If you do not want to indicate your mobile number during registration and do not need to protect your account, take the virtual number for Twitter in the special SIMonline service.
The Insinia Security team managed to publish tweets (with the permission of the account owners, of course) without direct access to user accounts. This was done without logging in and without the need to intercept the two-factor authentication code.
The trick does not work against every Twitter account. Only some SMS-enabled accounts are vulnerable, and it is not yet known exactly how many users are affected.
To implement the tweet, Insinia researchers first had to track the phone numbers that were associated with their Twitter accounts. Due to numerous data leaks and hacks, this information is much easier to get than you think.
Once they found the phone number, the next step was to borrow a trick from spammers and scammers. Researchers have injected a phone number into a spoofing tool that makes calls and texts look like they come from a specific phone number, although this is actually not the case. Insinia experts gave Gizmodo a demonstration of the attack, which reportedly worked against several Twitter accounts.
According to Gizmodo, this should not have been possible. Twitter issued a statement stating that it “fixed a bug that caused certain accounts with a connected phone number in the UK to become falsified by SMS”, adding that “account security protocols work as expected.”
It is gratifying to know that no actual accounts are in danger. However, if hackers can simply get around these measures, there are still some obvious holes that need to be fixed.
