From Mindless Scrolling to Meaningful Discovery: Finding Security
summary
Shows concrete Instagram bugs found with no tools, using only the app on phone or web: an IG Lite muted reel leak (private audio unmuting) nets a base $3,500 reward; multi-image DM forwarding accidentally shares all images and is mitigated by a server-side block for multi-image forwards (bounty ~$500); draft/scheduled reelsposting bypass posts prematurely and gets a $5,000-range payout after bonuses; a close‑friends hiding/age bypass is fixed by adding a privacy access token. All fixes are escalated and deployed.
AI-written summary · about
chapters (9)
- 0:00Introduction to talk
- 1:50About Meta's bug bounty
- 7:51Instagram's attack surface
- 9:17Bug 1: IG Lite audio leak
- 14:48Bug 2: Multi-image forwarding
- 18:21Bug 3: Scheduled Reels leak
- 23:12Bug 4: Close Friends privacy flaw
- 28:59Benefits of Meta's program
- 30:27Q&A and contact details
related talks
42mHidden Chains: Revealing High-Impact Bugs from Bounty submissions
25mInvestigating Privacy Issues on Mobile Platforms
35mBug Bounty Hunting
55mAttacking Modern Web Technologies
29mThe Smörgåsbord of web app hacking
23mIntroduction to security research and bounty hunting on Apple's platforms
43mHow The Hack?
45mInoculating Rails Auth Against Bug Bounty Hunters