Encrypted messaging platform Signal has confirmed that a number of its customers have been affected by the phishing attack on Twilio last week.
The company believes around 1,900 of its users are potentially affected by the breach of the communication API firm, with phone numbers and SMS verification codes potentially exposed to the hackers.
Signal said Twilio informed it of the breach at the time, and a subsequent investigation revealed the hackers gained access to Twilio’s customer support console.
“During the window when an attacker had access to Twilio’s customer support systems it was possible for them to attempt to register the phone numbers they accessed to another device using the SMS verification code,” said Signal in a public disclosure. “The attacker no longer has this access, and the attack has been shut down by Twilio.”
It added that the attackers specifically searched for three phone numbers out of the total 1,900 exposed, and the owner of one of these numbers has confirmed to Signal that their account was re-registered.
Re-registering a user’s account does not give the attacker access to any messages, profile information, or contact lists, Signal said, since this data is stored on a user’s device only.
“Your contact lists, profile information, whom you’ve blocked, and more can only be recovered with your Signal PIN which was not (and could not be) accessed as part of this incident,” it told customers.
By re-registering a user’s account, an attacker would be able to send and receive Signal messages from that phone number, however.
Signal is currently in the process of notifying all affected users by SMS and is de-registering Signal on all affected users’ devices. The 1,900 users will be required to re-register their accounts with their phone numbers on all devices they use.
This process began on Monday and Signal expects to complete it by the end of the day.
Since the action taken by Signal following Twilio’s breach, some users will have seen a banner in the app saying their account has been de-registered.
This may mean they were affected by the incident, it said, or it could indicate their account had been inactive for a long period.
Signal had previously prepared for this type of attack and is the reason it developed functionalities like Signal PINs and registration lock – a feature that prevents anyone else from registering an account with a user’s phone number.
This feature is not enabled by default, and Signal has recommended all users to enable it in the app’s settings menu, using a Signal PIN.
What happened in the Twilio breach?
Last week, several Twilio employees were targeted by socially engineered phishing attacks which resulted in some staff handing over passwords to the attackers.
SMS messages were sent with password reset links which directed targets to fake Twilio pages where attackers harvested the login credentials of some staff members.
RELATED RESOURCE
An EDR buyer's guide
How to pick the best endpoint detection and response solution for your business
Targets were addressed by their name, in some cases, and texts appeared to be sent from Twilio’s IT department, the company said.
It’s unclear who was behind the attack but it was thought the attackers were well-equipped given the thorough understanding of the company, able to link current and former employees with phone numbers and real names.
Twilio said it was aware that other companies were also targeted at the same time, one of which was revealed as Cloudflare.
The DDoS mitigation company confirmed it was also targeted by a phishing attack at around the same time as Twilio, but was not breached as a result due to the company-wide use of hardware-based, FIDO2-compliant multi-factor authentication (MFA) keys.
-
Bigger salaries, more burnout: Is the CISO role in crisis?In-depth CISOs are more stressed than ever before – but why is this and what can be done?
-
Cheap cyber crime kits can be bought on the dark web for less than $25News Research from NordVPN shows phishing kits are now widely available on the dark web and via messaging apps like Telegram, and are often selling for less than $25.
-
Have I Been Pwned owner Troy Hunt’s mailing list compromised in phishing attackTroy Hunt, the security blogger behind data-breach site Have I Been Pwned, has fallen victim to a phishing attack targeting his email subscriber list.
-
LinkedIn has become a prime hunting ground for cyber criminals – here’s what you need to knowNews Cyber criminals are flocking to LinkedIn to conduct social engineering campaigns, research shows.
-
Phishing campaign targets developers with fake CrowdStrike job offersNews Victims are drawn in with the promise of an interview for a junior developer role at CrowdStrike
-
Iranian hackers targeted nuclear expert, ported Windows infection chain to Mac in a weekNews Fresh research demonstrates the sophistication and capability of state-sponsored threat actors to compromise diverse targets
-
Malware being pushed to businesses by search engines remains a pervasive threatNews High-profile malvertising campaigns in recent months have surged
-
CISA: Phishing campaign targeting US federal agencies went undetected for monthsNews Threat actors used legitimate remote access software to maliciously target federal employees
-
Google Ads malvertising campaign prompts questions around Search securityNews A leading security researcher has called into question why Google still allows malware links to top search results
-
Uber hacked via basic smishing attackNews The self-taught hacker impersonated an IT worker to gain an Uber employee's password, obtaining broad access to internal systems and posting taunting messages
