Resetting Your Password Is Vulnerable: A Security Study of Common SMS-Based Authentication in IoT Device

<table class="algorithm-group"><tr><td><table class="algorithm" id="figbox2"><tr><td colspan="2"><svg height="11.5564pt" id="M8" style="vertical-align:-2.26807pt" version="1.1" viewbox="-0.0498162 -9.28833 6.80666 11.5564" width="6.80666pt" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><g transform="matrix(.013,0,0,-0.013,0,0)"><path d="M293 -169V-141C218 -131 209 -90 209 -44C209 19 222 85 222 152C222 207 198 255 139 269V273C199 286 222 334 222 388C222 454 209 523 209 588C209 632 218 671 293 681V709C234 709 148 695 148 577C147 513 155 438 155 372C155 337 152 291 64 285V256C152 250 155 204 155 169C156 105 148 31 148 -41C148 -157 234 -169 293 -169Z" id="g113-124"></path></g></svg><span class="monospace">"code":200,"msg":"","result":</span><svg height="11.5564pt" id="M9" style="vertical-align:-2.26807pt" version="1.1" viewbox="-0.0498162 -9.28833 6.80666 11.5564" width="6.80666pt" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><g transform="matrix(.013,0,0,-0.013,0,0)"><path d="M293 -169V-141C218 -131 209 -90 209 -44C209 19 222 85 222 152C222 207 198 255 139 269V273C199 286 222 334 222 388C222 454 209 523 209 588C209 632 218 671 293 681V709C234 709 148 695 148 577C147 513 155 438 155 372C155 337 152 291 64 285V256C152 250 155 204 155 169C156 105 148 31 148 -41C148 -157 234 -169 293 -169Z" id="g113-124"></path></g></svg><span class="monospace">"session_id":"f7b532</span></td></tr><tr><td colspan="2"><span class="monospace">83-3c20-400d-b0ee-76a171036414","code_-1":-</span></td></tr><tr><td colspan="2"><span class="monospace">1,"error_code":"0"</span><svg height="11.5564pt" id="M10" style="vertical-align:-2.26807pt" version="1.1" viewbox="-0.0498162 -9.28833 13.5137 11.5564" width="13.5137pt" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><g transform="matrix(.013,0,0,-0.013,2.179,0)"><path d="M283 255V284C195 290 192 337 192 375C192 436 200 508 200 580C200 696 116 709 54 709V681C127 671 139 634 139 588C138 524 125 452 125 387C125 333 149 286 209 272V268C148 253 125 206 125 151C126 87 139 16 139 -47C139 -92 127 -131 54 -141V-169C115 -169 200 -152 200 -41C200 32 192 104 192 164C192 202 195 249 283 255Z" id="g113-126"></path></g><g transform="matrix(.013,0,0,-0.013,8.869,0)"><path d="M283 255V284C195 290 192 337 192 375C192 436 200 508 200 580C200 696 116 709 54 709V681C127 671 139 634 139 588C138 524 125 452 125 387C125 333 149 286 209 272V268C148 253 125 206 125 151C126 87 139 16 139 -47C139 -92 127 -131 54 -141V-169C115 -169 200 -152 200 -41C200 32 192 104 192 164C192 202 195 249 283 255Z" id="g113-126"></path></g></svg></td></tr></table></td></tr></table>

<div>Messages of the password reset for a home app. <span class="monospace">Cloud Response for the SMS authentication code</span>.</div>

Wireless Communications and Mobile Computing

figbox2

Box 2

Box 2: Resetting Your Password Is Vulnerable: A Security Study of Common SMS-Based Authentication in IoT Device 