In early days of web development I was reading a book on web security. The first line of the book was "The client should not be trusted". The client here refers to anything that makes a request to the server, for example a browser. It is the server's responsibility to sanitize everything that comes from the client.
Although a very basic rule, I have seen big players sometimes trusting the client.
It seems Instagram has developed a query language similar to SQL for its own purposes (popularly called Instagram Private Api). For example a SQL query "SELECT post_id FROM posts LIMIT 0,10" would fetch first 10 posts from a table. Instagram has a query language on similar lines (see the picture above).
Developing a query language is a very cool thing. But Instagram instead of using this query on its server side, sends the query as a parameter in AJAX requests. The AJAX request shown in the picture sends the query to get the next 10 followers of a user.
More importantly Instagram does not validate all AJAX request parameters on the server side. For example it gets 10 entries with each AJAX request dealing with getting the followers of a user. Anyone can get 100 followers just by replacing 10 by 100 in the parameters of the AJAX request.
This is turning out to be boon for Instagram bots. Marketing guys have seen business in Instagram. Services such as increasing the number of followers are very popular. Of course these services don't increase the no of followers by using human hands — they use bots.
A popular trick to increase your no of followers is to follow a lot of people. These people whom you follow — may follow you back. If you send following requests to 10000 people, 800 may follow you back. Not a bad deal if you are using bots to achieve it.
How An Ideal Bot Would Work
If Instagram were to validate that 10000 is not allowed, it might send an error message. The bot would would have no option but to send 1000 AJAX requests (instead of one) to get 10000 followers. Instagram's Intrusion Detection Systems might turn suspicious to see a client sending 1000 similar requests. It may then take appropriate actions. Bot-ism would be prevented
What Needs To Be Done
Of course this thing not a security issue, but it does not look cool coming from Instagram's side. The first thing Instagram needs to do it to remove the query language from the frontend. There is no need to tell people that internally it uses a query language. They are simply inviting hackers. They can use the query language in the server side.
The second thing would be to validate the AJAX requests.
Bots are a pain to web servers, but nevertheless they are important for research purposes. Servers should take all steps possible to cut down bots. Bots on the other hand are aggressive enough to find better ways to automate. All this will be important to take Artifical Intelligence to the next level.