Twilio gateway might be vulnerable to voicemail hack

[Bouke]

See also this blogpost which uses the victim's voicemail service to access OTP tokens. When the call goes to voicemail, the tokens can be access through a vulnerable voicemail service (e.g. requiring no PIN). Then the attacker will have access to the tokens and is able to login. When requiring interaction (e.g. pressing a button), this type of attack can be disarmed. Major services like Google and Yahoo are still vulnerable to this type of attack.