{"id":104862,"date":"2022-08-16T21:36:39","date_gmt":"2022-08-16T19:36:39","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/popytka-zahvata-uchyotnyh-zapisej-signal-cherez-komprometacziyu-sms-servisa-twilio"},"modified":"2022-08-16T21:36:39","modified_gmt":"2022-08-16T19:36:39","slug":"popytka-zahvata-uchyotnyh-zapisej-signal-cherez-komprometacziyu-sms-servisa-twilio","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/popytka-zahvata-uchyotnyh-zapisej-signal-cherez-komprometacziyu-sms-servisa-twilio","title":{"rendered":"Attempt to hijack Signal accounts through SMS service provider Twilio compromise","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
The developers of the open messaging app Signal have disclosed details about a targeted attack aimed at gaining control over the accounts of some users. The attack was conducted through the hacking of the Twilio service, which Signal uses to send SMS messages with confirmation codes. Analysis of the data revealed that the Twilio breach may have affected approximately 1,900 Signal user phone numbers, enabling attackers to re-register these phone numbers on another device, allowing them to send or receive messages for the associated phone number (access to past message history, profile information, and contacts could not be obtained since this information is stored on the user's device and not transmitted to Signal's servers). <\/p>\n
During the time from the breach until Twilio blocked the compromised employee account used for the attack, activity was observed on the noted 1,900 phone numbers related to account registration or sending verification codes via SMS. Meanwhile, by gaining access to Twilio's API, the attackers showed interest in three specific Signal user numbers, and at least one of the phones was linked to the attackers' device, according to a complaint received from the owner of the affected account. Signal sent SMS notifications about the incident to all users potentially impacted by the attack and revoked the registration of their devices. <\/p>\n
The Twilio breach was carried out using social engineering tactics that allowed the attackers to lure one of the company's employees to a phishing page and gain access to their account in the customer support system. In particular, attackers sent SMS messages to Twilio employees warning about the expiration of account activity or information about a schedule change, which included a link to a fake page styled to resemble the single sign-on interface for Twilio's services. According to Twilio, after connecting to the support interface, the attackers managed to access data related to 125 users. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"