In order to take advantage of the trick, minimal knowledge about the work of HTML and the browser is enough.
Photos and videos in closed accounts on Instagram and Facebook were not so closed. According to BuzzFeed, with a simple trick, friends and subscribers on social networks can not only view them, but also upload and share them with other users.
In order to take advantage of the aforementioned method, a minimal knowledge of how HTML and the browser work is enough. An attacker can examine the source code of a web page (for example, by resorting to the Inspect Elements tool), use the tabs to get to the Img section and find the URL of any image that he clicked on. This URL is public and can be sent to other users, including those not authorized on Instagram and not subscribers of this closed account.
As the results of testing conducted by specialists of the BuzzFeed Tech + News Working Group showed, the above method allows you to view, upload and share files in JPEG and MP4 formats published on closed pages and in the “Stories”.
Facebook does not consider the problem to be dangerous. “The described actions are equivalent to creating a screenshot of a friend’s photo on Facebook or Instagram and sharing it with other people. They do not allow access to closed accounts, ”company representatives said.
