0

So I was looking at some firewall logs and saw some strange activity on a remote IP address. I checked out the address via browser since https was open, the certificate was for *.twilio.com and twilio.com. It's an AWS address which is a popular choice for hackers who want to spin up a free server.

My first question is how could they get both the certificate and key for the twilio wildcard certificate?

My second question is what does this XML response mean? The page is masquerading as the twilio website. They owners of the firewall use twilio for phone and text purposes, could this XML response be used to do that? There were 2 recent attempts to execute this code.

<TwilioResponse>
<Versions firstpageuri="/?Page=0&PageSize=50" numpages="1" end="1" total="2" previouspageuri="" lastpageuri="/?Page=0&PageSize=50" uri="/" pagesize="50" start="0" nextpageuri="" page="0">
<Version>
<Name>2008-08-01</Name>
<Uri>/2008-08-01</Uri>
<SubresourceUris>
<Accounts>/2008-08-01/Accounts</Accounts>
</SubresourceUris></Version>
<Version>
<Name>2010-04-01</Name>
<Uri>/2010-04-01</Uri>
<SubresourceUris>
<Accounts>/2010-04-01/Accounts</Accounts></SubresourceUris></Version></Versions>
</TwilioResponse>

closed as off-topic by schroeder Apr 16 '17 at 11:35

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – schroeder
If this question can be reworded to fit the rules in the help center, please edit the question.

  • Sorry, don't know if I am missing something by what is convincing you hackers are involved? Twilio offers an API service sending text and phone messages and uses XML as well on their response uri for incoming messages. So I'm confused on what part are the attackers involved in? – nd510 Apr 14 '17 at 1:52
  • Well on the firewall I found that it was an exploit, a buffer overflow attack going from a server on the trusted network towards the AWS IP. Twilio does use AWS so I'll have to check into the IP further. It's an exact copy of the Twilio API. Why would they need it? all requests go to the api server, it may be a failover IP or something similar. The exploit attempt has happened twice over the last 2 days. It may be legit developer code triggering a false positive, I don't see why they would send a request to another server... – Benjamin Pinkert Apr 14 '17 at 5:18
  • I don't think you have given us enough information, and the info you have provided doesn't link together well. "on a remote IP" - do you mean "[to|from] a remote IP". The "address" was the IP or was there a domain you visited with HTTPS? Is the IP owned by Twillio? "Owners of the firewall" - which firewall? Who? – schroeder Apr 14 '17 at 7:29
  • The same problem applies to your comment above. You are assuming we have all the data you have and are making statements without context. "Why would they need it? - who? You claim it was an exploit going from your network to the IP, and you are stating that as claim that the IP is run by hackers. Aren't the hackers on your network, according to your statements? – schroeder Apr 14 '17 at 7:33
  • This doesn't look malicious. Are you sure the server isn't actually Twilio's? They seem to be running on Amazon AWS. – André Borie Apr 15 '17 at 2:12
1

Yea it was a legit twilio server. Jumped the gun a bit. We are concerned about insider and outside threats due to two strange server failures. The /etc directory and /usr/bin directory have been deleted on both occasions so there is some type of foul play going on,not sure from where though.

Not the answer you're looking for? Browse other questions tagged or ask your own question.