SMS Goes Nuclear: Fortifying SMS-Based MFA in Online Account Ecosystem
Weizhao Jin, Xiaoyu Ji, Ruiwen He, Zhou Zhuang, Wenyuan Xu, Yuan, Tian

TL;DR
This paper uncovers vulnerabilities in SMS-based multi-factor authentication within the online account ecosystem, demonstrating how dependencies can lead to widespread account compromises, and proposes a systematic detection and mitigation approach.
Contribution
It introduces ActFort, a novel system for detecting vulnerabilities in online account dependencies and proposes countermeasures to strengthen SMS-based MFA security.
Findings
Identified systemic vulnerabilities in SMS-based MFA
Demonstrated the feasibility of Chain Reaction Attacks
Proposed effective countermeasures for ecosystem security
Abstract
With the rapid growth of online services, the number of online accounts proliferates. The security of a single user account no longer depends merely on its own service provider but also the accounts on other service platforms(We refer to this online account environment as Online Account Ecosystem). In this paper, we first uncover the vulnerability of Online Account Ecosystem, which stems from the defective multi-factor authentication (MFA), specifically the ones with SMS-based verification, and dependencies among accounts on different platforms. We propose Chain Reaction Attack that exploits the weakest point in Online Account Ecosystem and can ultimately compromise the most secure platform. Furthermore, we design and implement ActFort, a systematic approach to detect the vulnerability of Online Account Ecosystem by analyzing the authentication credential factors and sensitive personal…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsUser Authentication and Security Systems · Spam and Phishing Detection · Advanced Malware Detection Techniques
