<story><title>Twilio incident: What Signal users need to know</title><url>https://support.signal.org/hc/en-us/articles/4850133017242</url></story><parent_chain><item><author>jamespwilliams</author><text>The attack Twilio suffered is almost identical to the recent attack against Cloudflare: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;blog.cloudflare.com&amp;#x2F;2022-07-sms-phishing-attacks&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;blog.cloudflare.com&amp;#x2F;2022-07-sms-phishing-attacks&amp;#x2F;&lt;/a&gt; (even down the wording of the text messages, which are nearly identical). Cloudflare’s use of security keys prevented the attackers getting access to any accounts in that case.&lt;p&gt;These attacks are sophisticated and are capable of bypassing TOTP or mobile-app-based MFA. If this is widespread, I’d be surprised if we didn’t see a massive influx of breaches soon. The vast majority of companies are not well defended against this.</text></item></parent_chain><comment><author>hn_throwaway_99</author><text>&amp;gt; These attacks are sophisticated and are capable of bypassing TOTP or mobile-app-based MFA.&lt;p&gt;To be honest, I wish people would stop parroting that these attacks were &amp;quot;sophisticated&amp;quot;. In my opinion, I&amp;#x27;d call something like Pegasus spyware &amp;quot;sophisticated&amp;quot;. I don&amp;#x27;t think these attacks were that sophisticated at all - they were just standard issue, MITM attacks using targeted text messages - and they just took advantage of what is always the weakest link in security: people. I think of myself as a general middle-of-the-road software developer but I think I could have easily replicated this attack myself.</text></comment>
<story><title>Twilio incident: What Signal users need to know</title><url>https://support.signal.org/hc/en-us/articles/4850133017242</url></story><parent_chain><item><author>jamespwilliams</author><text>The attack Twilio suffered is almost identical to the recent attack against Cloudflare: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;blog.cloudflare.com&amp;#x2F;2022-07-sms-phishing-attacks&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;blog.cloudflare.com&amp;#x2F;2022-07-sms-phishing-attacks&amp;#x2F;&lt;/a&gt; (even down the wording of the text messages, which are nearly identical). Cloudflare’s use of security keys prevented the attackers getting access to any accounts in that case.&lt;p&gt;These attacks are sophisticated and are capable of bypassing TOTP or mobile-app-based MFA. If this is widespread, I’d be surprised if we didn’t see a massive influx of breaches soon. The vast majority of companies are not well defended against this.</text></item></parent_chain><comment><author>saurik</author><text>The way that Cloudflare attack was working out sounds similar in nature to the way MailChimp was attacked a few months ago:&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.bleepingcomputer.com&amp;#x2F;news&amp;#x2F;security&amp;#x2F;hackers-breach-mailchimps-internal-tools-to-target-crypto-customers&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.bleepingcomputer.com&amp;#x2F;news&amp;#x2F;security&amp;#x2F;hackers-breac...&lt;/a&gt;</text></comment>