Hackers Exploit Meta's AI Chatbot To Hijack Prominent Instagram Accounts
Some of the notable accounts that were affected by this security loophole include that of former president Barack Obama, the Chief Master Sergeant of US Space Force and cosmetics company Sephora. Once these accounts were compromised the hackers defaced the users’ Instagram pages with pro-Iranian imagery, videos and messages.
Tricking Meta’s AI chatbot didn’t require much effort, as all the hackers had to do was request a password reset for the target account and choose to handle the request using the AI assistant. Once the chat starts the attacker instructs the chatbot to link a new e-mail address, which the attacker controls, to the target account. With that change in place the hacker can receive a one-time security code and change the password to the account. The one hoop the bad actors had to jump through was using a VPN to obtain an IP address near the victim’s location.
Thankfully, Meta’s Vice President of Communications, Andy Stone, shared on social media platform X that “this issue has been resolved and we are securing impacted accounts.” While it’s great that the company took care of the problem quickly, it’s unnerving that the AI chatbot was so easily manipulated into giving an unauthorized user access to an account. Hopefully it’s a lesson that Meta and other companies can use to better secure AI systems.
Users are strongly encouraged to have some form of multi-factor authentication in place to protect online accounts, even basic SMS authentication is better than nothing. In this case, this extra security measure would’ve prevented at least some of these account takeovers.
