Let's say I have a website which uses 4 digit OTP based authentication for login i.e. users will enter their mobile number, receive OTP on the entered mobile number, enter the received OTP to login successfully.
I have an approach on how to crack such a login based mechanism if I have access to a subset of all registered mobile numbers, and I want to know whether it will work and if yes how to protect against the same.
Let's say I have a list of 100,000 mobile numbers registered/using such a website.
Now, I will do the following process multiple times.
- Pick a previously unused phone number from the list of registered phone numbers.
- Hit the service to send an OTP to the registered phone number ( which I do not have access to ).
- The website in background will generate a random OTP and send it to the registered mobile number.
- I will generate a random 4 digit OTP and try to login using the same.
Now, the probability of the above process succeeding is: 10000 / (10000 * 10000) => 1 / 10000, because in every process a pair of 10,000 faced dice are rolled, and above is the probability that both of them will have same number on the top.
So, if I repeat the above process at least 10000 (expected value to get a match) times, I should be able to login using at least one phone number with high probability.
How do I mitigate such an attack ?