OTP-Hunter: An App-based Fuzzing Framework to Discover One Time Password Vulnerabilities

One Time Password (OTP) plays a crucial role in verifying user identities for tasks like registration, login, and forgotten password on cloud platforms. However poorly implemented OTP can lead to vulnerabilities like Bomb attacks (a Denial of Service attack) on SMS or Email, OTP Brute-Force attacks, and OTP bypass, compromising access control. While fuzzing at the application layer (e.g., http) is effective for web products, it faces limitations in mobile applications due to cryptographic complexities and certificate verification. To address this, we propose a fuzzing framework, OTP-Hunter, combining static and dynamic analysis to uncover OTP vulnerabilities in applications with minimal manual intervention. We use OTP-Hunter to analyze 59 IoT-related apps (not limited), identify 68 vulnerabilities and reported them to the vendor and China National Vulnerability Database for 11 CNVDs. These vulnerabilities could let attackers remotely take control of devices by knowing the victim's cloud account, typically a phone number. Our results also show that compared with mutating the network requests, our approach can cover more circumstances like custom protocol because we do not need to know the encryption process.