2

We have multiple customer sites which provides login via mobile number OTP option (new & registered users). Recently, we come across an incident where a user received 100+ OTPs with in few minutes to login to 10+ different websites multiple times. Attempts made on few unfamiliar websites as well.

  1. Which type of attack this is ? and how it is possible ?
  2. How to understand whether those OTP were used for login & collect information ? or just to create cyber fear ? (Not all customer sites are providing new device login notification like social networking sites)
  3. How we can prevent this? (No restrictions on the sites and mobile number can't be kept as secret)
Improve this question
4
  • what do you mean by "Attempts made on few unfamiliar websites as well." ? – Infra Mar 15 at 7:42
  • Could be a bot trying username and password combinations, and successfully guessed the user's password. To stop this, you could implement a captcha check before logging in or limit the number of failed login attempts per IP address. Does the user use the same password across multiple customer sites? – Marc Woodyard Mar 15 at 8:26
  • Hi @Infra "Attempts made on few unfamiliar websites as well" - User never had an account in few of the sites and never visited before, but OTP received for login using mobile number. So we assumed that is may be to create a cyber fear, panic attack. – Vijayabharathi Mar 15 at 8:55
  • Hi @MarcWoodyard, this is a use-case where user can login to the customer site with Mobile number as user name and Synchronous OTP as password. Example : flipkart.com site login – Vijayabharathi Mar 15 at 9:01
0

1.Which type of attack this is ? and how it is possible ?

Attack could be a dictionary attack or Brute-force guessing attack. There are many scripts available publicly to perform those kind of attacks. Even an expert can develop their own script as well. In addition to that botnet attack also possible.

2.How to understand whether those OTP were used for login & collect information ?

It is only possible if you have setup proper logs and monitoring solution. OTP in mainly two types. Synchronous and asynchronous. Synchronous OTPs are not working after specific time period and asynchronous OTPs are available until it use. But according to your scenario, synchronous should be used and If logs and monitoring are not enabled, unable to check whether those are used or not.

3.How we can prevent this?

You need to enable firewall/IPS and especially Input validation and clipping levels for failure login attempts. Monitoring is required at any situation, Otherwise you don't have visibility on what is going on with network.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.