5 ms·

"Twilio put out at midnight last night. In that Press Release, Twilio accidentally revealed which services Parler was using. Turns out it was all of the securit

by neya 6y ago

"Twilio put out at midnight last night. In that Press Release, Twilio accidentally revealed which services Parler was using. Turns out it was all of the security authentications that were used to register a user. This allowed anyone to create a user, and not have to verify an email address, and immediately have a logged-on account. Well, because of that access, it gave them access to the behind the login box API that is used to deliver content -- ALL CONTENT (parleys, video, images, user profiles, user information, etc) --. But what it also did was revealed which USERS had "Administration" rights, "Moderation" rights. Well, then what happened, those user accounts that had Administration rights to the entire platform... The hackers, internet warriors, call it what you will, was able to use the forgot password link to change the password. Why? Because Twilio was no longer authenticating emails. This meant, they'd get directly to the reset password screen of that Administration user." I'm not from the US, but as an outsider, this leaves a really bad taste with how Twilio handled the situation AS A BUSINESS.

Udik 6y ago
> Because Twilio was no longer authenticating emails. Can someone explain what does this mean?
- dgellow 6y ago
  Trying to make sense of it, I believe that means Parler was delegating their email verification and 2fa checks to Twillio. And somehow, without access to Twillio's API, they defaulted to not do any check at all? I'm not sure what to do of this, that doesn't sound that realistic but who knows.
  - beerandt 6y ago
    That, or Twillio was reporting authenticated emails, without actually authenticating them? It seems to involve some skipped auth steps on someones part though, not just a fail-safe/fail-dead mixup. It's not clear.
    - myaccount275 6y ago
      Maybe Parler was deciding based on HTTP status codes returned from the Twilio API, or the presence of some expected "error" field in the response (if it's not there, consider it ok), and one side screwed up the handling of an unexpected case? Pure speculation. Instead of having "if explicitly ok, proceed", they maybe had "unless it's an explicit negative response in an expected format (or a connectivity issue, timeout, etc.), proceed"? Which would be a pretty dumb thing to do, but I've seen worse.
  - tutfbhuf 6y ago
    > they defaulted to not do any check at all? That would be a very unsafe default.
    - rbanffy 6y ago
      They wanted more users to register - they were urging users to invite friends and family - so they may have changed the safe default to the unsafe one thinking on verifying later without realizing the full consequences of what they did.
  - drewmol 6y ago
    Maybe it was more complex: Create new acct 1 using valid email. Request users by username and see privilege. Find likely phone # and likely email for user : arroganttechfounder1 (admin). Create new acct 2 using likely phone number (fail, account exists). Change (add) new acct 1 phone # to match likely phone number (normally, the twilio validation step here would prevent duplicate phone numbers for multiple accounts?). Request pw reset for phone number (pw reset key saved to both accts?), no sms sent. Request pw reset for email (new acct 1) and logic sees non-expired key from previous request, emails you same key. Modify url to reset pw for arroganttechfounder1 using phone # and key.
  - Alex3917 6y ago
    > And somehow, without access to Twillio's API, they defaulted to not do any check at all? I guess you could imagine user accounts being created with `authenticated=null`, and then having `authenticated=False|True` set in the in the success handler for some Twillio API call. Having null as the default would allow you to see in the database where authentication emails hadn't been sent out, so you could resend them. And then I guess you could imagine a developer checking authentication by looking for cases where `!authenticated`, rather than `authenticated == True`. Granted I don't think this hack is real, but if it were then that's probably how it would play out.
  - nunez 6y ago
    Nope it was totally realistic. I tried to create an account on Parler last night to check which services were turned off by AWS. I entered dummy data into their form. The POST to their auth service timed out...but the auth flow took you to the success page anyway?
- mikewarot 6y ago
  It's basically the scenario Tom Scott laid out about what would happen if Google stopped checking passwords... except it happened to Parler. https://www.youtube.com/watch?v=y4GB_NDU43Q https://www.youtube.com/watch?v=y4GB_NDU43Q
davedx 6y ago
I would hold off judging Twilio based on a random anonymous reddit post's account
de6u99er 6y ago
Hijacking top comment. Here's the data: https://donk.sh/06d639b2-0252-4b1e-883b-f275eff7e792/ https://donk.sh/06d639b2-0252-4b1e-883b-f275eff7e792/ #noflylist is trending on Twitter. Guess a lot of jobs will soon be available in Silicon Valley.
- willejs 6y ago
  That is just a list of parler public urls.
  - MacsHeadroom 6y ago
    The URL lists were used to distribute archiving of media content. 70TB of text, image, video, and metadata content was downloaded in a few hours with essentially a volunteer botnet. The team at archive.org is importing the full archive right now.
    - de6u99er 6y ago
      I don't know about that's Only that the FBI is creating their nofly lists based on it.
- kodah 6y ago
  Just a disclaimer, in case anyone has forgotten about the great ion cannon from back in the day: If any of these Twitter or Reddit posts are true then I would talk to a lawyer before participating.
