CYBER SYRUP
Delivering the sweetest insights on cybersecurity.

Cybersecurity Wake-Up Call: SMS 2FA Codes Aren't Enough

Security Vulnerability in SMS 2FA Codes

Security experts advise against using SMS messages for two-factor authentication codes due to their vulnerability to interception or compromise. Recently, a security researcher discovered an unsecured database on the internet containing millions of such codes, which could be easily accessed by anyone.

The Unprotected Database

The internal database, discovered by security researcher Anurag Sen, was left unprotected without a password despite being internet-facing. Anyone who knew the database’s IP address would be able to access it using nothing more sophisticated than a bog-standard web browser.

Identified Culprit

Although it wasn’t immediately clear as to the ownership of the exposed database, after reaching out to reporters at TechCrunch the guilty party was found to be YX International, an Asian company that provides SMS text message routing, among other services. YX International secured the database after TechCrunch contacted the company.

Potential Impact

With a daily flow of as many as 5 million SMS messages, the YX International database was a treasure trove of sensitive information. Information including password reset links and 2FA codes for companies such as Google, WhatsApp, Facebook, and TikTok.

Reassessing Security Measures

Jake Moore, the global cybersecurity advisor at ESET, emphasizes the importance of multi-layered security measures. While SMS 2FA codes provide some level of security, options like passkeys, authenticator apps, and physical security keys offer stronger protection. Moore suggests that relying solely on passwords or SMS 2FA codes might leave accounts vulnerable.

Lessons Learned

Although users need not panic about their 2FA codes being compromised in the exposed database, it serves as a reminder to reconsider the reliance on SMS for authentication. The incident underscores the importance of keeping up with the latest security practices and opting for more secure alternatives when available.

Conclusion

While SMS 2FA codes have been a common security measure, their vulnerability to interception or compromise highlights the need for stronger authentication methods. As technology evolves, it's crucial to prioritize security over convenience to safeguard sensitive information effectively.