How can I use a user's own SMS service to send OTP and make mobile number verification in my Android app?

Question

Goal: I am building a app, i want to verify user's mobile number, the way i am using is when user enters the mobile number, I send OTP to that number and ask user to enter the otp to verify the mobile number is in access to user.

The way i am doing this is using users own Sim card to send SMS and doing all procces within the app.

It is as follows: first I generated a small random 6 digit code (OTP)

int otp = new Random().nextInt(900000) + 100000;

then, I send this OTP to the user-entered mobile number that I have to verify. I use the user's own SMS service to do this

SmsManager smsManager = SmsManager.getDefault();
smsManager.sendTextMessage(user_mobile.getText().toString(),null,"Otp for verification is: "+otp,null,null);

then, I create an Intent, start new activity and pass OTP to new activity

Intent itn = new Intent(MainActivity.this,OtpPage.class);        
itn.putExtra("Otp",s_otp);        
startActivity(itn);

and then, the user enters the OTP I sent, and I verify it with the OTP I received from the previous activity using Intent. If both are the same, I verify the mobile number.

Now my question is, Is this a valid way to do this or it contains some security flaws, if yes what security problems may arise here?

Answer 1

Is this a valid way to do this or it contains some security flaws, if yes what security problems may arise here?

You generate the secret on the users device, and then send it to the user. It's probably trivial to rewrite your application to simply tell the server a random phone number, and Yup, this number really verified just fine!

This doesn't offer security, and is just a waste of time. To make this secure, the client should transmit the phone number to the server, and the server should generate a secret and send this via SMS to the provided phone number.

This is not fool proof, as there's avenues for intercepting or hijacking text messages, but it will be magnitudes better than your current scheme.

In addition, as pointed out by bk2204 in a comment, Random() is not secure. It's not meant to be used for secrets, and past codes may reveal future codes, and the seed is commonly the time of the machine - which can be brute forced easily.

Answer 2

In addition to the issues pointed out in the other answer, ever since API level 19 (Android 4.4), using the sendTextMessage function when your app is not the default SMS app will automatically add the sent message to the SMS provider (the central data store of SMS sent and received on the phone, managed by the OS and not part of any individual app). So, all that an attacker would have to do is supply somebody else's number, and then open their SMS app, look for their message history with that person, and enter the code in the last message they sent as though they'd just received it.

Of course, this is only one of the many, many problems with trusting the client like this. The attacker could also steal the code right out of the app as it's generated, spoof the Random (or SecureRandom, once you stop using a predictable PRNG) class so it always generates a known code, steal the code on its way to the server, block the app's message to the server and send their own (with a known code) in its place, spoof the message to the server announcing that the code verified successfully...

And all of that is without even considering that SMS is not very secure to begin with!