8 ms·

Millions of SMS messages exposed in database security lapse

189 points by known 7y ago

threatofrain 7y ago
> But the data also contained sensitive text messages, such as two-factor codes and other security messages, which may have allowed anyone viewing the data to gain access to a person’s online accounts. Many of the messages we reviewed contained codes to access online medical services to obtain, and password reset and login codes for sites including Facebook and Google accounts. > The data also contained usernames and passwords of TrueDialog’s customers, which if used could have been used to access and impersonate their accounts.
- retSava 7y ago
  Hence why 2FA tokens and reset links should have a short window of validity, and why shallow information such as knowing account name, or address, or mothers maiden name, should not be used for sensitive purposes.
  - faeyanpiraat 7y ago
    It is considered a security best practice to use a 2fa app (like Authy), or a physical token instead of SMS. This way when the token generator is lost you at least notice it in a reasonable timeframe. For critical systems where 2fa is enabled I also do a "simulated" device loss, where I go trough all the steps at least once that I would have to do in case of a real device loss (fetching backup codes, revoking token, resetting password, adding new token). This way I do not have to constantly worry about losing critical items, because I'm prepared for the worst and I can be calm. It also helps to have all your data encrypted at rest with Bitlocker or Veracrypt (hard to enforce this rule on yourself for pendrives, but oh well..).
    - teel 7y ago
      Thanks! That (simulated device loss followed by all the steps you mentioned) is something I plan to do every now and then but so far I've never gotten around to actually doing it. Encouraged by your post think I'll finally do it (some day, hopefully sooner rather than later).
  - threatofrain 7y ago
    This brings up some interesting technical questions: how long is too long and what is a deep question for identity?
    - a3n 7y ago
      Your imaginary friend's mother's maiden name.
      - blowski 7y ago
        Which also happens to be an extremely rare maiden name - i.e. not Smith but "Vortangula" or "Brinderbass".
        pavel_lishin 7y ago
        > Vortangula Brinderbass Thank you for the new D&D character name.
    - theshadowknows 7y ago
      One time I did a "forgot password" reset on an old email account. Apparently young me thought it was a good idea to choose the 'pick your own question' thing and the question I chose was "What?" ...to this day I still don't remember what the answer was.
      - dpeck 7y ago
        Depending on how young, there’s a decent chance the answer was some variation of “chicken butt”
        wkearney99 7y ago
        I have an 11 year old. You're sooo right about the chance that's it...
        theshadowknows 7y ago
  - tinus_hn 7y ago
    Hence why SMS is not a valid part of any authentication system that should be secure.
- ga-vu 7y ago
  This article massively overhypes the breach. 2FA and password resets have a very short window of validity. The database contained historical messages and did not operate in real-time.
  - pmorici 7y ago
    How do you know it didn’t operate in real-time? The article doesn’t contain enough information to know.
    - threatofrain 7y ago
      If it wasn’t real time then how would short lived auth solutions even work?
      - epanchin 7y ago
        I understand they mean the database
  - nkrisc 7y ago
    Perhaps, but you're also making a lot of assumptions about the security practices of companies that send you info via SMS.
    - eganist 7y ago
      To your point: I can count on two hands the number of companies I've encountered that iterate HOTP on use rather than on issuance. ...which means there are bound to be a few stale but still active SMS codes lingering in there from people who attempted but did not complete authentication e.g. because they entered the wrong number or didn't have access to the number they attempted to use when signing in. Services impacted are any which allow for users to authenticate with _just_ SMS HOTP and which don't expire unused codes. That number is unfortunately high enough for me to think that this is equatable to a small credential breach.
sojmq 7y ago
Nice clickbait. A database from a B2C provider, not personal texts from a telco.
- lightedman 7y ago
  What's the difference? Security breaches are security breaches, no matter what.
