Hacker News Reader

Comment by jamespwilliams | Hacker News Reader

The attack Twilio suffered is almost identical to the recent attack against Cloudflare: https://blog.cloudflare.com/2022-07-sms-phishing-attacks/ (even down the wording of the text messages, which are nearly identical). Cloudflare’s use of security keys prevented the attackers getting access to any accounts in that case.

These attacks are sophisticated and are capable of bypassing TOTP or mobile-app-based MFA. If this is widespread, I’d be surprised if we didn’t see a massive influx of breaches soon. The vast majority of companies are not well defended against this.

View on HN

> These attacks are sophisticated and are capable of bypassing TOTP or mobile-app-based MFA.

To be honest, I wish people would stop parroting that these attacks were "sophisticated". In my opinion, I'd call something like Pegasus spyware "sophisticated". I don't think these attacks were that sophisticated at all - they were just standard issue, MITM attacks using targeted text messages - and they just took advantage of what is always the weakest link in security: people. I think of myself as a general middle-of-the-road software developer but I think I could have easily replicated this attack myself.

to be clear they are not able to "bypass" TOTP or mobile-app-based MFA in the way security folks think of that term. They were able to bypass humans[1], which are often the weakest link in security related matters.

[1]: "Twilio became aware of unauthorized access to information related to a limited number of Twilio customer accounts through a sophisticated social engineering attack designed to steal employee credentials. This broad based attack against our employee base succeeded in fooling some employees into providing their credentials. The attackers then used the stolen credentials to gain access to some of our internal systems, where they were able to access certain customer data. " https://www.twilio.com/blog/august-2022-social-engineering-a...

I would consider myself "security folks" and while maybe I wouldn't choose the word "bypass" the effect is that TOTP is basically useless against phishing and always was, and I don't object to that word from lay people.

At Cloudflare, or Google, or several other places that took this seriously, "fooling some employees into providing their credentials" doesn't get you anywhere. With WebAuthn your employees don't have a way to give bad guys credentials the bad guys can use - no matter how badly they were fooled.

TOTP is effective against credential stuffing, but it does nothing for phishing.

The way that Cloudflare attack was working out sounds similar in nature to the way MailChimp was attacked a few months ago:

https://www.bleepingcomputer.com/news/security/hackers-breac...

I'd contest the sophisticated characterisation. Phishing activity targeting banking has been doing this for ages and it's been common against office365 accounts for a long time as well. And it's plainly obvious to common sense that the adversary can just proxy the verification code check in a phishing attack.

I wonder if Twilio corporate culture has an aversion to or outright not-implemented or banned more secure methods of MFA such as security keys because of their $$ acquisition of Authy. Anyone have any insight?

Reply on news.ycombinator.com