SMS Database Leak, Including Two-Factor Codes

[engine]

According to a researcher, tens of millions of text messages, including password reset links, two-factor codes, shipping notifications was sitting on an exposed server which wasn't protected by a password.

Worse, the database — running on Amazon’s Elasticsearch — was configured with a Kibana front-end, making the data within easily readable, browsable and searchable for names, cell numbers and the contents of the text messages themselves.

[techcrunch.com...]

The database is now offline, so that's ok, right! ;)

[justpassing]

server which wasn't protected by a password

I don't password protect my servers either ... just use ssh with private key, and only allowing my static IP, I guess they were not doing this either :)

[brotherhood of LAN]

There's programs that walk up and down the likes of Amazon's servers/ips/ports because it seems to be a gravitational centre for these kinds of mistakes.

apt get install ignorance

[justpassing]

apt get install ignorance

:)

[graeme_p]

@justpassing, a server login was not needed, they had a web ui for the database publicly accessible and not requiring passwords. The article seems a bit confused. Elasticsearch has nothing to do with Amazon (You can run it on AWS, but I think the journo has confused it with AWS products with "Elastic" in the name)