Issues of identity verification of typical applications over mobile terminal platform

Xiaolin ZHANG; Dawu GU; Chi ZHANG

doi:10.11959/j.issn.2096-109x.2020081

您当前的位置：

首页 >

文章列表页 >

Issues of identity verification of typical applications over mobile terminal platform

Papers | 更新时间：2024-06-03

- Issues of identity verification of typical applications over mobile terminal platform
- Chinese Journal of Network and Information Security Vol. 6, Issue 6, Pages: 137-151(2020)
- 作者机构：
  
  1. 上海交通大学电子信息与电气工程学院，上海 200240
  2. 西安电子科技大学网络与信息安全学院，陕西西安 710126
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2020081
  CLC： TP311.1
- Online First：2020-12，
  
  Published：15 December 2020
- 稿件说明：
移动端阅览
Xiaolin ZHANG, Dawu GU, Chi ZHANG. Issues of identity verification of typical applications over mobile terminal platform[J]. Chinese Journal of Network and Information Security, 2020, 6(6): 137-151.
DOI：

Xiaolin ZHANG, Dawu GU, Chi ZHANG. Issues of identity verification of typical applications over mobile terminal platform[J]. Chinese Journal of Network and Information Security, 2020, 6(6): 137-151. DOI： 10.11959/j.issn.2096-109x.2020081.

摘要

近年来的研究表明，针对USIM卡的攻击手段日益增多，在5G环境下攻击者也能使用复制的USIM卡绕过某些正常应用的身份认证，进而获取用户信息。在USIM可被复制的条件下，研究了移动平台上典型应用的身份认证流程，通过分析用户登录、重置密码、执行敏感操作的应用行为给出身份认证树。在此基础上，测试了社交通信、个人健康等7类58款典型应用，发现有29款认证时仅需USIM卡接收的SMS验证码便可通过认证。针对该问题，建议应用开启两步验证，并结合USIM防伪等手段完成认证。

Abstract

Recent studies have shown that attacks against USIM card are increasing

and an attacker can use the cloned USIM card to bypass the identity verification process in some applications and thereby get the unauthorized access.Considering the USIM card being cloned easily even under 5G network

the identity verification process of the popular mobile applications over mobile platform was analyzed.The application behaviors were profiled while users were logging in

resetting password

and performing sensitive operations

thereby the tree model of application authentication was summarized.On this basis

58 popular applications in 7 categories were tested including social communication

healthcare

etc.It found that 29 of them only need SMS verification codes to get authenticated and obtain permissions.To address this issue

two-step authentication was suggested and USIM anti-counterfeiting was applied to assist the authentication process.

关键词

Keywords

references

3GPP specification:31.102.Characteristics of the Universal Subscriber Identity Module (USIM) application [S ] .

国家统计局 . 电信业务统计数据 [EB ] .

DOGTIEV A . App download and usage statistics (2018),business of App(2018) [EB ] .

BLAIR I . Mobile App download and usage statistics,BuildFire [EB ] .

LIU J R , YU Y , STANDAERT F , et al . Small tweaks do not help:differential power analysis of milenage implementations in 3G/4G USIM cards [C ] // The 20th European Symposium on Computer Security . 2015 : 468 - 480 .

BRIER E , CLAVIER C , OLIVIER F . Correlation power analysis with a leakage model [C ] // Cryptographic Hardware and Embedded Systems . 2014 : 16 - 29 .

3GPP specication:35.206.Specification of the MILENAGE algorithm set [S ] .

ANWAR N , RIADI I , LUTHFI A . Analisis SIM card cloning terhadap algoritma random number Generator [J ] . Buana Inform , 2016 , 7 ( 2 ): 143 - 150 .

SINGH J , RUHL R , LINDSKOG D , et al . GSM OTA SIM cloning attack and cloning resistance in EAP-SIM and USIM [C ] // Proc Soc , 2013 : 1005 - 1010 .

