SMS Based One Time Password: Risks and Safeguarding Tips

With the evolution of the digital world, the need to ensure customer identity has also changed. Today’s customers expect from the safe experiences of organizations. Growing use of cloud-based services and mobile devices has also increased the risk of data breach. Do you know that general accounts piracy losses increased 61% to $ 2.3 billion and that incidents increased to 31% over 2014?

One-Time Password based on SMS technology invented to tackle phishing and other security risks related to authentication in the Web world. In general, the SMS-based OTP is used as the second-factor authentication solutions for two factors. It requires users to have a single OTP after entering the credentials to be verified on the site. 2FA has become an effective way to reduce incidents of piracy and prevent identity fraud.

But unfortunately, the SMS-based OTP are safer today. There are two main reasons behind this:

First, most SMS-based OTP security based on the text message confidentiality. But SMS is based on the security of cellular networks and recently many GSM and 3G networks involved that the confidentiality of such SMS can not be essentially provided.
Secondly, hackers are doing their best to intrude on customer data and thus have developed many Trojans specialize in mobile phones to access customer data.
Talk about them in detail!
Key risks associated with SMS-based OTP:

The main objective of the attacker is to acquire this unique password and make it possible, various options are developed such as Trojan’s mobile phones, wireless interception, SIM swap attacks. Let’s go into details:

1. Wireless Interception:

There are many factors that make GSM technology less secure, such as lack of mutual authentication, lack of robust encryption algorithms, etc. It is also found that communication between cell phones or base stations can be heard and with the help of some of the weaknesses of the protocol can be deciphered as well. In addition, we find that abusing femtocells, 3G communications can be intercepted. In this attack, a modified firmware is installed on the femtocell. This firmware contains sniffing and interception capabilities. In addition, these devices can be used to mount attacks against cell phones.

2. Trojan’s mobile phone:

The latest growing threats to mobile devices are mobile malware phones, especially Trojans. This malware are specifically designed to intercept SMS that contains individual passwords. The main purpose behind creating such malware is to make money. Understand the different types of Trojans capable of stealing SMS based OTP.

The first piece was known as Trojans Zitmo (Zeus on the cell phone) for Symbian OS. This trojan was developed to intercept MTAN. The Trojan has the ability to register on the Symbian operating system so that when SMS can be intercepted. It contains more features such as sending messages, deleting messages, etc. The removal ability completely hides the fact that the message has arrived.

A similar type of Trojan for Windows Mobile was identified in February 2011, called Trojan-Spy.WinCE.Zot.a The features of this Trojan were similar to those described above.

The Trojans for Android and RIM Blackberry also exist. All of these known Trojans are user-installed software, and therefore they do not support any vulnerability of the affected security platform. In addition, they use social engineering to convince users to install the bit.

3. Free Wi-Fi and free public points:

Nowadays, it is more difficult for hackers to use an unsecured Wi-Fi network to distribute malware. Planting infected software on your mobile device is no longer a difficult task if you allow file sharing over the network. In addition, some criminals are also able to cut connection points. Thus, they present a popup during the login process forcing them to update some popular software.

4. Encoding and duplication SMS:

The transmission of SMS from the institute to the client takes place in text format. And I need to say that it goes through various intermediates, such as SMS aggregator, cellular carrier, application management provider, etc. And one of the collusion hackers with weak security controls can be a huge risk. In addition, several times, hackers get the SIM card locked, providing a fake identity proof and acquire the SIM duplicate by visiting the retail point of mobile operators. Now the hacker is free to access all the OTP has reached that number.

5. Malware:

Malware is the aggressive type of advertising that helps provide targeted advertising through the data and location of the smartphone by providing free mobile applications. But some of these programs have the ability to operate as spyware, which can capture personal data and transfer them to the application owner.

What’s the solution?

The use of some precautionary measures required to ensure security against the vulnerability of the One Time password based on SMS. There are many solutions here like introducing hardware tokens. In this approach, while performing an operation, the token generates a unique password. Another option is to use a touch-authentication process. In addition, an application may also need to be installed on the mobile phone to generate OTP. Below are two tips for securing SMS-based OTP:

1.End encryption for final SMS:

In this approach, end encryption in order to protect the original password as soon as the deletion of its functionality if the SMS is listening. It uses the “private application storage”, available on most cell phones these days. This permanent storage area is particular to each application. This data can only be accessed by the application that stores data. In this process, the first step contains the same OTP generation process, but in the second step, this OTP is encrypted with a key and OTP is sent to the client-centric mobile client. In the telephone receiver, a dedicated application displays the OTP after decryption. This means that even though the Trojan is able to access SMS, it will not be possible to decrypt the OTP because of the lack of the required key.

2. Virtual dedicated channel for mobile:

Because phone Trojans are the biggest threat to SMS-based OTPs, since running a large-scale Trojan attack is difficult, this process requires minimal operating system support and minimal support for any mobile network provider. In this solution, some SMS messages are protected against spying by sending only one channel or a special application. The process requires a virtual channel dedicated to the mobile phone operating system. This chain redirects certain messages to a specific OTP application, making it secure against espionage. Using the private storage application guarantees security protection.

Finally, whatever process you choose, no technology guarantees 100% security. The key here is to be aware of and updated on the rapid changes in technology.