Case The Code That Was Given Away

The University Esports Society runs one Instagram account with 14,000 followers. One account, one password, shared by the four committee members — and two-factor authentication switched on, with the login codes texted to the registered phone number.

At 23:47 on Thursday, that account posted a "NordVPN giveaway" linking to a fake login page. At least 60 students typed their Instagram passwords into it before the account was locked. Eleven minutes later, at 23:58, the account password was changed and all four committee members were locked out of their own society page.

Here is what makes this case worth your time: the two-factor authentication worked perfectly. Instagram sent the code to the registered phone exactly as designed. The attacker still got in. Somebody handed the code over.

Four people had the password. One of them gave away the code. Neither of those two is necessarily the person who took the account. Work out who logged in at 23:40 — and don't stop at whoever looks most guilty.