An Empirical Study of SMS One-Time Password Authentication in Android Apps

被引：22

作者：

Ma, Siqi ^{[1
]}

Feng, Runhan ^{[2
]}

Li, Juanru ^{[2
]}

Liu, Yang ^{[3
]}

Nepal, Surya ^{[1
]}

Ostry, Diethelm ^{[1
]}

Bertino, Elisa ^{[4
]}

Deng, Robert H. ^{[5
]}

Ma, Zhuo ^{[3
]}

Jha, Sanjay ^{[6
]}

机构：

[1] CSIRO, Canberra, ACT, Australia

[2] Shanghai Jiao Tong Univ, Shanghai, Peoples R China

[3] Xidian Univ, Xian, Peoples R China

[4] Purdue Univ, W Lafayette, IN 47907 USA

[5] Singapore Management Univ, Singapore, Singapore

[6] Univ New South Wales, Sydney, NSW, Australia

来源：

35TH ANNUAL COMPUTER SECURITY APPLICATIONS CONFERENCE (ACSA) | 2019年

基金：

中国国家自然科学基金;

关键词：

Authentication Protocol; Mobile Application Security; One-Time Password Authentication; Vulnerability Detection; SECURITY; SCHEMES;

D O I：

10.1145/3359789.3359828

中图分类号：

TP [自动化技术、计算机技术];

学科分类号：

0812 ;

摘要：

A great quantity of user passwords nowadays has been leaked through security breaches of user accounts. To enhance the security of the Password Authentication Protocol (PAP) in such circumstance, Android app developers often implement a complementary One-Time Password (OTP) authentication by utilizing the short message service (SMS). Unfortunately, SMS is not specially designed as a secure service and thus an SMS One-Time Password is vulnerable to many attacks. To check whether a wide variety of currently used SMS OTP authentication protocols in Android apps are properly implemented, this paper presents an empirical study against them. We first derive a set of rules from RFC documents as the guide to implement secure SMS OTP authentication protocol. Then we implement an automated analysis system, AUTH-EYE, to check whether a real-world OTP authentication scheme violates any of these rules. Without accessing server source code, AUTH-EYE executes Android apps to trigger the OTP-relevant functionalities and then analyzes the OTP implementations including those proprietary ones. By only analyzing SMS responses, AUTH-EYE is able to assess the conformance of those implementations to our recommended rules and identify the potentially insecure apps. In our empirical study, AUTH-EYE analyzed 3,303 popular Android apps and found that 544 of them adopt SMS OTP authentication. The further analysis of AUTH-EYE demonstrated a far-from-optimistic status: the implementations of 536 (98.5%) out of the 544 apps violate at least one of our defined rules. The results indicate that Android app developers should seriously consider our discussed security rules and violations so as to implement SMS OTP properly.

引用

页码：339 / 354

页数：16

共 46 条

[1]

[Anonymous], 2006, Inf. Syst. Secur., DOI DOI 10.1080/10658980601051318

[2]

[Anonymous], 2011, Technical Report

[3] Wired versus wireless security: The Internet, WAP and iMode for e-commerce [J].

Ashley, P ;

Hinton, H ;

Vandenwauver, M .

17TH ANNUAL COMPUTER SECURITY APPLICATIONS CONFERENCE, PROCEEDINGS, 2001, :296-306

[4] Addressing Smartphone-based Multi-factor Authentication via Hardware-rooted Technologies [J].

Ba, Zhongjie ;

Ren, Kui .

2017 IEEE 37TH INTERNATIONAL CONFERENCE ON DISTRIBUTED COMPUTING SYSTEMS (ICDCS 2017), 2017, :1910-1914

[5] Exploitation and Mitigation of Authentication Schemes Based on Device-Public Information [J].

Bianchi, Antonio ;

Gustafson, Eric ;

Fratantonio, Yanick ;

Kruegel, Christopher ;

Vigna, Giovanni .

33RD ANNUAL COMPUTER SECURITY APPLICATIONS CONFERENCE (ACSAC 2017), 2017, :16-27

[6] The Quest to Replace Passwords: A Framework for Comparative Evaluation of Web Authentication Schemes [J].

Bonneau, Joseph ;

Herley, Cormac ;

van Oorschot, Paul C. ;

Stajano, Frank .

2012 IEEE SYMPOSIUM ON SECURITY AND PRIVACY (SP), 2012, :553-567

[7]

Butler S., 2011, 2011 IEEE 27th International Conference on Software Maintenance, P93, DOI 10.1109/ICSM.2011.6080776

[8]

Carter Patrick., 2016, International Conference on Financial Cryptography and Data Security, P231

[9]

Crocker Steve, 1994, TECHNICAL REPORT

[10] A Markov adversary model to detect vulnerable iOS devices and vulnerabilities in iOS apps [J].

D'Orazio, Christian J. ;

Lu, Rongxing ;

Choo, Kim-Kwang Raymond ;

Vasilakos, Athanasios V. .

APPLIED MATHEMATICS AND COMPUTATION, 2017, 293 :523-544

← 1 2 3 4 5 →