One Time Password via Text Message: Possible exploits?

Question

Is there a credible scenario in which the OTP (One Time Password) for online credit card transactions ( specifically for Verified by Visa) can be bypassed?

Context: A guy I know was cheated via the usual social engineering routes (dumb I know!) into revealing his Credit Card details & a fraudulent transaction was made. The bank says an accurate OTP was entered and hence their liability ends. I tend to agree with them.

The victim OTOH insists that although he did give his Card Number, Expiry date & CVV to the phishers over the phone, he never gave them the OTP received via his cellphone SMS (text message). I find that hard to rationalize.

That's why I'm wondering if there really could be channels of attack that somehow defeat the OTP-SMS protection? The only possibility I could brainstorm is some variant of SIM card cloning.

What do people think? Know any exploit reports like this in the wild? (Normally I'd have not believed the victims insistence that he never revealed the OTP but I'm just playing devils advocate for a bit)

In case it matters, Verified by Visa uses a 4-6 digit OTP sent via text message & it is supposed to expire in 180 secs.

Answer 1

If your friend is telling the truth then there are a few different ways the attackers could have gotten the code:

1. If the phone is a GSM it's possible they could have cloned his SIM and received his text messages that way
2. Text messages are processed by systems called SMS-Cs - servers running software that handles text messages which are located in the cell provider's network. If the phishers managed to hack the SMS-C they could have access to every text message in the system
3. His phone was hacked - phone malware could have given the phishers access to text messages on his phone
4. An app on the phone leaked the information using permissions. On Android when you install an application it will pop up a message with all the access the app requires. Apps offering the most minor functionality sometimes request to access email, sms, contacts, photos, location, and browsing history - way more than required to do what they say. If you permit an application access to SMS messages it will be able to legitimately forward every SMS you send or receive to a third party. Most of the time this is done to sell to advertisers, however some of these applications are known to have been developed by criminals expressly for the purpose of identity theft and to assist in wider crime.

So it is entirely possible that your friend did not give the criminals the SMS details directly, instead it's quite likely that he gave them indirectly through the apps he installed.

Answer 2

As OTP by SMS grows in popularity, there's a growing trend in malware to steal it.

For example, check out this report on NeverQuest. Once it infects your computer and steals all your other credentials, it shows a very professional looking page, apparently from your bank, asking you to download an app. And then of course, it steals your OTPs.

(PDF) https://devcentral.f5.com/d/neverquest-malware-analysis?download=true

If your friend insists that he was not asked to download an app, then the likely scenario is this:

1. He downloaded an app that looked legit and required text message reading permissions.
2. Once the app was running, it sent his phone number to the scammers.
3. The scammers called him and asked for his details.
4. The scammers logged in using his details.
5. The bank sent your friend an OTP.
6. The app forwarded it to the scammers and deleted the SMS from the phone.
7. The scammers completed login using the OTP.

I've not heard of this method in use, but it would be very simple to implement. Much easier than Neverquest.

Answer 3

You should consider also that an attacker used IMSI catcher as a possible attack vector to get access to the mobile phone data.

IMSI catchers are essentially devices which imitate mobile phones towers in order to intercept calls and text messages. These devices can grab information such as the International Mobile Subscriber Identity, as well as phone calls and text messages.

Th government agencies and law enforcement can use these, but you can always buy one on the black market or build one yourself (if you know how to do it)

IMSI catchers hijack the phone's signal, and in some cases, intercept the contents of calls and texts. The IMSI catchers take advantage of a vulnerability built into the system. Phones using 3G or 4G technology can authenticate cell towers, but phones on older 2G systems cannot tell between real and fake towers.

An IMSI catcher blocks the smarter 3G and 4G signals, forcing mobile phones in the area to switch to the unsecured 2G service — something that phones also do routinely in more rural areas, where 2G service is widespread. The IMSI catcher then poses as a tower and "catches" signals.

Answer 4

If it's a four-digit password and you get three tries to enter it, then three in every 10,000 attacks will succeed by trying random passwords. That doesn't sound like very much, but if every one of the 1 billion or so people with a credit or debit card were to be attacked in this way then there would be 300,000 people all telling stories like your friend's.