Guess Who's Texting You? Evaluating the Security of Smartphone Messaging Applications.
Sebastian Schrittwieser, Peter Frühwirt, Peter Kieseberg, Manuel Leithner, Martin Mulazzani, Markus Huber, Edgar R. Weippl · 2012
In recent months a new generation of mobile messag-ing and VoIP applications for smartphones was introduced. These services offer free calls and text messages to other subscribers, providing an Internet-based alternative to the traditional communication methods managed by cellular network carriers such as SMS, MMS and voice calls. While user numbers are estimated in the millions, very little atten-tion has so far been paid to the security measures (or lack thereof) implemented by these providers. In this paper we analyze nine popular mobile messaging and VoIP applications and evaluate their security models with a focus on authentication mechanisms. We find that a majority of the examined applications use the user’s phone number as a unique token to identify accounts, which fur-ther encumbers the implementation of security barriers. Fi-nally, experimental results show that major security flaws exist in most of the tested applications, allowing attack-ers to hijack accounts, spoof sender-IDs or enumerate sub-scribers. 1