  - de6u99er 6y ago
    Participating in what?
Udik 6y ago
BTW, where is that Press Release? Can't find it on the Twilio website.
nl 6y ago
Did Twilio actually make this alleged press release? There is nothing like that on https://www.twilio.com/press/releases https://www.twilio.com/press/releases
- diebeforei485 6y ago
  I have the same question about the press release. Where was it posted and what was its content? I know that not all press statements are going to be on the website.
newbie578 6y ago
You said it nicely. At the end of the day, we all look after ourselves the most, and one cannot avoid thinking what if this happened to our company? Twilio as a B2B doesn't gain a lot from being a "woke" company and following the trend of lynching Parler, on the contrary this can and will scream how Twilio can put your whole platform down overnight.. I wonder when are we going to see a legal discussion if / when internet access is going to become a basic human right? Just like electricity became ubiquitous, I expect internet access (email, payment processing, etc) to also become a right.
- kjakm 6y ago
  >> I wonder when are we going to see a legal discussion if / when internet access is going to become a basic human right? Just like electricity became ubiquitous, I expect internet access (email, payment processing, etc) to also become a right. Is electricity a right?
  - Daho0n 6y ago
    Not in the US, no.
  - chaganated 6y ago
    In a way, yes (even in the US). You still have to pay for it, but there is a litany of rules and procedures they must follow before they can cut you off. Kind of like the foreclosure process. They can't cut a customer's power over his politics--especially paying customers!
    - dsr_ 6y ago
      Electricity is a public utility, not a right. A public utility is a regulated entity that must supply anyone in their region who follows the rules -- and, in general, if you break the rules but then fix your behavior, they must allow you service again. The existence of a public utility does not forbid a private competitor, but the scale advantage of a public utility is generally overwhelming unless you have specialized needs. It is reasonable to suggest that Internet bandwidth should be a public utility.
rbanffy 6y ago
> this leaves a really bad taste with how Twilio handled the situation AS A BUSINESS. I wouldn't blame Twilio. It's entirely Parler's fault they allowed an unvalidated account to successfully register and log in. Of course, it's also entirely the intruder's fault they exploited the wide open security hole.
- nunez 6y ago
  Agreed. It’s a bit of column A and column B. Twilio shouldn’t have disclosed the services that Parler were using. Parler should not have allowed unverified users to log in ESPECIALLY if they’re dealing with PII. (Verified Parlers submitted photos of their licenses.) Either way, this feels like something that will end in a lawsuit.
  - rbanffy 6y ago
    I doubt Parler will survive long enough.
saargrin 6y ago
"accidentally"
checkyoursudo 6y ago
I have no idea about what twilio did, as this is all completely unrelated to any work I've ever done, so that leads me to wonder about contingencies like this in general. From the perspective of any company using a service like twilio (i.e., not just Parler and this specific set of events), would there not be some sort of failsafe in case something just like this were to happen? Or would this kind of thing be so nearly inconceivable that you wouldn't protect against it?
- marcinzm 6y ago
  There's two ways to react if an API you're using for authentication type stuff is down: * Fail and essentially have downtime on the features using the API * Succeed and essentially have no authentication for that time but no downtime Parler took the second approach. Platforms that value security would take the first approach.
thinkharderdev 6y ago
The description doesn't really make any sense. Did everything just fail open? I would assume that if your SMS/Email service stopped working then it would just be that nobody could login or sign up.
- WalterSear 6y ago
  > Did everything just fail open? That seems to be the consensus.
kolencherry 6y ago
Tagging onto the top comment here. I work at Twilio and this is our official statement on the enforcement of our AUP with Parler. --- With regards to reports of cyber security issues Parler experienced and have been attributed to Twilio, our security team investigated the claims and found no evidence indicating their security issues were related to Twilio or our products. Per our Website [0], Twilio has not issued any press releases pertaining to or referencing Parler. Furthermore, Parler was using Twilio to send out identity verification codes for new downloads or password resets. Once a user was verified, security protocols were independently handled by Parler and did not involve Twilio or its products. On Friday, January 8th, we sent Parler a letter informing them they were in violation of our Acceptable Use Policy [1] and notifying them that we would suspend their account if they did not make efforts to remediate multiple calls for violence on their platform. Shortly after receiving our letter, Parler informed us they had already turned off their integration with Twilio. Any cyber security issues experienced by Parler were completely unrelated to Twilio or any of its products. [0] https://www.twilio.com/press/releases https://www.twilio.com/press/releases [1] https://www.twilio.com/legal/aup https://www.twilio.com/legal/aup

by neya 6y ago

Udik 6y ago

> Because Twilio was no longer authenticating emails. Can someone explain what does this mean?

