Security News > 2021 > June > Researcher Earns $30,000 for Instagram Flaw Exposing Private Posts
A researcher says he has earned $30,000 through Facebook's bug bounty program for reporting an Instagram vulnerability that exposed private posts.
In a blog post published on Tuesday, Mayur Fartade, a researcher based in India, said the flaw could have been exploited to access private or archived posts, stories, reels and IGTV videos without following the user whose content was targeted.
The security issue was serious, but its severity was mitigated by the fact that an attacker would need to somehow obtain the ID of the targeted media.
Sending a specially crafted POST request with the targeted content's media ID to a certain Instagram domain resulted in a display URL - this showed the targeted content - and additional data being returned.
The researcher said hackers could have also obtained these media IDs using brute-force attacks.
They could have used brute-forced IDs to collect data, and then determine which of the content was private or archived.