RAO J R , ROHATGI P , SCHERZER H , et al . Partitioning attacks:or how to rapidly clone some GSM cards [C ] // Proc IEEE Symp Secur Priv , 2002 : 31 - 41 .

ZHANG C , LIU J R , GU D W , et al . Side-channel analysis for the authentication protocols of CDMA cellular networks [J ] . J Comput Sci Technol , 2019 : 1079 - 1095 .

3GPP specication:33.501.Security architecture and procedures for 5G System [S ] .

BASIN D , RADOMIROVIC S , DREIER J , et al . A formal analysis of 5G authentication [C ] // Proceedings of the ACM Conference on Computer and Communications Security . 2018 : 1383 - 1396 .

LoCCS GoCE . 抱紧你的SIM卡—5G物理安全初探 [EB ] .

LoCCS GoCE . hold your SIM card tight—a glance at 5G physical security [EB ] .

KOOT L . Security of mobile TAN on smartphones a risk analysis for the iOS and Android smartphone platforms [D ] . The Netherlands:Radboud University Nijmegen , 2012 .

DMITRIENKO A , LIEBCHEN C , ROSSOW C , et al . Security analysis of mobile two-factor authentication schemes [J ] . Intel Technol J , 2014 : 138 - 161 .

ALECU B . SMS Fuzzing-SIM Toolkit attack [R ] . 2013 .

KIM H K , YEO H , HWANG H J , et al . Effective mobile applications testing strategies [R ] . 2016 .

Google . Esspresso testing android-framework,Github [EB ] .

Apple . Apple ui-automation documentation,Apple [EB ] .

GOMEZ L , NEAMTIU I , AZIM T , et al . Reran:timing-and touch-sensitive record and replay for android [C ] // 35th International Conference on Software Engineering (ICSE) . 2013 : 72 - 81 .

HU Y , AZIM T , NEAMTIU I . Versatile yet lightweight record-and-replay for android [C ] // Proceedings of the 2015 ACM SIGPLAN International Conference on Object-Oriented Programming,Systems,Languages,and Applications . 2015 : 349 - 366 .

MACHIRY A , TAHILIANI R , NAIK M . Dynodroid:an input generation system for android Apps [C ] // Proceedings of the 2013 9th Joint Meeting on Foundations of Software Engineering . 2013 : 224 - 234 .

Appsee . App mobile analytics platform [EB ] .

OpenSTF . Smartphone test farm,Github [EB ] .

WANG R , CHEN S , WANG X F . Signing me onto your accounts through facebook and google:a traffic-guided security study of commercially deployed single-sign-on web services [C ] // 2012 IEEE Symposium on Security and Privacy . 2012 : 365 - 379 .

GAN C , WANG W . Uses and gratifications of social media:a comparison of microblog and WeChat [J ] . Journal of Systems and Information Technology , 2015 ( 4 ): 351 - 363 .

DMITRIENKO A , LIEBCHEN C , ROSSOW C , et al . On the (in) security of mobile two-factor authentication [C ] // International Conference on Financial Cryptography and Data Security . 2014 : 365 - 383 .

AppAnnie . The App analytics and App industry standard [EB ] .

Statista . Global business data platform [EB ] .

iresearch . App指数分析 [EB ] .

Iresearch . App index Analysis [EB ] .

QuestMobile . 2019移动App半年增长报告 [EB ] .

QuestMobile . Mobile App semi-annual growth report of 2019 [EB ] .

Views

901

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Automotive ethernet controller authentication method based on national cryptographic algorithms

Lightweight authentication protocol for security vehicle network of railway freight train

Related Author

Hui GUO

Yong LUO

Xiaolu GUO

Congdong LYU

Yucai LI

Related Institution

School of Vehicle and Mobility, Tsinghua University

IM Motors Technology Co., Ltd

United Automotive Electronic Systems Co., Ltd.

School of Information Engineering,Nanjing Audit University

Information Technology Centre of Ministry of Railways

⁰