Telstra users safe from Twitter SMS flaw

Powered by SC Magazine

Others should use PIN protection.

A SMS bug has made it possible to issue spoofed tweets for some Australian Twitter account holders.

An attacker could spoof their number to appear like that owned by their victim and then issue SMS tweets.

In Australia, only Telstra and Azercell subscribers were safe from attack, along with Twitter users who opted to put PIN protection on their accounts.

This was because spoofing was not possible over shortcodes, offered by both Telstra and Azercell (0198089488 and 8800 respectively).

Vulnerable longcodes could not be used where a shortcode was avaliable, Twitter's product security engineering manager Moxie Marlinspike said.

"Given that it is possible to send an SMS message with a fake source address to [shortcodes], we have offered PIN protection to users who sign up with a longcode since 2007.  As of August of this year, we have additionally disallowed posting through longcodes for users that have an available shortcode," he said.

Jonathan Rudenberg discovered the flaw and reported the findings on his blog.

"The same vulnerability also existed in Facebook and Venmo, a mobile payments service for use among friends, but those two companies were more responsive to fixing the issue," Rudenberg said.

He reported the bug to Venmo last Thursday, and it was corrected by Saturday.

Facebook took longer, with the weakness being reported to the social networking giant on 19 August and Rudenberg notified last Wednesday that the hole was plugged.

He ran into more challenges with Twitter which was alerted about the vulnerability on 17 August, but when Rudenberg checked back for an update on 15 October, he never heard back.

He decided last Wednesday to go public with the disclosure, but only referencing Twitter.

Affected users can follow Twitter's guide to set up PIN protection.

Copyright © SC Magazine, Australia

Telstra users safe from Twitter SMS flaw
Top Stories
Earning the right to innovate
Breaking down the barriers to innovation is a long, but rewarding process, says Bank of Queensland Group CIO, Julie Bale.
A call for timely reporting
[Blog post] Businesses need incentives to keep customer data secure.
Doubts cast on Queensland's ICT Dashboard
Opposition, former Govt CIO say it can't be trusted.
Sign up to receive iTnews email bulletins
Latest Comments
What is delaying adoption of public cloud in your organisation?

   |   View results
Lock-in concerns
Application integration concerns
Security and compliance concerns
Unreliable network infrastructure
Data sovereignty concerns
Lack of stakeholder support
Protecting on-premise IT jobs
Difficulty transitioning CapEx budget into OpEx