dgellow 6y ago
Trying to make sense of it, I believe that means Parler was delegating their email verification and 2fa checks to Twillio. And somehow, without access to Twillio's API, they defaulted to not do any check at all? I'm not sure what to do of this, that doesn't sound that realistic but who knows.
- beerandt 6y ago
  That, or Twillio was reporting authenticated emails, without actually authenticating them? It seems to involve some skipped auth steps on someones part though, not just a fail-safe/fail-dead mixup. It's not clear.
  - myaccount275 6y ago
    Maybe Parler was deciding based on HTTP status codes returned from the Twilio API, or the presence of some expected "error" field in the response (if it's not there, consider it ok), and one side screwed up the handling of an unexpected case? Pure speculation. Instead of having "if explicitly ok, proceed", they maybe had "unless it's an explicit negative response in an expected format (or a connectivity issue, timeout, etc.), proceed"? Which would be a pretty dumb thing to do, but I've seen worse.
- tutfbhuf 6y ago
  > they defaulted to not do any check at all? That would be a very unsafe default.
  - rbanffy 6y ago
    They wanted more users to register - they were urging users to invite friends and family - so they may have changed the safe default to the unsafe one thinking on verifying later without realizing the full consequences of what they did.
- drewmol 6y ago
  Maybe it was more complex: Create new acct 1 using valid email. Request users by username and see privilege. Find likely phone # and likely email for user : arroganttechfounder1 (admin). Create new acct 2 using likely phone number (fail, account exists). Change (add) new acct 1 phone # to match likely phone number (normally, the twilio validation step here would prevent duplicate phone numbers for multiple accounts?). Request pw reset for phone number (pw reset key saved to both accts?), no sms sent. Request pw reset for email (new acct 1) and logic sees non-expired key from previous request, emails you same key. Modify url to reset pw for arroganttechfounder1 using phone # and key.
- Alex3917 6y ago
  > And somehow, without access to Twillio's API, they defaulted to not do any check at all? I guess you could imagine user accounts being created with `authenticated=null`, and then having `authenticated=False|True` set in the in the success handler for some Twillio API call. Having null as the default would allow you to see in the database where authentication emails hadn't been sent out, so you could resend them. And then I guess you could imagine a developer checking authentication by looking for cases where `!authenticated`, rather than `authenticated == True`. Granted I don't think this hack is real, but if it were then that's probably how it would play out.
- nunez 6y ago
  Nope it was totally realistic. I tried to create an account on Parler last night to check which services were turned off by AWS. I entered dummy data into their form. The POST to their auth service timed out...but the auth flow took you to the success page anyway?
mikewarot 6y ago
It's basically the scenario Tom Scott laid out about what would happen if Google stopped checking passwords... except it happened to Parler. https://www.youtube.com/watch?v=y4GB_NDU43Q https://www.youtube.com/watch?v=y4GB_NDU43Q

davedx 6y ago

I would hold off judging Twilio based on a random anonymous reddit post's account

de6u99er 6y ago

Hijacking top comment. Here's the data: https://donk.sh/06d639b2-0252-4b1e-883b-f275eff7e792/ https://donk.sh/06d639b2-0252-4b1e-883b-f275eff7e792/ #noflylist is trending on Twitter. Guess a lot of jobs will soon be available in Silicon Valley.

willejs 6y ago
That is just a list of parler public urls.
- MacsHeadroom 6y ago
  The URL lists were used to distribute archiving of media content. 70TB of text, image, video, and metadata content was downloaded in a few hours with essentially a volunteer botnet. The team at archive.org is importing the full archive right now.
  - de6u99er 6y ago
    I don't know about that's Only that the FBI is creating their nofly lists based on it.
kodah 6y ago
Just a disclaimer, in case anyone has forgotten about the great ion cannon from back in the day: If any of these Twitter or Reddit posts are true then I would talk to a lawyer before participating.
- de6u99er 6y ago
  Participating in what?

