The IT Nerd

Here’s something that seems a bit suspect to me. Via a blog post, Twilio who makes two factor authentication apps, specifically an app called Authy, said that it was hacked. But the way that it provides details about this hack leads to more questions than answers:

Twilio has detected that threat actors were able to identify data associated with Authy accounts, including phone numbers, due to an unauthenticated endpoint. We have taken action to secure this endpoint and no longer allow unauthenticated requests. 

We have seen no evidence that the threat actors obtained access to Twilio’s systems or other sensitive data. As a precaution, we are requesting that all Authy users update to the latest Android and iOS apps for the latest security updates. While Authy accounts are not compromised, threat actors may try to use the phone number associated with Authy accounts for phishing and smishing attacks; we encourage all Authy users to stay diligent and have heightened awareness around the texts they are receiving.

You’ll note that the company hasn’t said how many users were affected. Now it is possible that Twilio has no clue how many users were affected. It is also possible that they just don’t want to say because the number is huge. There are reports that the number of users is 33 million which would be huge if true. And the fact that Twilio said that hackers got in via an “unauthenticated endpoint” is interesting. That kind of implies that they might have had computers on their network that weren’t properly authenticated to the network. IF that is the case, that’s not good. Either way, this isn’t trivial. All of this leads to more questions than answers. And Twilio will have to answer those questions sooner rather than later if they are to be trusted again.

This entry was posted on July 4, 2024 at 8:53 am and is filed under Commentary with tags Hacked. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.