If a Domain Name Service Provider's text message platform is improperly designed, the customer's information and text messages can be obtained through brute force attacks.

If a Domain Name Service Provider's text message platform is improperly designed, the customer's information and text messages can be obtained through brute force attacks.
Http://www.nwabc.cn/

You can log on to the SMS group to check whether the user name exists.

Use Fuzzer to sniff existing user names
 

Some accounts are available for brute force cracking.

Ceshi123 ------ 123 ------ messages can be sent javascript: void (0)

Administrator ------ 888888 ------ 3 million + messages can be sent



There are also some accounts with no balance, but there is a lot of customer information, such as this

Happy ------ 123456.
 

 

It is not impossible to be a social worker with the company name and the customer's mobile phone number.
 

 

Solution:

Add a verification code, limit the number of logins, and use a strong password.