breakingcups 7y ago
> TechCrunch contacted TrueDialog about the exposure, which promptly pulled the database offline. Despite reaching out several times, TrueDialog’s chief executive John Wright would not acknowledge the breach nor return several requests for comment. Wright also did not answer any of our questions — including whether the company would inform customers of the security lapse and if he plans to inform regulators, such as state attorneys general, per state data breach notification laws. Though it doesn't mention a timeline, this does seem like a way to pour gasoline onto a PR dumpster fire.
ga-vu 7y ago
Actual source: https://www.vpnmentor.com/blog/report-truedialog-leak/ https://www.vpnmentor.com/blog/report-truedialog-leak/ Saved you a click
haolez 7y ago
From the original article, it seems to be ElasticSearch again. Why do so many companies expose ES to the open internet?
- tyingq 7y ago
  Terrible defaults, and stuff like this: https://discuss.elastic.co/t/ransom-attack-on-elasticsearch-cluster/71310/17 https://discuss.elastic.co/t/ransom-attack-on-elasticsearch-...
  - nullwarp 7y ago
    I will never understand why basic authentication in ES was locked behind a X-Pack license. That's always seemed absolutely bonkers to me.
    - vageli 7y ago
      > I will never understand why basic authentication in ES was locked behind a X-Pack license. That's always seemed absolutely bonkers to me. Security is an enterprise feature. Dealing with this now trying to enable SAML in a few SaaS apps, for example.
      - tyingq 7y ago
        It's not just locked behind the X-Pack...if you choose a trial, it works. Then, when the trial expires, poof...it's wide open. Surely there's a better way to handle that.
        user5994461 7y ago
        As horrible at it sounds, it's just business. Large companies have a checklist that databases MUST be protected by authentication, so they always pay for the enterprise edition just to get authentication, and corollary the only way as a software editor to get money is to have authentication behind a pay wall.
woadwarrior01 7y ago
IMO, mining SMS messages for data is by definition going too far in terms of intrusion into people's privacy. On a related note, I came across a post on the machine learning subreddit[1] recently, where the author claims to have a dataset of 33 million SMSs in Mexican Spanish. I'm half suspecting the OP added the Mexican prefix to prevent anyone from doubting that his dataset was collected in Spain (In which case, GDPR applies). This was likely collected from an Android app which surreptitiously collected with the "Telephony.SMS_RECEIVED" intent, and the author half confirms it[2]. Regardless of the legality of doing so, reading people's private SMSs just reeks of privacy violations. iOS in this specific case does the right thing by not letting apps read incoming text messages (except for the limited case of reading single-factor SMS login codes[3], which was introduced in iOS 12). [1]: https://www.reddit.com/r/MachineLearning/comments/e0z7xs/discussion_hyperparameters_for_word2vec_for_sms/ https://www.reddit.com/r/MachineLearning/comments/e0z7xs/dis... [2]: https://www.reddit.com/r/MachineLearning/comments/e0z7xs/discussion_hyperparameters_for_word2vec_for_sms/f8lfbpt https://www.reddit.com/r/MachineLearning/comments/e0z7xs/dis... [3]: https://developer.apple.com/documentation/uikit/uitextcontenttypeonetimecode https://developer.apple.com/documentation/uikit/uitextconten...
- travem 7y ago
  > except for the limited case of reading single-factor SMS login codes Is the app actually reading the code? I thought this was just a UI hint that made it easier for the user to select the code from the suggestion area of the keyboard
  - dlhavema 7y ago
    You don't code anything in your app to get/use this feature. If you click the suggestion iOS fills in the passcode for the user.
- mattkrause 7y ago
  Latin American Spanish and Castilian differ quite a bit (and there are pretty obvious differences within Latin America too), so I'm not sure this is necessarily a GDPR cop-out.
- 7y ago
Avery3R 7y ago
Non-techcrunch link https://www.vpnmentor.com/blog/report-truedialog-leak/?=truedialog-exposed-data https://www.vpnmentor.com/blog/report-truedialog-leak/?=true...
ryanmcdonough 7y ago
I wonder if this is why I’ve been getting phone call spam from Switzerland & Turkmenistan the past few days.
spamlord 7y ago
Where can I download the database to see if any of my own information has been pwnd?

