Twilio, a cloud communications platform as a service (CPaaS) company, disclosed that attackers compromised its TaskRouter JS SDK after gaining access to one of its misconfigured Amazon AWS S3 buckets. This left the SDK’s path publicly readable and writable since 2015. Twilio’s customers include Twitter, Netflix, Uber, Shopify, Morgan Stanley, Airbnb, and others.
Experts Comments
July 23, 2020
Compromise of common cloud security infrastructure is a jewel in the crown for any attacker given the scope of influence over dependent enterprises and broadly deployed mobile applications alike. Storage configuration, SDK and API attacks are an increasingly exploited vectors that can lead to misdirection, malware injection, manipulation and theft of data. While malvertising was the initial endgame here, that in itself can lead to compromise of end user platforms and secondary data theft. Given .....Read More
Like(
July 23, 2020
Modern web applications make extensive use of third-party scripts and open source libraries, such as the TaskRouter library published by Twilio. Often introduced without proper vetting, this Shadow Code introduces unknown risks into the application and vastly expands the attack surface. Misconfigured S3 buckets remain a common way for hackers to introduce malware into otherwise legitimate scripts. By compromising a single widely used supplier such as Twilio, hackers can gain access to hundreds.....Read More
Submit Your Expert Comments
What do you think of the topic? Do you agree with expert(s) or share your expert opinion below.Be part of our growing Information Security Expert Community (1000+), please register here.
Linkedin Message
@Casey Kraus, President of Cloud Security Management Provider, provides expert commentary at @Information Security Buzz.
"The complexity around configurations, identity, and access in the cloud are creating many opportunities for these bad actors. ..."
#infosec #cybersecurity #isdots
https://informationsecuritybuzz.com/expert-comments/twilios-sdk-compromised-by-attackers-expert-reaction
Facebook Message
@Casey Kraus, President of Cloud Security Management Provider, provides expert commentary at @Information Security Buzz.
"The complexity around configurations, identity, and access in the cloud are creating many opportunities for these bad actors. ..."
#infosec #cybersecurity #isdots
https://informationsecuritybuzz.com/expert-comments/twilios-sdk-compromised-by-attackers-expert-reaction