Multiple login attempts made using mobile OTP in multiple customer sites at the same time

Question

We have multiple customer sites which provides login via mobile number OTP option (new & registered users). Recently, we come across an incident where a user received 100+ OTPs with in few minutes to login to 10+ different websites multiple times. Attempts made on few unfamiliar websites as well.

1. Which type of attack this is ? and how it is possible ?
2. How to understand whether those OTP were used for login & collect information ? or just to create cyber fear ? (Not all customer sites are providing new device login notification like social networking sites)
3. How we can prevent this? (No restrictions on the sites and mobile number can't be kept as secret)

Answer 1

1.Which type of attack this is ? and how it is possible ?

Attack could be a dictionary attack or Brute-force guessing attack. There are many scripts available publicly to perform those kind of attacks. Even an expert can develop their own script as well. In addition to that botnet attack also possible.

2.How to understand whether those OTP were used for login & collect information ?

It is only possible if you have setup proper logs and monitoring solution. OTP in mainly two types. Synchronous and asynchronous. Synchronous OTPs are not working after specific time period and asynchronous OTPs are available until it use. But according to your scenario, synchronous should be used and If logs and monitoring are not enabled, unable to check whether those are used or not.

3.How we can prevent this?

You need to enable firewall/IPS and especially Input validation and clipping levels for failure login attempts. Monitoring is required at any situation, Otherwise you don't have visibility on what is going on with network.