Live
- PM Modi condoles demise of Dr. Manmohan Singh
- Former Prime Minister Manmohan Singh Dies at 92: A Legacy of Economic Reforms
- Nagesh Trophy: Telangana, Gujarat dominate action on Day 4 with easy wins
- Get Ready for Dreame Technology’s Year-End Amazon Sale – Big Savings on Smart Home Products
- FIR registered as 4 voter forgery cases come to light in Delhi's Okhla constituency
- Ayodhya Ram temple to host majestic anniversary celebrations on Jan 11 with devotional, cultural programmes
- National Policy Framework on Agricultural Marketing draft silent on MSP: Punjab
- Thyrocare Sets Benchmark as The First National Diagnostic Chain with 100% of its Labs with NABL Accreditation
- Hisense India Partners with Reliance resQto Elevate After-Sales Service Nationwide
- RG Kar tragedy: CFSL reports suggest further probe to find whether rape & murder committed by only one or others involved
Hackers use OTP APIs for SMS bombing, 44 Indian APIs exposed
Hackers have developed automated software programmes that exploit OTP (One-Time Password) verification APIs (Application Programming Interface) to flood mobile devices with excessive OTP SMS messages, a new report said on Monday.
New Delhi : Hackers have developed automated software programmes that exploit OTP (One-Time Password) verification APIs (Application Programming Interface) to flood mobile devices with excessive OTP SMS messages, a new report said on Monday.
According to the cyber-security company CloudSEK, when these rogue scripts are released, they have the potential to cause targeted outages of telecommunications services, causing financial and reputational harm to the brands affected.
The situation raises concerns about the possibility of "multi-factor authentication (MFA) fatigue" or "exhaustion" attacks in account takeover scenarios.
The researchers have uncovered multiple GitHub repositories containing references to global companies and their APIs. These APIs allow unlimited OTP SMS messages to be sent to any number, lacking rate limiting or captcha protection.
This vulnerability has led to the abuse of these APIs by automated tools, resulting in increased API costs, legal repercussions, and reputational damage to affected brands.
"This attack could be used as a veil to hide illegitimate login attempts made by the threat actors to gain access to the users' device. This also implies that while the attack is going on the user may miss out on critical notifications," said Mudit Bansal, Cyber Threat Researcher, CloudSEK.
"Further, due to the constant request of OTPs a service might block your account and you might not be able to access it," he added.
Moreover, the number of exposed APIs according to the country includes -- India with 44 exposed APIs, Russia with 81 exposed APIs, and Indonesia with one exposed APIs.
The findings also underline the accessibility and financial aspects of these malicious services, which include -- numerous online tools that enable anyone to launch such campaigns effortlessly, the tools are available for free, as the primary cost burden falls on the brands owning the SMS-sending APIs, and a single OTP SMS could cost a brand up to 20 paisa.
Bombarding phones with SMS messages, even after activating DND (Do Not Disturb) services, constitutes harassment and nuisance under IPC Section 268, and further qualifies as theft, cheating, and dishonest inducement of property delivery under IPC Sections 378 & 420, the report mentioned.
