NDLI: Exploiting Phone Numbers and Cross-Application Features in Targeted Mobile Attacks

Please wait, while we are loading the content...

Hardware Isolation for Trusted Execution

Secure Containers in Android: The Samsung KNOX Case Study

SecuRank: Starving Permission-Hungry Apps Using Contextual Permission Analysis

Hardened Setup of Personalized Security Indicators to Counter Phishing Attacks in Mobile Banking

White Rabbit in Mobile: Effect of Unsecured Clock Source in Smartphones

Securing Recognizers for Rich Video Applications

Picasso: Lightweight Device Class Fingerprinting for Web Clients

What You See Isn't Always What You Get: A Measurement Study of Usage Fraud on Android Apps

On a (Per)Mission: Building Privacy Into the App Marketplace

Detecting Misuse of Google Cloud Messaging in Android Badware

CRiOS: Toward Large-Scale iOS Application Analysis

Exploiting Phone Numbers and Cross-Application Features in Targeted Mobile Attacks

On the CCA (in)Security of MTProto

Analyzing TETRA Location Privacy and Network Availability

Exploiting Phone Numbers and Cross-Application Features in Targeted Mobile Attacks

Content Provider	ACM Digital Library
Author	Ahamad, Mustaque Gupta, Payas Kumaraguru, Ponnurangam Gupta, Srishti
Abstract	Smartphones have fueled a shift in the way we communicate with each other via Instant Messaging. With the convergence of Internet and telephony, new Over-The-Top (OTT) messaging applications (e.g., WhatsApp, Viber, WeChat etc.) have emerged as an important means of communication for millions of users. These applications use phone numbers as the only means of authentication and are becoming an attractive medium for attackers to deliver spam and carry out more targeted attacks. The universal reach of telephony along with its past trusted nature makes phone numbers attractive identifiers for reaching potential attack targets. In this paper, we explore the feasibility, automation, and scalability of a variety of targeted attacks that can be carried out by abusing phone numbers. These attacks can be carried out on different channels viz. OTT messaging applications, voice, e-mail, or SMS. We demonstrate a novel system that takes a phone number as an input, leverages information from applications like Truecaller and Facebook about the victim and his / her social network, checks the presence of phone number's owner (victim) on the attack channel (OTT messaging applications, voice, e-mail, or SMS), and finally targets the victim on the chosen attack channel. As a proof of concept, we enumerated through a random pool of 1.16 million phone numbers and demonstrated that targeted attacks could be crafted against the owners of 255,873 phone numbers by exploiting cross-application features. Due to the significantly increased user engagement via new mediums of communication like OTT messaging applications and ease with which phone numbers allow collection of pertinent information, there is a clear need for better protection of applications that rely on phone numbers.
Starting Page	73
Ending Page	82
Page Count	10
File Format	PDF
ISBN	9781450345644
DOI	10.1145/2994459.2994471
Language	English
Publisher	Association for Computing Machinery (ACM)
Publisher Date	2016-10-24
Publisher Place	New York
Access Restriction	Subscribed
Subject Keyword	Vishing Over-the-top messaging applications Truecaller Phishing Vanity numbers Phone numbers Cross-application features Targeted attacks Caller id applications Security Facebook
Content Type	Text
Resource Type	Article

Central Library (ISO-9001:2015 Certified)
Indian Institute of Technology Kharagpur
Kharagpur, West Bengal, India | PIN - 721302

See location in the Map
03222 282435
Mail: support@ndl.gov.in

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in