Udik 6y ago

BTW, where is that Press Release? Can't find it on the Twilio website.

nl 6y ago

Did Twilio actually make this alleged press release? There is nothing like that on https://www.twilio.com/press/releases https://www.twilio.com/press/releases

diebeforei485 6y ago
I have the same question about the press release. Where was it posted and what was its content? I know that not all press statements are going to be on the website.

newbie578 6y ago

You said it nicely. At the end of the day, we all look after ourselves the most, and one cannot avoid thinking what if this happened to our company? Twilio as a B2B doesn't gain a lot from being a "woke" company and following the trend of lynching Parler, on the contrary this can and will scream how Twilio can put your whole platform down overnight.. I wonder when are we going to see a legal discussion if / when internet access is going to become a basic human right? Just like electricity became ubiquitous, I expect internet access (email, payment processing, etc) to also become a right.

kjakm 6y ago
>> I wonder when are we going to see a legal discussion if / when internet access is going to become a basic human right? Just like electricity became ubiquitous, I expect internet access (email, payment processing, etc) to also become a right. Is electricity a right?
- Daho0n 6y ago
  Not in the US, no.
- chaganated 6y ago
  In a way, yes (even in the US). You still have to pay for it, but there is a litany of rules and procedures they must follow before they can cut you off. Kind of like the foreclosure process. They can't cut a customer's power over his politics--especially paying customers!
  - dsr_ 6y ago
    Electricity is a public utility, not a right. A public utility is a regulated entity that must supply anyone in their region who follows the rules -- and, in general, if you break the rules but then fix your behavior, they must allow you service again. The existence of a public utility does not forbid a private competitor, but the scale advantage of a public utility is generally overwhelming unless you have specialized needs. It is reasonable to suggest that Internet bandwidth should be a public utility.

rbanffy 6y ago

> this leaves a really bad taste with how Twilio handled the situation AS A BUSINESS. I wouldn't blame Twilio. It's entirely Parler's fault they allowed an unvalidated account to successfully register and log in. Of course, it's also entirely the intruder's fault they exploited the wide open security hole.

nunez 6y ago
Agreed. It’s a bit of column A and column B. Twilio shouldn’t have disclosed the services that Parler were using. Parler should not have allowed unverified users to log in ESPECIALLY if they’re dealing with PII. (Verified Parlers submitted photos of their licenses.) Either way, this feels like something that will end in a lawsuit.
- rbanffy 6y ago
  I doubt Parler will survive long enough.

saargrin 6y ago

"accidentally"

checkyoursudo 6y ago

I have no idea about what twilio did, as this is all completely unrelated to any work I've ever done, so that leads me to wonder about contingencies like this in general. From the perspective of any company using a service like twilio (i.e., not just Parler and this specific set of events), would there not be some sort of failsafe in case something just like this were to happen? Or would this kind of thing be so nearly inconceivable that you wouldn't protect against it?

marcinzm 6y ago
There's two ways to react if an API you're using for authentication type stuff is down: * Fail and essentially have downtime on the features using the API * Succeed and essentially have no authentication for that time but no downtime Parler took the second approach. Platforms that value security would take the first approach.

thinkharderdev 6y ago

The description doesn't really make any sense. Did everything just fail open? I would assume that if your SMS/Email service stopped working then it would just be that nobody could login or sign up.

WalterSear 6y ago
> Did everything just fail open? That seems to be the consensus.

kolencherry 6y ago

Tagging onto the top comment here. I work at Twilio and this is our official statement on the enforcement of our AUP with Parler. --- With regards to reports of cyber security issues Parler experienced and have been attributed to Twilio, our security team investigated the claims and found no evidence indicating their security issues were related to Twilio or our products. Per our Website [0], Twilio has not issued any press releases pertaining to or referencing Parler. Furthermore, Parler was using Twilio to send out identity verification codes for new downloads or password resets. Once a user was verified, security protocols were independently handled by Parler and did not involve Twilio or its products. On Friday, January 8th, we sent Parler a letter informing them they were in violation of our Acceptable Use Policy [1] and notifying them that we would suspend their account if they did not make efforts to remediate multiple calls for violence on their platform. Shortly after receiving our letter, Parler informed us they had already turned off their integration with Twilio. Any cyber security issues experienced by Parler were completely unrelated to Twilio or any of its products. [0] https://www.twilio.com/press/releases https://www.twilio.com/press/releases [1] https://www.twilio.com/legal/aup https://www.twilio.com/legal/aup