English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

A fundamental premise of SMS One-Time Password (OTP) is that the usedpseudo-random numbers (PRNs) are uniquely unpredictable for each login session.Hence, the process of generating PRNs is the most critical step in the OTPauthentication. An improper implementation of the pseudo-random numbergenerator (PRNG) will result in predictable or even static OTP values, makingthem vulnerable to potential attacks. In this paper, we present a vulnerabilitystudy against PRNGs implemented for Android apps. A key challenge is that PRNGsare typically implemented on the server-side, and thus the source code is notaccessible. To resolve this issue, we build an analysis tool, \sysname, toassess implementations of the PRNGs in an automated manner without the sourcecode requirement. Through reverse engineering, \sysname identifies the appsusing SMS OTP and triggers each app's login functionality to retrieve OTPvalues. It further assesses the randomness of the OTP values to identifyvulnerable PRNGs. By analyzing 6,431 commercially used Android apps downloadedfrom \tool{Google Play} and \tool{Tencent Myapp}, \sysname identified 399vulnerable apps that generate predictable OTP values. Even worse, 194vulnerable apps use the OTP authentication alone without any additionalsecurity mechanisms, leading to insecure authentication against guessingattacks and replay attacks.

Fine with "1234"? An Analysis of SMS One-Time Password Randomness in Android Apps