{"id":104862,"date":"2022-08-16T21:36:39","date_gmt":"2022-08-16T19:36:39","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/popytka-zahvata-uchyotnyh-zapisej-signal-cherez-komprometacziyu-sms-servisa-twilio"},"modified":"2022-08-16T21:36:39","modified_gmt":"2022-08-16T19:36:39","slug":"popytka-zahvata-uchyotnyh-zapisej-signal-cherez-komprometacziyu-sms-servisa-twilio","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hr\/blog\/news\/popytka-zahvata-uchyotnyh-zapisej-signal-cherez-komprometacziyu-sms-servisa-twilio","title":{"rendered":"Poku\u0161aj preuzimanja korisni\u010dkih ra\u010duna Signal putem kompromitacije SMS usluge Twilio","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Razvoda\u010di otvorenog mjenja\u010da Signal otkrili su informacije o ciljanom napadu usmjerenom na preuzimanje kontrole nad ra\u010dunima nekih korisnika. Napad je izveden putem hakiranja usluge Twilio, koja se koristi u Signalu za organizaciju slanja SMS poruka s kodovima potvrde. Analiza podataka pokazala je da je hakiranje Twilio moglo zahvatiti otprilike 1900 brojeva telefona korisnika Signala, za koje su napada\u010di imali mogu\u0107nost prenamjene brojeva telefona na drugi ure\u0111aj, nakon \u010dega su mogli primati ili slati poruke za povezani broj telefona (pristup povijesti prethodnih razgovora, informacija iz profila i adresara nije mogao biti ste\u010den, jer se takve informacije pohranjuju na ure\u0111aju korisnika i ne prenose na poslu\u017eitelje Signala). <\/p>\n

U razdoblju od trenutka hakiranja do blokiranja od strane Twilio kompromitirane ra\u010duna zaposlenika, kori\u0161tene za napad, na ozna\u010denih 1900 brojeva telefona zabilje\u017eena je aktivnost povezana s registracijom ra\u010duna ili slanjem potvr\u0111uju\u0107eg koda putem SMS-a. Pri tome, dobiv\u0161i pristup slu\u017ebenom su\u010delju Twilio, napada\u010di su se zanimali za konkretna tri broja korisnika Signala, a najmanje jedan od telefona uspjeli su povezati s ure\u0111ajem po\u010dinitelja, sude\u0107i prema pritu\u017ebi primljenoj od vlasnika pogo\u0111ene ra\u010duna. Signal je poslao SMS obavijesti o incidentu svim korisnicima koji su potencialno mogli biti pogo\u0111eni napadom i poni\u0161tio registraciju njihovih ure\u0111aja. <\/p>\n

Hakiranje Twilio izvr\u0161eno je kori\u0161tenjem metoda dru\u0161tvenog in\u017eenjeringa, koje su napada\u010dima omogu\u0107ile da navedu jednog od zaposlenika kompanije na phishing stranicu i dobiju pristup njegovom korisni\u010dkom ra\u010dunu u sustavu podr\u0161ke kupcima. Konkretno, napada\u010di su slali SMS poruke zaposlenicima Twilio s upozorenjem o isteku roka trajanja ra\u010duna ili informacijama o izmjenama rasporeda, uz koje je bila prilo\u017eena poveznica na la\u017enu stranicu, stiliziranu prema su\u010delju jedinstvenog prijavljivanja u slu\u017ebene usluge Twilio. Prema podacima Twilio, povezav\u0161i se na su\u010delje slu\u017ebe podr\u0161ke, napada\u010di su uspjeli dobiti pristup podacima vezanim za 125 korisnika.
\n
Izvor: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0433\u043e \u043c\u0435\u0441\u0441\u0435\u043d\u0434\u0436\u0435\u0440\u0430 Signal \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e \u0446\u0435\u043b\u0435\u0432\u043e\u0439 \u0430\u0442\u0430\u043a\u0435, \u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u043e\u0439 \u043d\u0430 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u0435 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u043d\u0430\u0434 \u0443\u0447\u0451\u0442\u043d\u044b\u043c\u0438 \u0437\u0430\u043f\u0438\u0441\u044f\u043c\u0438 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439. \u0410\u0442\u0430\u043a\u0430 \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0430 \u0447\u0435\u0440\u0435\u0437 \u0432\u0437\u043b\u043e\u043c \u0441\u0435\u0440\u0432\u0438\u0441\u0430 Twilio, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0433\u043e \u0432 Signal \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 SMS-\u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0439 \u0441 \u043a\u043e\u0434\u0430\u043c\u0438 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0438\u044f. \u0410\u043d\u0430\u043b\u0438\u0437 \u0434\u0430\u043d\u043d\u044b\u0445 \u043f\u043e\u043a\u0430\u0437\u0430\u043b, \u0447\u0442\u043e \u0432\u0437\u043b\u043e\u043c Twilio \u043c\u043e\u0433 \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u044c \u043e\u043a\u043e\u043b\u043e 1900 \u043d\u043e\u043c\u0435\u0440\u043e\u0432 \u0442\u0435\u043b\u0435\u0444\u043e\u043d\u043e\u0432 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 Signal, \u0434\u043b\u044f \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435 \u0438\u043c\u0435\u043b\u0438 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043f\u0435\u0440\u0435\u0440\u0435\u0433\u0438\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043d\u043e\u043c\u0435\u0440\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-104862","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Poku\u0161aj preuzimanja ra\u010duna Signala putem kompromitacije SMS usluge Twilio | ProHoster","description":"Razvojni tim otvorenog mjernog alata Signal otkrio je detalje o ciljanom napadu usmjerenom na preuzimanje kontrole nad ra\u010dunima nekih korisnika.","canonical_url":"https:\/\/prohoster.info\/hr\/blog\/news\/popytka-zahvata-uchyotnyh-zapisej-signal-cherez-komprometacziyu-sms-servisa-twilio","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hr_HR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u043e\u043f\u044b\u0442\u043a\u0430 \u0437\u0430\u0445\u0432\u0430\u0442\u0430 \u0443\u0447\u0451\u0442\u043d\u044b\u0445 \u0437\u0430\u043f\u0438\u0441\u0435\u0439 Signal \u0447\u0435\u0440\u0435\u0437 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044e SMS-\u0441\u0435\u0440\u0432\u0438\u0441\u0430 Twilio | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0433\u043e \u043c\u0435\u0441\u0441\u0435\u043d\u0434\u0436\u0435\u0440\u0430 Signal \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e \u0446\u0435\u043b\u0435\u0432\u043e\u0439 \u0430\u0442\u0430\u043a\u0435, \u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u043e\u0439 \u043d\u0430 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u0435 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u043d\u0430\u0434 \u0443\u0447\u0451\u0442\u043d\u044b\u043c\u0438 \u0437\u0430\u043f\u0438\u0441\u044f\u043c\u0438 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439.","og:url":"https:\/\/prohoster.info\/hr\/blog\/news\/popytka-zahvata-uchyotnyh-zapisej-signal-cherez-komprometacziyu-sms-servisa-twilio","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-08-16T19:36:39+00:00","article:modified_time":"2022-08-16T19:36:39+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"104862","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-08-16 19:37:46","updated":"2022-09-28 09:18:42","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/104862","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/comments?post=104862"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/104862\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media?parent=104862"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/categories?post=104862"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/tags?post=104862"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}