Text message database reportedly leaked password resets

guest · Nov 19, 2018

Text message database reportedly leaked password resets
Unprotected server yields password resets and two-factor security codes, TechCrunch reports
November 16, 2018
https://www.cnet.com/news/text-message-database-reportedly-leaked-password-resets/

Voxox, a San Diego-based communications company maintained the server, which was left unprotected by password, offering anyone knowing where to look a real-time glimpse at a steady stream of text messages, TechCrunch reported Thursday.

The database appeared to contain more than 26 million text messages, each containing the message and tagged with the recipient's cell phone number, TechCrunch reported.
Among the information reportedly discovered were security codes sent by Fidelity Investments, a temporary banking password sent by a Silicon Valley credit union and an Amazon tracking notification with UPS tracking information.

"Our resources are looking into the issue and following standard data breach policy at the moment," Barrett Brown, director of customer service at Voxox, said in a statement.
Click to expand...

guest · Nov 19, 2018

mood said: ↑

Text message database reportedly leaked password resets
Unprotected server yields password resets and two-factor security codes, TechCrunch reports
Click to expand...

Here's Why Account Authentication Shouldn't Use SMS
November 19, 2018
https://www.inforisktoday.com/heres-account-authentication-shouldnt-use-sms-a-11708

SMS Weaknesses
The risk posed by sending anything via SMS is well known and has been repeatedly flagged. In July 2016, the National Institute of Standards and Technology advised that SMS should be deprecated.

SIM swaps or hijacks - where attackers gain control of someone's mobile phone number - is one way to capture a two-step verification code sent by SMS.
2FA Adoption Remains Challenging
Service providers are diversifying their options for delivering two-step verification codes, supporting independent code generators such as Google's Authenticator, Authy and Duo and others. Those types of applications take SMS out of the equation.

But there's still a heavy reliance on SMS. Google, LinkedIn, Instagram and other service providers sometimes still use that mobile channel for password resets, depending on how an account is configured.
Click to expand...

guest · Jan 15, 2019

Another huge database exposed millions of call logs and SMS text messages
January 15, 2019
https://techcrunch.com/2019/01/15/a...-millions-of-call-logs-and-sms-text-messages/

This time around, it’s a different company: Voipo, a Lake Forest, California communications provider, exposed tens of gigabytes worth of customer data.
The company’s backend routes calls and processes text messages for its users. But because one of the backend ElasticSearch databases wasn’t protected with a password, anyone could look in and see streams of real-time call logs and text messages sent back and forth.

It’s one of the largest data breaches of the year — so far — totaling close to seven million call logs, six million text messages, and other internal documents containing unencrypted passwords that if used could have allowed an attacker to gain deep access to the company’s systems.

Paine said, and noted in his write-up, that the database was exposed since June 2018, and contains call and message logs dating back to May 2015. He told TechCrunch that the logs were updated daily and went up to January 8 — the day the database was pulled offline.
Click to expand...

Log in or Sign up

Text message database reportedly leaked password resets

guest Guest

guest Guest

guest Guest

Log in or Sign up

Text message database reportedly leaked password resets

guest Guest

guest Guest

guest Guest

Useful Searches