189 points by known 7y ago

> But the data also contained sensitive text messages, such as two-factor codes and other security messages, which may have allowed anyone viewing the data to gain access to a person’s online accounts. Many of the messages we reviewed contained codes to access online medical services to obtain, and password reset and login codes for sites including Facebook and Google accounts. > The data also contained usernames and passwords of TrueDialog’s customers, which if used could have been used to access and impersonate their accounts.

retSava 7y ago
Hence why 2FA tokens and reset links should have a short window of validity, and why shallow information such as knowing account name, or address, or mothers maiden name, should not be used for sensitive purposes.
- faeyanpiraat 7y ago
  It is considered a security best practice to use a 2fa app (like Authy), or a physical token instead of SMS. This way when the token generator is lost you at least notice it in a reasonable timeframe. For critical systems where 2fa is enabled I also do a "simulated" device loss, where I go trough all the steps at least once that I would have to do in case of a real device loss (fetching backup codes, revoking token, resetting password, adding new token). This way I do not have to constantly worry about losing critical items, because I'm prepared for the worst and I can be calm. It also helps to have all your data encrypted at rest with Bitlocker or Veracrypt (hard to enforce this rule on yourself for pendrives, but oh well..).
  - teel 7y ago
    Thanks! That (simulated device loss followed by all the steps you mentioned) is something I plan to do every now and then but so far I've never gotten around to actually doing it. Encouraged by your post think I'll finally do it (some day, hopefully sooner rather than later).
- threatofrain 7y ago
  This brings up some interesting technical questions: how long is too long and what is a deep question for identity?
  - a3n 7y ago
    Your imaginary friend's mother's maiden name.
    - blowski 7y ago
      Which also happens to be an extremely rare maiden name - i.e. not Smith but "Vortangula" or "Brinderbass".
      - pavel_lishin 7y ago
        > Vortangula Brinderbass Thank you for the new D&D character name.
  - theshadowknows 7y ago
    One time I did a "forgot password" reset on an old email account. Apparently young me thought it was a good idea to choose the 'pick your own question' thing and the question I chose was "What?" ...to this day I still don't remember what the answer was.
    - dpeck 7y ago
      Depending on how young, there’s a decent chance the answer was some variation of “chicken butt”
      - wkearney99 7y ago
        I have an 11 year old. You're sooo right about the chance that's it...
      - theshadowknows 7y ago
- tinus_hn 7y ago
  Hence why SMS is not a valid part of any authentication system that should be secure.
ga-vu 7y ago
This article massively overhypes the breach. 2FA and password resets have a very short window of validity. The database contained historical messages and did not operate in real-time.
- pmorici 7y ago
  How do you know it didn’t operate in real-time? The article doesn’t contain enough information to know.
  - threatofrain 7y ago
    If it wasn’t real time then how would short lived auth solutions even work?
    - epanchin 7y ago
      I understand they mean the database
- nkrisc 7y ago
  Perhaps, but you're also making a lot of assumptions about the security practices of companies that send you info via SMS.
  - eganist 7y ago
    To your point: I can count on two hands the number of companies I've encountered that iterate HOTP on use rather than on issuance. ...which means there are bound to be a few stale but still active SMS codes lingering in there from people who attempted but did not complete authentication e.g. because they entered the wrong number or didn't have access to the number they attempted to use when signing in. Services impacted are any which allow for users to authenticate with _just_ SMS HOTP and which don't expire unused codes. That number is unfortunately high enough for me to think that this is equatable to a small credential breach.

sojmq 7y ago

Nice clickbait. A database from a B2C provider, not personal texts from a telco.

lightedman 7y ago
What's the difference? Security breaches are security breaches, no matter what.

