Enhancing Two-Factor Authentication Security by Analyzing and Detecting SMS OTP-Interception Techniques in Android Malware

Two-factor authentication (2FA) is a foundational security mechanism that significantly enhances user identity verification's reliability. Despite the availability of various 2FA implementation methods, a considerable proportion still relies on SMS-based one-time passwords (SMS OTP). This approach, however, has been widely discouraged by prominent cybersecurity standardization and advisory bodies such as the National Institute of Standards and Technology (NIST), the European Union Agency for Cybersecurity (ENISA), and the Open Worldwide Application Security Project (OWASP) due to its susceptibility to multiple types of attacks, including those involving malware. The research presented in this paper focuses on evaluating the resilience of a proposed malware detection approach based on static analysis, which is capable of detecting SMS-stealing malware even in the presence of code obfuscation. The study targeted malware applications designed to intercept SMS OTP codes. A key objective was to assess whether code obfuscation techniques hinder the effectiveness of static analysis in detecting such malware. To facilitate this evaluation, a dedicated dataset, SMS Stealing Malware Dataset (SSMD), was constructed using samples from existing collections, including CICMalAnal2017, DREBIN, and RmvDroid. The SSMD consists exclusively of malware samples that actively intercept SMS OTPs. Experimental validation of the proposed malware detection method demonstrated an almost 70% detection rate for malware exploiting the READ_SMS and RECEIVE_SMS permissions. The results further demonstrate that permission-based static analysis techniques remain effective, even when subjected to the evaluated code obfuscation strategies.