Ausnahme gefangen: SSL certificate problem: certificate is not yet valid ๐Ÿ“Œ The Case of the Disappearing OTPs: Exposing SMS Pumping Attacks

๐Ÿ  Team IT Security News

TSecurity.de ist eine Online-Plattform, die sich auf die Bereitstellung von Informationen,alle 15 Minuten neuste Nachrichten, Bildungsressourcen und Dienstleistungen rund um das Thema IT-Sicherheit spezialisiert hat.
Ob es sich um aktuelle Nachrichten, Fachartikel, Blogbeitrรคge, Webinare, Tutorials, oder Tipps & Tricks handelt, TSecurity.de bietet seinen Nutzern einen umfassenden รœberblick รผber die wichtigsten Aspekte der IT-Sicherheit in einer sich stรคndig verรคndernden digitalen Welt.

16.12.2023 - TIP: Wer den Cookie Consent Banner akzeptiert, kann z.B. von Englisch nach Deutsch รผbersetzen, erst Englisch auswรคhlen dann wieder Deutsch!

Google Android Playstore Download Button fรผr Team IT Security



๐Ÿ“š The Case of the Disappearing OTPs: Exposing SMS Pumping Attacks


๐Ÿ’ก Newskategorie: Programmierung
๐Ÿ”— Quelle: dev.to

Imagine this: you've integrated a robust 2-step verification (2FA) system using Twilio for OTP delivery, feeling confident about your user security. But then, a wave of confusion hits your team. OTP codes are flying out, yet your backend logs show no record of user requests. Panic sets in โ€“ is it a security breach? An internal threat?

This scenario, though unsettling, might be a case of a sneaky cybercrime tactic known as SMS pumping.

What is SMS Pumping?

SMS pumping, also called SMS traffic pumping or International Revenue Share Fraud (IRSF), exploits weaknesses in systems that rely on SMS verification. Attackers use bots to bombard your platform with fake requests for OTP codes. These codes are then sent to phone numbers controlled by the attackers, who often profit through revenue-sharing agreements with certain mobile carriers.

Our Story: A Baffling Mystery

In our project, everything seemed secure. We had 2FA with Twilio, and Cloudflare guarded our systems against bots. Even Postman, our API testing tool, was locked down. Yet, the inexplicable OTP storm raged on. Internal investigations yielded no culprits.

Unmasking the Culprit: The Signs of SMS Pumping

The key to identifying SMS pumping lies in the red flags:

  • Spike in OTP requests: A sudden, dramatic increase in OTP requests, often originating from sequential phone numbers controlled by the same carrier.

  • Missing backend logs: No corresponding user activity on your platform for the OTP requests.

  • Incomplete verification cycles: If the OTPs are intended for user verification, you won't see completed verification processes.

Fighting Back Against SMS Pumping

Here's how to fortify your defenses:

  • Validate phone numbers: Implement checks to ensure phone numbers are valid and belong to real users.
  • Rate limiting: Set limits on the number of OTP requests allowed per user or IP address.
  • Advanced fraud detection: Consider solutions that analyze user behavior to identify suspicious activity.
  • Partner with Twilio: Twilio offers fraud prevention tools to help combat SMS pumping.

Lessons Learned

Our experience highlights the importance of staying vigilant against emerging cyber threats. By understanding the signs of SMS pumping and implementing robust security measures, you can protect your platform and user data.

Remember, security is an ongoing process. Stay informed and adapt your defenses to stay ahead of the game!

...



๐Ÿ“Œ The Case of the Disappearing OTPs: Exposing SMS Pumping Attacks


๐Ÿ“ˆ 112.52 Punkte

๐Ÿ“Œ Malicious Apps from Google PlayStore Bypassing SMS-Based Two-Factor Authentication and Steal OTPs in SMS


๐Ÿ“ˆ 47.59 Punkte

๐Ÿ“Œ Apple wants to standardize the format of SMS OTPs (one-time passcodes)


๐Ÿ“ˆ 38.05 Punkte

๐Ÿ“Œ Apple Wants To Standardize the Format of SMS OTPs (One-Time Passcodes)


๐Ÿ“ˆ 38.05 Punkte

๐Ÿ“Œ Snake Case VS Camel Case VS Pascal Case VS Kebab Case โ€“ What's the Difference Between Casings


