A Berlin-based security researcher has discovered an unsecured database containing tens of millions of text messages including password reset links, two-factor authentication codes and more.
The server itself belongs to the communications company Voxox (formerly Telcentris) which failed to secure it and the data it holds with a password. This made it possible for anyone who knew where it was located online to have a look and see a near-real-time stream of incoming text messages.
Security researcher Sébastien Kaul found the server easily on Shodan, a search engine for publicly available devices and databases. The database was running on Amazon’s Elasticsearch and was configured with a Kibana front-end which made the data it held easy to read and search for names, phone numbers and even the contents of the text messages it stored.
Businesses have begun to employ two-factor authentication to better secure their services and although firms such as Telesign and Nexmo are used to verify phone numbers or send out authentication codes, Voxox and other companies are responsible for converting these codes into text messages.
Database contents
After TechCrunch got in touch with Voxox, the database was eventually taken offline. However, before it was, the database had over 26m text messages year-to-date but this number could actually be higher due to how many messages the platform processed per minute.
The records stored on the database were very detailed and included the cell phone number of the recipient, the message and the details of the Voxox customer who initially sent the message.
Kaul provided further insight on TechCrunch’s findings, saying:
Yeah, this is very bad. My real concern here is the potential that this has already been abused. This is different from most breaches, due to the fact the data is temporary, so once it’s offline any data stolen isn’t very useful.”
Voxox’s failure to secure its database highlights just some of the many problems with SMS-based verification and shows why companies have moved away from it in favour of two-factor authentication.
Via TechCrunch
Be the first to comment