Two-factor authentication, or just 2FA, is one of the ways to secure online accounts.
The method 2FA uses to confirm users' claimed identities is by using a combination of two different factors.
For example, after entering their username and password, users need to verify their identity with something they know, or something they have, or something they are.
Just when many people thought that 2FA was one of the most secure way to protect accounts, it was discovered that more than 26 million 2FA codes, password reset links, and delivery tracking details were left out on the internet for anyone to see.
The database that contained SMS text messages, was discovered by Berlin-based security researcher Sébastien Kaul. The database in question was owned by a telephony company called Vonox.
What made things worse is that, the database that runs on Amazon’s Elasticsearch, was configured with a Kibana frontend, making the data within it easily readable, browseable and searchable for names, phone numbers and the contents of the text messages themselves.
Kaul found the database when searching for public databases using the search engine Shodan.
How the database of information leaked users' credentials was because of a human error.
Voxox provides SMS-based APIs that converts code into text messages to authenticate users. It was discovered that the exposed database contained messages to authenticate phone numbers for Trivia HQ, KakaoTalk and Viber, verification codes for Huawei accounts, password reset codes for Microsoft accounts, 2FA codes for Booking.com's extranet corporate network and Google accounts in Latin America, Yahoo! account keys, Amazon shipping tracking links and more.
According to Dylan Katz, another security researcher who reviewed the findings, the data might have already been snapped up and used by malicious third parties.
What this means, those users who have their credentials exposed on the database, may have their accounts compromised.
After Voxox was contacted by TechCrunch, the company quickly took the database offline.
