Introduction

In recent times, the cyber threat landscape has witnessed a concerning evolution in the tactics employed by hackers. The utilization of automated software programs to exploit OTP (one-time password) verification APIs has emerged as a significant concern. This practice, known as OTP SMS , has the potential to cause widespread disruptions and financial losses. This alarming trend has serious implications for businesses and its users.

Sophisticated Hacks: Unveiling the Threat of OTP SMS

Hackers are becoming more sophisticated, employing automated scripts to exploit OTP verification APIs. A report by a cyber security and monitoring firm highlights how this technique floods mobile devices with excessive OTP SMS messages, leading to potential outages in telecommunications services. The firm stated that users of the SMS bomber input the desired phone number or a selection of phone numbers to which they intend to dispatch messages. Cybercriminals can amass phone numbers of sales department members from "lead vendors" on dark web forums, or even from platforms such as LinkedIn or Scribd, to execute a targeted assault.

MFA Fatigue: The Risks of Exhaustion Attacks

The concept of multi-factor authentication (MFA) was introduced to enhance security. However, hackers are now leveraging OTP SMS to exploit MFA mechanisms. By bombarding users with OTP messages, attackers can cause MFA fatigue or exhaustion, potentially paving the way for unauthorized access. The research sheds light on this emerging threat landscape.

API Abuse: Uncovering Vulnerabilities in Global Companies

The firm's investigation revealed numerous GitHub repositories containing references to companies and their vulnerable APIs. These APIs lack rate limiting and captcha protection, making them susceptible to abuse by automated tools. This enables hackers to exploit these vulnerabilities and this may have consequences for affected brands. OTP SMS serves as a deceptive veil for threat actors attempting illegitimate login activities. By bombarding users with OTP messages, hackers aim to distract and obscure their true intentions. The impact of this tactic on users' devices and access to critical notifications is thoroughly examined in the report.

Legal and Financial Ramifications: The Hidden Costs of SMS

Beyond the immediate disruptions caused by OTP SMS , there are legal and financial implications to consider. The easy accessibility of malicious services and the financial burden they place on brands that own the SMS-sending APIs is enormous. The findings also underline the accessibility and financial aspects of these malicious services, which include numerous online tools that enable anyone to launch such campaigns effortlessly; the tools are available for free, as the primary cost burden falls on the brands owning the SMS-sending APIs; and a single OTP SMS could cost a brand up to 20 paisa. Additionally, the legal consequences of bombarding phones with SMS messages, even in violation of Do Not Disturb (DND) services, are explored by the report.

Sending numerous SMS messages to phones, even after enabling DND (Do Not Disturb) features, is considered as a form of harassment and annoyance according to IPC Section 268. Furthermore, this action is also categorized as theft, deceit, and dishonestly encouraging property delivery under IPC Sections 378 and 420, as stated in the report.

A Global Issue: Exposed APIs and International Impact

OTP SMS isn't limited to India. The research reveals the scope of exposed APIs in various countries, emphasizing the global nature of this threat. The number of exposed APIs according to the country includes India with 44 exposed APIs, Russia with 81 exposed APIs, and Indonesia with one exposed API.

Conclusion

The rise of OTP SMS bombing underscores the need for heightened cybersecurity measures. As hackers employ increasingly sophisticated tactics, individuals and businesses must remain vigilant to protect sensitive information. The vulnerabilities in OTP verification APIs serve as a reminder of the ever-evolving nature of cyber threats and the importance of staying informed and prepared.