Telstra users safe from Twitter SMS flaw

A SMS bug has made it possible to issue spoofed tweets for some Australian Twitter account holders.

An attacker could spoof their number to appear like that owned by their victim and then issue SMS tweets.

In Australia, only Telstra and Azercell subscribers were safe from attack, along with Twitter users who opted to put PIN protection on their accounts.

This was because spoofing was not possible over shortcodes, offered by both Telstra and Azercell (0198089488 and 8800 respectively).

Vulnerable longcodes could not be used where a shortcode was avaliable, Twitter's product security engineering manager Moxie Marlinspike said.

"Given that it is possible to send an SMS message with a fake source address to [shortcodes], we have offered PIN protection to users who sign up with a longcode since 2007.  As of August of this year, we have additionally disallowed posting through longcodes for users that have an available shortcode," he said.

Jonathan Rudenberg discovered the flaw and reported the findings on his blog.

"The same vulnerability also existed in Facebook and Venmo, a mobile payments service for use among friends, but those two companies were more responsive to fixing the issue," Rudenberg said.

He reported the bug to Venmo last Thursday, and it was corrected by Saturday.

Facebook took longer, with the weakness being reported to the social networking giant on 19 August and Rudenberg notified last Wednesday that the hole was plugged.

He ran into more challenges with Twitter which was alerted about the vulnerability on 17 August, but when Rudenberg checked back for an update on 15 October, he never heard back.

He decided last Wednesday to go public with the disclosure, but only referencing Twitter.

Affected users can follow Twitter's guide to set up PIN protection.