SMS Vulnerability in Twitter, Facebook and Venmo
Twitter users with SMS enabled are vulnerable to an attack that allows anyone to post to their account. The attacker only needs knowledge of the mobile number associated with a target's Twitter account. Messages can then be sent to Twitter with the source number spoofed.
Context & Ripple Effects
The SMS command channel has been a recurring weak point for Twitter: a flaw in 2009 let attackers trigger viral messages through the service, and in August 2012 researcher pod2g demonstrated on his iOS blog that carrier-level SMS sender spoofing is trivially practical. Rudenberg's disclosure applies that same spoofing primitive directly to Twitter's SMS posting feature — and reportedly to Facebook and Venmo as well.
What makes the timing pointed is that the phone number was being treated simultaneously as an identity credential and an untrusted input: on the very same day Facebook was positioning its Messenger app for Android as a challenger meant to replace SMS outright, while also polling users on privacy governance. The pickup by Gizmodo and Softpedia shows how quickly a single-researcher finding travels when it touches three consumer services at once.
First-order effects
- Anyone who knows a target's mobile number can post to that user's Twitter account while SMS posting is enabled — account control effectively depends on carrier-side filtering the platforms don't control.
- Facebook and Venmo face the same exposure through their own SMS interfaces, putting payment flows (Venmo) and social identity (Facebook) one spoofed sender string away from impersonation.
Second-order effects
- Twitter, Facebook and Venmo are pushed toward deprecating or hardening SMS-based commands — adding PIN requirements or disabling the channel — because they cannot fix sender authentication themselves; it sits with carriers and SS7-era signaling.
- The finding strengthens Facebook's stated case for moving messaging off SMS entirely via Messenger for Android, turning a security liability into a product argument against SMS and WhatsApp.
Third-order effects
- If platforms keep treating phone numbers as proof of identity, every SMS-anchored system inherits the same trust defect; the durable fix is decoupling authentication from the carrier network rather than patching individual services.
- Repeated demonstrations like this shift responsibility debates toward carriers and regulators, since application-layer vendors cannot authenticate senders on their own — the structural tension behind later SMS-security scrutiny.
The trend: SMS is steadily being discredited as both a command channel and an identity anchor, pushing consumer platforms toward in-app authentication and messaging replacements.