amazon-web-services - AWS Cognito 在未经我许可的情况下发送 SMS 消息

Question

我注意到几个月前发送的 SMS 消息有一笔奇怪的费用，由于我们的代码尚不支持发送 SMS 消息，我一直在调查它。

事实证明，当我们将“UpdateUserPool”调用到 +12064350128 (206-435-0128) 时，AWS Cognito 正在发送文本消息。这不是与我们的帐户、我们的代码或我们的任何人员相关联的电话号码。更糟糕的是，这个 AWS 账户只托管公众无法访问的开发环境。所以我们知道它要么是亚马逊员工的号码，要么是安全漏洞(或两者兼而有之)。

有其他人发生过这种情况吗？除了可能来自西雅图的某个人之外，对该电话号码的谷歌搜索一无所获。

有谁知道这些消息中发送的是什么类型的数据，或者如何找出其中的内容？是密码和 secret 信息吗？

我打开了 SMS 日志记录，这是我可以收集的所有数据:

{
    "notification": {
        "messageId": "975e37a9-a5f1-5397-b6d0-63fdbad40d83",
        "timestamp": "2018-10-31 21:21:41.756"
    },
    "delivery": {
        "destination": "+12064350128",
        "priceInUSD": 0.00645,
        "smsType": "Transactional",
        "providerResponse": "Message has been accepted by phone",
        "dwellTimeMs": 168,
        "dwellTimeMsUntilDeviceAck": 2514670
    },
    "status": "SUCCESS"
}

Answer 1

我从 AWS 支持收到以下内容。看起来是无害的。哇!

I completely understand your concern of AWS Cognito sending messages to phone number +12064350128. I got in touch with the Cognito team and found that it is an expected behaviour that when you make an UpdateUserPool API call, a message is sent out to +12064350128 and this applies to all AWS accounts. The phone number +12064350128 is an internal number and a message to this number is sent out to verify if Cognito and SNS are integrated correctly so that Cognito can send SMS to other numbers. Please note that no security information including passwords is being passed in the content of this SMS message, It's just a sample message indicating SNS is integrated with Cognito correctly.

Please be rest assured that we treat customer's data with utmost privacy and we have a strict security mechanism in place to check any fraudulent activities.

I also completely agree that the above behavior needs to be documented and hence I will be reaching out to the Cognito team to get this updated in our docs to avoid further confusion.