Abstract
AbstractTwo Factor Authentication (2FA) using One Time Password (OTP) codes via SMS messages is widely used. In order to improve user experience, Google has proposed APIs that allow the automatic verification of the SMS messages without the intervention of the users themselves. They reduce the risks of user error, but they also have vulnerabilities. One of these APIs is the SMS Retriever API for Android devices. This article presents a method to study the vulnerabilities of these OTP exchange APIs in a given sector. The most popular API in the sector is selected, and different scenarios of interaction between mobile apps and SMS OTP servers are posed to determine which implementations are vulnerable. The proposed methodology, applied here to the banking sector, is nevertheless simple enough to be applied to any other sector, or to other SMS OTP APIs. One of its advantages is that it proposes a method for detecting bad implementations on the server side, based on analyses of the apps, which boosts reusability and replicability, while offering a guide to developers to prevent errors that cause vulnerabilities. Our study focuses on Spain’s banking sector, in which the SMS Retriever API is the most popular. The results suggest that there are vulnerable implementations which would allow cybercriminals to steal the users SMS OTP codes. This suggests that a revision of the equilibrium between ease of use and security would apply in order to maintain the high level of security which has traditionally characterized this sector.
Funder
Universidad de Valladolid
Publisher
Springer Science and Business Media LLC
Subject
Electrical and Electronic Engineering,Computer Networks and Communications,Information Systems
Reference29 articles.
1. Authority, E. B. (2015). Directive
2. (EU) 2015/2366 of the European Parliament and of the Council of 25 November 2015 on payment services in the internal market, amending Directives 2002/65/EC, 2009/110/EC and 2013/36/EU and Regulation
3. (EU) No 1093/2010, and repealing Directive 2007/64/EC (Text with EEA relevance) (2015). https://eur-lex.europa.eu/eli/dir/2015/2366/oj
4. Lei, Z., Nan, Y., Fratantonio, Y., Bianchi, A., & Talos, C. (2021). On the insecurity of SMS one-time password messages against local attackers in modern mobile devices. Network and Distributed System Security Symposium. https://doi.org/10.14722/ndss.2021.24212
5. Zhou, Y., Hu, L., & Chu, J. (2017). An enhanced SMS-based OTP scheme. In Proceedings of the 2017 2nd international conference on automation, mechanical control and computational engineering (AMCCE 2017), pp. 1091– 1094. Atlantis Press, (2017/03). https://doi.org/10.2991/amcce-17.2017.196
Cited by
1 articles.
订阅此论文施引文献
订阅此论文施引文献，注册后可以免费订阅5篇论文的施引文献，订阅后可以查看论文全部施引文献