Vagadziri veakavhurika-sosi messenger Signal vakaburitsa ruzivo nezve kurwiswa kwakanangwa kwakanangana nekuwana kutonga pamusoro peakaundi yevamwe vashandisi. Kurwiswa uku kwakaitwa nekubira Twilio sevhisi, iyo Signal inoshandisa kutumira mameseji eSMS ane macode ekusimbisa. Ongororo yedata yakaratidza kuti Twilio hack inogona kunge yakakanganisa nhamba dzenhare dzevashandisi veSignal dzinosvika chiuru nemazana mapfumbamwe, izvo vapambi vakakwanisa kunyoresazve nhamba dzenhare pane imwe mudziyo, vobva vagamuchira kana kutumira mameseji enharembozha yakabatana (kusvika kunhoroondo yetsamba dzakapfuura, ruzivo rweprofile uye bhuku rekero hazvigone kuwanikwa, sezvo ruzivo rwakadai rwakachengetwa pachishandiso chemushandisi uye Chiratidzo chisina kutumirwa kune server).
Pakati penguva yekutyora uye Twilio ichivharira iyo account yevashandi yakakanganiswa yakashandiswa mukurwiswa, nhamba dzerunhare 1900 dziri mubvunzo dzakaratidza chiitiko chine chekuita nekunyoresa account kana kutumira macode ekusimbisa kuburikidza neSMS. Vapambi vacho vaifarira nhamba nhatu dzeSignal mushandisi mushure mekuwana mukana weTwilio service interface, uye imwe yenharembozha yaive yakabatana nemudziyo wevanorwisa, maererano nechichemo chakagamuchirwa kubva kumuridzi weakaundi yakakanganisika. Signal yakatumira zviziviso zveSMS nezve chiitiko kune vese vashandisi vangangokanganisika uye vakadzima zvishandiso zvavo.
The Twilio hack yakaitwa pachishandiswa masocial engineering matekiniki ayo aibvumira varwisi kukwezva mumwe wevashandi vekambani kune phishing peji uye kuwana mukana kuakaundi yake mutsigiro yevatengi. Kunyanya, vapambi vakatumira mameseji eSMS kuvashandi veTwilio yambiro nezve kupera kweakaunti kana ruzivo nezve shanduko yehurongwa, iyo yaive nekubatanidza kune peji rekunyepedzera rakanyorerwa seimwe yekusaina-painterface yeTwilio sevhisi masevhisi. Maererano neTwilio, nekubatanidza kune yekutsigira interface, vapambi vakakwanisa kuwana ruzivo rwakabatana nevashandisi ve125.
Source: opennet.ru