breakingcups 7y ago

> TechCrunch contacted TrueDialog about the exposure, which promptly pulled the database offline. Despite reaching out several times, TrueDialog’s chief executive John Wright would not acknowledge the breach nor return several requests for comment. Wright also did not answer any of our questions — including whether the company would inform customers of the security lapse and if he plans to inform regulators, such as state attorneys general, per state data breach notification laws. Though it doesn't mention a timeline, this does seem like a way to pour gasoline onto a PR dumpster fire.

ga-vu 7y ago

Actual source: https://www.vpnmentor.com/blog/report-truedialog-leak/ https://www.vpnmentor.com/blog/report-truedialog-leak/ Saved you a click

haolez 7y ago

From the original article, it seems to be ElasticSearch again. Why do so many companies expose ES to the open internet?

tyingq 7y ago
Terrible defaults, and stuff like this: https://discuss.elastic.co/t/ransom-attack-on-elasticsearch-cluster/71310/17 https://discuss.elastic.co/t/ransom-attack-on-elasticsearch-...
- nullwarp 7y ago
  I will never understand why basic authentication in ES was locked behind a X-Pack license. That's always seemed absolutely bonkers to me.
  - vageli 7y ago
    > I will never understand why basic authentication in ES was locked behind a X-Pack license. That's always seemed absolutely bonkers to me. Security is an enterprise feature. Dealing with this now trying to enable SAML in a few SaaS apps, for example.
    - tyingq 7y ago
      It's not just locked behind the X-Pack...if you choose a trial, it works. Then, when the trial expires, poof...it's wide open. Surely there's a better way to handle that.
      - user5994461 7y ago
        As horrible at it sounds, it's just business. Large companies have a checklist that databases MUST be protected by authentication, so they always pay for the enterprise edition just to get authentication, and corollary the only way as a software editor to get money is to have authentication behind a pay wall.

woadwarrior01 7y ago

IMO, mining SMS messages for data is by definition going too far in terms of intrusion into people's privacy. On a related note, I came across a post on the machine learning subreddit[1] recently, where the author claims to have a dataset of 33 million SMSs in Mexican Spanish. I'm half suspecting the OP added the Mexican prefix to prevent anyone from doubting that his dataset was collected in Spain (In which case, GDPR applies). This was likely collected from an Android app which surreptitiously collected with the "Telephony.SMS_RECEIVED" intent, and the author half confirms it[2]. Regardless of the legality of doing so, reading people's private SMSs just reeks of privacy violations. iOS in this specific case does the right thing by not letting apps read incoming text messages (except for the limited case of reading single-factor SMS login codes[3], which was introduced in iOS 12). [1]: https://www.reddit.com/r/MachineLearning/comments/e0z7xs/discussion_hyperparameters_for_word2vec_for_sms/ https://www.reddit.com/r/MachineLearning/comments/e0z7xs/dis... [2]: https://www.reddit.com/r/MachineLearning/comments/e0z7xs/discussion_hyperparameters_for_word2vec_for_sms/f8lfbpt https://www.reddit.com/r/MachineLearning/comments/e0z7xs/dis... [3]: https://developer.apple.com/documentation/uikit/uitextcontenttypeonetimecode https://developer.apple.com/documentation/uikit/uitextconten...

travem 7y ago
> except for the limited case of reading single-factor SMS login codes Is the app actually reading the code? I thought this was just a UI hint that made it easier for the user to select the code from the suggestion area of the keyboard
- dlhavema 7y ago
  You don't code anything in your app to get/use this feature. If you click the suggestion iOS fills in the passcode for the user.
mattkrause 7y ago
Latin American Spanish and Castilian differ quite a bit (and there are pretty obvious differences within Latin America too), so I'm not sure this is necessarily a GDPR cop-out.
7y ago

Avery3R 7y ago

Non-techcrunch link https://www.vpnmentor.com/blog/report-truedialog-leak/?=truedialog-exposed-data https://www.vpnmentor.com/blog/report-truedialog-leak/?=true...

ryanmcdonough 7y ago

I wonder if this is why I’ve been getting phone call spam from Switzerland & Turkmenistan the past few days.

spamlord 7y ago

Where can I download the database to see if any of my own information has been pwnd?