A database owned by TrueDialog storing millions of SMS
text messages in plain text was found online, accessible to anyone and
unprotected by passwords.
The data in the rogue database was found accessible
online by vpnMentor security researchers Noam Rotem and Ran Locar. The millions
of SMS messages included university finance applications, discount codes,
usernames, passwords, and two-factor authentication numbers.
TrueDialog, based in Austin, Texas, collaborates with
almost 1,000 network operators to send bulk SMS messages, from small and large
businesses to users from all over the world.
When the researchers found the database, it was holding
about 604 GB of data, with over 1 billion private entries. It was hosted on
Microsoft Azure and ran on the Oracle Marketing Cloud, in the US. The fact that
it was all stored in plain text immediately drew the researchers’ attention.
All of TrueDialog’s client base was exposed, including their customers and
phone numbers.
“There is also a significant impact for TrueDialog
themselves, not including how this will negatively affect their reputation.
Their competitors could have gotten a look into their backend and seen how the
company is run from within,” said
vpnMentor’s researchers. “This would have given them a way to copy, or improve
upon, the business model that has brought TrueDialog success. And now that
TrueDialog failed at keeping its customer database safe, its competitors can
also take advantage of the bad publicity the brand is going to receive, and
even take over their customers.”
While leaving names and phone numbers in the open is a
big problem, the issue surrounding this leak is much more extensive. The emails
can be used in targeted phishing scams, people are now susceptible to SIM-jacking,
and other accounts from various other services are exposed as well. And that’s
not even acknowledging how competitors could use this wealth of data.
According to TechCrunch,
the owners pulled the database offline as soon as they found out but failed to
communicate any other subsequent measures. At the very least, all of the people
targeted by SMSs from them should be notified that their private information is
now in the open. Also, the companies that used TrueDialog’s services should be
made aware of the breach.
This is the second major incident in less than a week
involving a massive database full of private information left out in the open.
Personal data for 1.2 billion people was
discovered in an open Elasticsearch mystery server, most likely originating
from People Data Labs (PDL).