Identifying Implementation Flaws of SMS OTP Authentication

Currently, the Short Message Service (SMS) One-Time Passwords (OTP) authentication is widely adopted in mobile applications. However, due to improper implementation by developers, significant security flaws exist in the SMS OTP authentication mechanisms of some apps. To provide a comprehensive and accurate assessment, we propose a new approach. First, we locate the SMS OTP authentication page through UI exploration. Then, using hooking technology, we conduct simulated attacks to verify the security of the SMS OTP authentication in the app, focusing on its susceptibility to brute-force attacks. This approach is applicable to apps with app-side or UI-layer protection measures, uncovering hidden implementation flaws beneath these protections. Technically, we employ dynamic analysis based on the ART virtual machine instrumentation to obtain runtime information of the app and generate vulnerability verification scripts, overcoming the challenges posed by code-packing in program analysis. We implemented a semi-automatic tool named <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">AuthChecker</i> and tested it on 950 popular apps, identifying 87 apps with security flaws that potentially allow attackers to achieve unauthorized account access. Our findings highlight the security issues in SMS OTP authentication of apps, promoting improvements in vulnerability patching and preventive strategies by developers.