What is the security of one time login with SMS code?

Question

I am writing a web application and I want to let my users to login by sending one time code to a given number. The code will be received by a GSM module within certain time after it's generation and will be sent to the server for authentication.

Is this method vulnerable to SMS spoofing easily? Is SMS spoofing very easy? Or what kind of other threats could be possible for this method.

I am avoiding to send message to the user's number because Pakistan Telecommunication Authority blocks the sim card if we send messages above a certain amount.

Answer 1

SMS spoofing is certainly possible. However, SMS spoofing doesn't make your security verification any less secure. All spoofing does is allow an attacker to send your user a different code. The code will obviously be wrong, and may confuse the user, but it doesn't hurt anything, in the sense that an attacker can't gain access to someone's account by spoofing texts. What would be a problem is SMS interception. If an attacker can intercept the message then they would be able to login to someone else's account if they also somehow already know that account's username and password.

Answer 2

SMS OTPs are not recommended. Not only is spoofing an Issue but also the fact that your users will need to have cellphone reception every time they want to log in.

https://www.logintc.com/blog/2015-05-15-avoid-SMS-when-choosing-2-factor-authentication.html

Answer 3

Is SMS spoofing very easy?

I talked a bit about SMS spoofing in this answer.

The gist of it is that the phone companies relies on a system called Signaling System 7 (SS7). It is built on trust between the operators, and this makes it easy for one operator to send false information to another. Using this, it is quite easy to spoof the senders number.

Is this method vulnerable to SMS spoofing easily?

I don't know if your method is voulnerable. That would depend on if you use the senders number as part of verification. It might also be possible to construct an attack scenario in which an attacker sends the authentication code before the real user, or a scenario where the user might not want to send the confirmation, but an attacker can do it in their place and use this for an attack.

Answer 4

SMS Spoofing

Yes, sms spoofing is possible. Even if not really easy (you have to use specific hardware and know how it work).

One time login

Depending on how this is implemented on server, ideally one time login password mean a password useable only one time, then deleted immediately after use.

Then

If someone obtains your one time pass and uses it, you yourself will not be able to connect. From there, you would have to report the problem to the site owner.

If you could connect with your password, nobody else could after you.

Disclaimer

For this to correctly work, the site using this kind of method have to correctly check and delete password after 1st use.

New formular?

My purpose:

1. Custom (Alice) come to an inscription formulare on Bob's Server site, to create

   • Username
   • All required identity fields
   • A specific field One time password 1
   • ... please re-enter One time password 1

2. Bob's Server create random One time password 2 for send by SMS to Alice's phone

3. Alice connect again to One time password verification, will have to correctly fill 3 fields:

   • Username
   • One time password 1 (from Alice)
   • One time password 2 (from SMS)

4. If some third person (Charles) could obtain SMS, they have to know what Alice typed in first formulare (under HTTPS, of course!)

5. Of course One time passwords have to be deleted immediately after first use anyway.