Instacart Patches Security Bug That Would Have Let Attackers Spoof SMS Messages

guest · May 5, 2020

Instacart Patches Security Bug That Would Have Let Attackers Spoof SMS Messages
May 5, 2020
https://www.darkreading.com/risk/in...t-attackers-spoof-sms-messages/d/d-id/1337734

Grocery delivery service Instacart has fixed a security flaw on its website that would have allowed attackers to send SMS messages containing malicious links to any mobile number.

A security researcher from Tenable Research discovered the vulnerability while using Instacart to buy dog food recently and reported it to the company on April 28. The shopping service fixed the issue on May 1, reducing risk for the millions of users who have begun using the service amid social distancing rules tied to the COVID-19 pandemic.
The problem had to do with a feature on Instacart's website that is designed to get users to download the company's mobile app.

Jimi Sebree, a security research engineer at Tenable, discovered that when an Internet user provides a mobile phone number, a request is sent to a "request_invite" endpoint at Instacart.

"The actual payload of the request includes the phone number entered into the field, as well as a unique link to download the Instacart mobile application," Tenable said in a report on the issue today.
Click to expand...

Tenable: Instacart Patches SMS Spoofing Vulnerability Discovered by Tenable Research

As the attacker can control the URL sent to a victim, they could point to a host under their control and embed code within the target URL to attempt various exploits determined by the user-agent passed by the victim’s web browser.

Unsolicited SMS messages aren’t new, but they create a unique problem for end users as there’s no way to validate the links they’ve received are, in fact, legitimate.
Impact
At the time of this writing, there is no evidence that this flaw has been used by malicious actors. However, if exploited, an attacker could have used this vulnerability to distribute malware or attempt phishing campaigns.
Solution
As of May 1, this issue has been fixed. Since the flaw was server-side on Instacart’s infrastructure, no updates or action is required by users of their service.
Click to expand...

Log in or Sign up

Instacart Patches Security Bug That Would Have Let Attackers Spoof SMS Messages

guest Guest

Log in or Sign up

Instacart Patches Security Bug That Would Have Let Attackers Spoof SMS Messages

guest Guest

Useful Searches