<story><title>Twilio incident: What Signal users need to know</title><url>https://support.signal.org/hc/en-us/articles/4850133017242</url></story><parent_chain><item><author>jamespwilliams</author><text>The attack Twilio suffered is almost identical to the recent attack against Cloudflare: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;blog.cloudflare.com&amp;#x2F;2022-07-sms-phishing-attacks&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;blog.cloudflare.com&amp;#x2F;2022-07-sms-phishing-attacks&amp;#x2F;&lt;/a&gt; (even down the wording of the text messages, which are nearly identical). Cloudflare’s use of security keys prevented the attackers getting access to any accounts in that case.&lt;p&gt;These attacks are sophisticated and are capable of bypassing TOTP or mobile-app-based MFA. If this is widespread, I’d be surprised if we didn’t see a massive influx of breaches soon. The vast majority of companies are not well defended against this.</text></item></parent_chain><comment><author>hn_throwaway_99</author><text>&amp;gt; These attacks are sophisticated and are capable of bypassing TOTP or mobile-app-based MFA.&lt;p&gt;To be honest, I wish people would stop parroting that these attacks were &amp;quot;sophisticated&amp;quot;. In my opinion, I&amp;#x27;d call something like Pegasus spyware &amp;quot;sophisticated&amp;quot;. I don&amp;#x27;t think these attacks were that sophisticated at all - they were just standard issue, MITM attacks using targeted text messages - and they just took advantage of what is always the weakest link in security: people. I think of myself as a general middle-of-the-road software developer but I think I could have easily replicated this attack myself.</text></comment>
<story><title>Twilio incident: What Signal users need to know</title><url>https://support.signal.org/hc/en-us/articles/4850133017242</url></story><parent_chain><item><author>jamespwilliams</author><text>The attack Twilio suffered is almost identical to the recent attack against Cloudflare: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;blog.cloudflare.com&amp;#x2F;2022-07-sms-phishing-attacks&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;blog.cloudflare.com&amp;#x2F;2022-07-sms-phishing-attacks&amp;#x2F;&lt;/a&gt; (even down the wording of the text messages, which are nearly identical). Cloudflare’s use of security keys prevented the attackers getting access to any accounts in that case.&lt;p&gt;These attacks are sophisticated and are capable of bypassing TOTP or mobile-app-based MFA. If this is widespread, I’d be surprised if we didn’t see a massive influx of breaches soon. The vast majority of companies are not well defended against this.</text></item></parent_chain><comment><author>maerF0x0</author><text>to be clear they are not able to &amp;quot;bypass&amp;quot; TOTP or mobile-app-based MFA in the way security folks think of that term. They were able to bypass humans[1], which are often the weakest link in security related matters.&lt;p&gt;[1]: &amp;quot;Twilio became aware of unauthorized access to information related to a limited number of Twilio customer accounts through a sophisticated social engineering attack designed to steal employee credentials. This broad based attack against our employee base succeeded in fooling some employees into providing their credentials. The attackers then used the stolen credentials to gain access to some of our internal systems, where they were able to access certain customer data. &amp;quot; &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.twilio.com&amp;#x2F;blog&amp;#x2F;august-2022-social-engineering-attack&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.twilio.com&amp;#x2F;blog&amp;#x2F;august-2022-social-engineering-a...&lt;/a&gt;</text></comment>