SMS-Delivered URLs: Security Risks of Frictionless User Experience

The Problem with Frictionless SMS URLs

• 💡 SMS-delivered URLs are often designed for a frictionless user experience, leading to relaxed authentication and security checks.
• ⚠️ This implicit trust that only intended users will access the link is dangerous, as SMS is an insecure and unencrypted channel.
• 📌 Many services prioritize user experience over security, making it easy for users to click links without additional verification like OTP codes.

Widespread Security Failures Found

• 🔍 Researchers analyzed over 322,000 unique URLs from 33 million messages, uncovering widespread security failures.
• 🎯 Exposed PII was found across 701 endpoints at 177 services due to weak, token-based authentication.
• 📈 The study identified low-entropy tokens enabling mass URL enumeration and data overfetching issues.
• 🧩 In some cases, changing a single character in a URL could grant access to another user's sensitive information, like insurance applications.

Overfetching and Exposed Data

• 📊 The research highlighted overfetching, where backends send more data than is visible in the UI.
• ⚠️ This includes sensitive PII like names, email addresses, phone numbers, and even bank account details, credit scores, and social security numbers.
• 💻 Even if not visible on the UI, this data can be found in network logs, which are often not audited.

Challenges in Responsible Disclosure

• 📞 Companies were difficult to reach, with many lacking proper security or vulnerability disclosure pages.
• 📧 Even when contacted, responses were slow or non-existent, with some companies dismissing security emails as spam.
• ✅ Out of over 100 reported issues, only 17 companies responded, though 18 services eventually fixed flaws, improving privacy for millions.

Recommendations for Developers and Users

• 🛠️ Developers have access to good practices but often fail to implement them, prioritizing user experience over security.
• ⚠️ Users should be cautious about entering sensitive information on less established or seemingly insecure websites.
• 💡 The core issue is a lack of awareness and implementation of existing security best practices by service providers.