Characterizing the Security Threats of Disposable Phone Numbers

Abstract

Many organizations require users to provide a phone number for verification when registering an account. Simultaneously, because of the convenience and security of SMS-based two-factor authentication, many organizations adopt this method to enable users to log in their accounts. On the other hand, many web service platforms provide a mass of disposable phone numbers for receiving SMS messages. The original intention of these platforms is to provide user privacy protection services; however, people know very little about the threat that this service poses to the organization’s security. In this paper, we collected data from 9 disposable phone platforms with high traffic in China. These data include 4,669 phone numbers and 30 million messages. These phone numbers come from 44 countries, and most of the phone number carriers are mobile virtual network operators in China. To the best of our knowledge, this is the first paper that discloses the OTA (Online Travel Agency) accounts registered by disposable phone numbers, which would leak a large number of passenger information. Furthermore, we discovered that cybercriminals use temporary OTA accounts to carry out airline seat spinning attacks. Among the organizations we surveyed, only 47% of the organizations’ security mechanisms can detect accounts that registered with disposable numbers. Our findings indicate that disposable phone numbers pose potential threats to cybersecurity, and new solutions are needed to address the threat.

This work is supported by National Major Science and Technology Projects of China (Grant No. 2018YFB1800202, 2017YFB0803001, 2018YFB0804703) and National Natural Science Foundation of China (Grant No. 61571144, U1836117).