Guess Who's Texting You? Evaluating the Security of Smartphone Messaging Applications.

TLDR

A new generation of mobile messaging and VoIP applications offers free internet‑based calls and texts, attracting millions of users, yet their security measures have received little scrutiny. This study analyzes nine popular mobile messaging and VoIP applications to evaluate their security models, with a particular focus on authentication mechanisms. The authors examined the authentication mechanisms of these apps, noting that most use the user’s phone number as a unique token, which hampers the implementation of robust security barriers. Experimental results reveal that most tested applications contain major security flaws that enable account hijacking, sender‑ID spoofing, and subscriber enumeration.

Abstract

In recent months a new generation of mobile messaging and VoIP applications for smartphones was introduced. These services offer free calls and text messages to other subscribers, providing an Internet-based alternative to the traditional communication methods managed by cellular network carriers such as SMS, MMS and voice calls. While user numbers are estimated in the millions, very little attention has so far been paid to the security measures (or lack thereof) implemented by these providers. In this paper we analyze nine popular mobile messaging and VoIP applications and evaluate their security models with a focus on authentication mechanisms. We find that a majority of the examined applications use the user’s phone number as a unique token to identify accounts, which further encumbers the implementation of security barriers. Finally, experimental results show that major security flaws exist in most of the tested applications, allowing attackers to hijack accounts, spoof sender-IDs or enumerate subscribers.