๐Ÿ“ˆ 35.71 Punkte

๐Ÿ“Œ Experts Warn of "SMS Pumping" Fraud Epidemic


๐Ÿ“ˆ 35.51 Punkte

๐Ÿ“Œ Artificial Inflation of Traffic: So schadet SMS Traffic Pumping


๐Ÿ“ˆ 35.51 Punkte

๐Ÿ“Œ Raivo OTP: iOS-App zur Verwaltung von OTPs


๐Ÿ“ˆ 28.51 Punkte

๐Ÿ“Œ Google Messages Will Automatically Delete Your OTPs After 24 Hours


๐Ÿ“ˆ 28.51 Punkte

๐Ÿ“Œ Global AppSec Dublin: [T]OTPs Are Not As Secure As You Might Believe - Santiago Kantorowicz


๐Ÿ“ˆ 28.51 Punkte

๐Ÿ“Œ Telegram Offers Premium Subscription in Exchange for Using Your Number to Send OTPs


๐Ÿ“ˆ 28.51 Punkte

๐Ÿ“Œ Saturn's Rings Are Disappearing At a 'Worst-Case Scenario' Rate, NASA Says


๐Ÿ“ˆ 28.32 Punkte

๐Ÿ“Œ Pumping the Brakes on Artificial Intelligence


๐Ÿ“ˆ 25.97 Punkte

๐Ÿ“Œ Pumping the Brakes a Bit on FISA โ€œReformโ€


๐Ÿ“ˆ 25.97 Punkte

๐Ÿ“Œ Ransomware victim Colonial Pipeline paid $5m to get oil pumping again, restored from backups anyway โ€“ report


๐Ÿ“ˆ 25.97 Punkte

๐Ÿ“Œ Scientists Race To Find Who is Pumping a Dangerous Gas Into the Atmosphere


๐Ÿ“ˆ 25.97 Punkte

๐Ÿ“Œ 'Pumping Heart Patch' Ready For Human Use


๐Ÿ“ˆ 25.97 Punkte

๐Ÿ“Œ Beat Saber's latest free song, FitBeat, will get your blood pumping


๐Ÿ“ˆ 25.97 Punkte

๐Ÿ“Œ This Group of CISOs Is Pumping Their Own Money and Advice Into Security Startups


๐Ÿ“ˆ 25.97 Punkte

๐Ÿ“Œ TikTok Traders Are Pumping Joke Cryptocurrency Dogecoin -- and the Price is Up 95%


๐Ÿ“ˆ 25.97 Punkte

๐Ÿ“Œ Why the US Is Pumping More Oil Than Any Country in History


๐Ÿ“ˆ 25.97 Punkte

๐Ÿ“Œ Google's Investing Arms Are Pumping $1.56 Billion Into Blockchain Companies


๐Ÿ“ˆ 25.97 Punkte

๐Ÿ“Œ Can Pumping CO2 Into California's Oil Fields Help Stop Global Warming?


๐Ÿ“ˆ 25.97 Punkte

๐Ÿ“Œ SMS Intercept Attacks and Why SMS Multi-Factor Still Matters


๐Ÿ“ˆ 24.63 Punkte

๐Ÿ“Œ SMS Replacement is Exposing Users to Text, Call Interception Thanks to Sloppy Telecos


๐Ÿ“ˆ 24.16 Punkte

๐Ÿ“Œ SMS Replacement is Exposing Users To Text, Call Interception Thanks To Sloppy Telecos


๐Ÿ“ˆ 24.16 Punkte

๐Ÿ“Œ Poor endpoint visibility exposing firms to 'systemic ransomware attacks'


๐Ÿ“ˆ 20.18 Punkte

๐Ÿ“Œ High Street Banks Exposing Customers to Phishing Attacks


๐Ÿ“ˆ 20.18 Punkte

๐Ÿ“Œ ConnectWise fixes RCE bug exposing R1Soft backup servers to attacks


๐Ÿ“ˆ 20.18 Punkte

๐Ÿ“Œ ConnectWise fixes RCE bug exposing thousands of servers to attacks


๐Ÿ“ˆ 20.18 Punkte

๐Ÿ“Œ WordPress fixes POP chain exposing websites to RCE attacks


๐Ÿ“ˆ 20.18 Punkte

๐Ÿ“Œ Password Meters are exposing online users to Cyber Attacks


๐Ÿ“ˆ 20.18 Punkte

๐Ÿ“Œ PoC Released for Critical Vulnerability Exposing SharePoint Servers to Attacks


๐Ÿ“ˆ 20.18 Punkte

๐Ÿ“Œ Attacks growing in both scope and sophistication, exposing gaps in the cloud native toolchain


๐Ÿ“ˆ 20.18 Punkte

๐Ÿ“Œ mHealth App APIs Vulnerable To Attacks Exposing PII & PHI โ€“ Experts Insight


๐Ÿ“ˆ 20.18 Punkte











matomo