2FA security codes for some of the world’s biggest companies were left unprotected online

News
By published

A leaky database held one-time access codes and password reset links

Security
(Image credit: Shutterstock / Ico Maker)

A company that handles SMS text message routing has secured one of its internal databases after discovering it could be accessed with nothing more than an internet connection and a public IP address.

The routing service handled time-sensitive messages used for one-time passcodes and reset links for two-factor authentication services (2FA).

Latest Videos From

 Sealing the leak

The vulnerable database was discovered by good samaritan Anurag Sen, who is a security expert and researcher. Sen, upon discovering the database and being unable to trace its owner, reported the database to TechCrunch.

TechCrunch managed to identify a number of corresponding email addresses and passwords within the database that contained information hinting to the leaking database’s owner.

The database belonged to YX International, a company that specializes in cellular networks, and provides critical routing services for time-sensitive messages. YX International took down the database shortly after being notified, and then released a statement that the vulnerability had been fixed.

The database was responsible for handling one-time access codes for Facebook, Google and TikTok accounts, and there is no evidence that any data was stolen because the database did not retain access logs. Evidence within the database suggested that it has been active since July 2023, but YX International did not confirm how long the database had been left unsecured.

Sen told TechCrunch that the database held password reset links, alongside the one time access codes, for tech and social media giants such as Google and WhatsApp. While one-time access codes provide a superior level of security over just using a password, they are not as secure as dedicated 2FA and multi-factor authentication applications.

More from TechRadar Pro

TOPICS
Benedict Collins
Benedict Collins
Senior Writer, Security

Benedict is a Senior Security Writer at TechRadar Pro, where he has specialized in covering the intersection of geopolitics, cyber-warfare, and business security.

Benedict provides detailed analysis on state-sponsored threat actors, APT groups, and the protection of critical national infrastructure, with his reporting bridging the gap between technical threat intelligence and B2B security strategy.

Benedict holds an MA (Distinction) in Security, Intelligence, and Diplomacy from the University of Buckingham Centre for Security and Intelligence Studies (BUCSIS), with his specialization providing him with a robust academic framework for deconstructing complex international conflicts and intelligence operations, and the ability to translate intricate security data into actionable insights.