Telstra users safe from Twitter SMS flaw

Powered by SC Magazine

Others should use PIN protection.

A SMS bug has made it possible to issue spoofed tweets for some Australian Twitter account holders.

An attacker could spoof their number to appear like that owned by their victim and then issue SMS tweets.

In Australia, only Telstra and Azercell subscribers were safe from attack, along with Twitter users who opted to put PIN protection on their accounts.

This was because spoofing was not possible over shortcodes, offered by both Telstra and Azercell (0198089488 and 8800 respectively).

Vulnerable longcodes could not be used where a shortcode was avaliable, Twitter's product security engineering manager Moxie Marlinspike said.

"Given that it is possible to send an SMS message with a fake source address to [shortcodes], we have offered PIN protection to users who sign up with a longcode since 2007.  As of August of this year, we have additionally disallowed posting through longcodes for users that have an available shortcode," he said.

Jonathan Rudenberg discovered the flaw and reported the findings on his blog.

"The same vulnerability also existed in Facebook and Venmo, a mobile payments service for use among friends, but those two companies were more responsive to fixing the issue," Rudenberg said.

He reported the bug to Venmo last Thursday, and it was corrected by Saturday.

Facebook took longer, with the weakness being reported to the social networking giant on 19 August and Rudenberg notified last Wednesday that the hole was plugged.

He ran into more challenges with Twitter which was alerted about the vulnerability on 17 August, but when Rudenberg checked back for an update on 15 October, he never heard back.

He decided last Wednesday to go public with the disclosure, but only referencing Twitter.

Affected users can follow Twitter's guide to set up PIN protection.

Copyright © SC Magazine, Australia

Telstra users safe from Twitter SMS flaw
Top Stories
Myer CIO named retailer's new chief executive
Richard Umbers to lead data-driven retail strategy.
Empty terminals and mountains of data
Qantas CIO Luc Hennekens says no-one is safe from digital disruption.
BoQ takes $10m hit on Salesforce CRM
Regulatory hurdles end cloud pilot.
Sign up to receive iTnews email bulletins
Latest Comments
Who do you trust most to protect your private data?

   |   View results
Your bank
Your insurance company
A technology company (Google, Facebook et al)
Your telco, ISP or utility
A retailer (Coles, Woolworths et al)
A Federal Government agency (ATO, Centrelink etc)
An Australian law enforcement agency (AFP, ASIO et al)
A State Government agency (Health dept, etc)

Do you support the abolition of the Office of the Information Commissioner?

   |   View results
I support shutting down the OAIC.
I DON'T support shutting the OAIC.