Two-factor authentication is widely believed to be the best way to secure one's online account. But, unfortunately, there is now a way with which hackers can bypass two-factor authentication.
Hackers are bypassing two-factor authentication on target accounts through the use of automated bots that call the victim and ask for the authentication code. These bots are being sold on the Internet, and any hacker can use them to trick gullible users into sharing their sensitive two-factor authentication in order to gain access to their accounts.
What are OTP Bots?
The bots that enable attackers to extract one-time passwords from consumers without human- intervention are commonly known as OTP bots. Attackers use these programmed bots to call up unsuspecting consumers and trick them into divulging their two-factor authentication codes. They then use these codes to authenticate and complete unauthorized transactions from compromised accounts.
The success of OTP bots in enabling attackers to access authentication codes and tokens has led to a proliferation in bot-based services. OTP bot services cost anywhere from $40-$100 per week of unlimited use to $4,000 unlimited-use subscription for lifetime. BloodOTPbot, Otp.agency, SMSRanger, and SMS Buster are some of the many OTP bot services available readily to the attackers. OTP bots are easily available in several underground communities. Telegram chat rooms are replete with chatter on sale and purchase of ‘OTP bot services’ and how they help attackers profit from exploiting consumers’ accounts on social media, financial, fintech, and crypto platforms.
Here's How OTP Bots Work
OTP bots use social engineering to trick a consumer into sharing sensitive information about digital accounts. Attackers use them for international calling with multiple call scripts in several types of voice accents.
Automation allows attackers to scale up the attacks to intercept and phish OTPs in large volumes. The larger the number of victims, the greater the returns. As a result, using OTP bots, attackers are able to maximize the returns from relatively lower investments. Digital businesses, however, are suffering substantial losses due to OTP bots.
In addition to intercepting OTPs, attackers can use bots to bypass OTP-based two factor authentication verification altogether. Since an OTP is a numeric or alphanumeric string of characters, it is possible to manipulate the OTP schema. Some of the tactics attackers use to bypass OTPs on websites and apps include response manipulation, brute forcing, SMS forwarding, and broken authentication.
How to stay secure
Users can stay secure by being aware of such attacks. Whenever you get a call from any customer care asking for personal information, drop the call. Also, you should not share the 2FA or OTP codes with anyone.
In case you are worried about a potential breach of your account, you should log in to your account and track your transactions. Change the email address to prevent such attacks but the hackers can still find it and target your account. So you will beware of these attacks at all times.
Designed as a simple 2FA solution to protect consumer and business interests, SMS-based OTPs and app-generated tokens are proving to be a weak link in security. Attackers are increasingly using specialized OTP bots to intercept codes. Digital businesses must take urgent steps for bot detection and to prevent OTP bots from causing damage to business and consumer interests.