Rogue Scripts Are Exploiting OTP Verification APIs To Send Heaps of OTP SMSes, Hold The Potential Of Triggering Service Disruptions.

Number of Exposed APIs according to the country
India	44
Indonesia	1
Russia	81

Note - These graphs are based on APIs found and collated from the source code of multiple sms bombing tools, some of which are archived now. Cloudsek researchers refrained from testing these APIs for their current vulnerability status.

Attack chain

Collecting Target Phone Numbers: The user of the SMS bomber provides the target phone number or a list of phone numbers to which they want to send the messages. This information can be input manually or imported from a file.

This depends on the motivation of the threat actor, for a prank, only the friend’s number would be used, but for a dedicated attack the phone numbers of representatives of the sales department could be collected from the “lead sellers” from dark web forums or even from linkedin or scribd.

These numbers are then passed into the software which makes continued multiple requests at the target APIs and the attack starts.

Attack chain (Contd)

Continuous Operation: The tool will continue sending messages until a preset limit is reached or until the user decides to stop the operation manually. This can result in a flood of messages and/or calls being sent to the target phone number.

Impact on the Target: The constant influx of messages and calls can overwhelm the target's device, potentially causing it to slow down, freeze, or even crash. Additionally, the target may be constantly alerted with notifications, making it difficult to use the device for other tasks.

As in the case of Uber hack, this could also lead to “MFA fatigue” or “exhaustion” attacks

Finally, the inbox of the receiver could get filled which blocks him from receiving new and potentially important messages.

In our example, the sales operation of the targeted company could shut down entirely because of the constant bombardment of sms and calls.

Legal repercussions - Bombarding a phone with SMSes even after it activates the DND service is not just a form of harassment and nuisance (IPC Section 268), but “a trap, bait, and a criminal act of theft, cheating and dishonestly inducing delivery of property under IPC Sections 378 & 420,” said Bombay High Court lawyer Satya Mulay. ( reference )

Accessibility and finances of such services -

Mitigation

For Brands	For Users
Rate Limiting and Throttling: Implement rate limiting and throttling mechanisms for API requests. This prevents a single user or IP address from sending a large volume of requests in a short amount of time. This can help deter automated attacks by slowing down the rate of requests. User Authentication and Authorization: Require users to authenticate and authorize their usage of the API. This can involve using API keys, OAuth tokens, or other forms of authentication to ensure that only authorized users can access the API. CAPTCHA and Human Verification: Implement CAPTCHA challenges or other forms of human verification for actions that involve sending messages. This helps prevent automated bots from abusing your services. Abuse Detection and Blocking: Implement algorithms that can detect patterns of abuse, such as a sudden surge in requests from a single source. Automatically flag or block suspicious activity and notify administrators. Monitoring and Analytics: Implement monitoring and analytics tools to track API usage patterns. This can help you identify unusual behavior and take action against potential attacks in real-time. Use CloudSEK’s Xvigil tool to find if threat actors are abusing your APIs with its github repository scanning feature.	Ask the tools owners (links later in the report) to put your phone number in the protected list. Ask your telecom provider to activate Do Not Disturb on your phone number.

For Brands

For Users

Rate Limiting and Throttling: Implement rate limiting and throttling mechanisms for API requests. This prevents a single user or IP address from sending a large volume of requests in a short amount of time. This can help deter automated attacks by slowing down the rate of requests.
User Authentication and Authorization: Require users to authenticate and authorize their usage of the API. This can involve using API keys, OAuth tokens, or other forms of authentication to ensure that only authorized users can access the API.
CAPTCHA and Human Verification: Implement CAPTCHA challenges or other forms of human verification for actions that involve sending messages. This helps prevent automated bots from abusing your services.
Abuse Detection and Blocking: Implement algorithms that can detect patterns of abuse, such as a sudden surge in requests from a single source. Automatically flag or block suspicious activity and notify administrators.
Monitoring and Analytics: Implement monitoring and analytics tools to track API usage patterns. This can help you identify unusual behavior and take action against potential attacks in real-time.
Use CloudSEK’s Xvigil tool to find if threat actors are abusing your APIs with its github repository scanning feature.

Ask the tools owners (links later in the report) to put your phone number in the protected list.
Ask your telecom provider to activate Do Not Disturb on your phone number.

Executive Summary

THREAT

IMPACT

MITIGATION

Analysis and Attribution

The affected companies and their exposed APIs (region wise) -

Attack chain

Attack chain (Contd)

Accessibility and finances of such services -

Mitigation

Scripts

References

Recent Articles

Get Global Threat Intelligence on Real Time

Protect and proceed with Actionable Intelligence