隐私链接，公开泄露：无摩擦用户体验对短信传递URL的安全性和隐私态势的影响
The Tragedy of Convenience: Cascading User-Data Leakage from SMS-Delivered URLs
AI总结：
本文研究了通过短信传递URL的安全和隐私问题，发现大量敏感信息泄露，并揭示了弱认证模型和数据过度获取等关键漏洞。
摘要：
数字服务提供商常常通过采用简化访问其服务的技术来优先考虑无摩擦的用户体验。一种广泛使用的机制是通过短信服务（SMS）传递链接（URLs），以实现单击访问在线服务，几乎没有任何阻力。然而，短信本质上是不安全的，已有大量报告记录了消息拦截和数据泄露事件。因此，对这种不安全通道过度信任会为对手提供意外访问和利用的途径。在本文中，我们从公共短信网关的角度对短信传递URL的影响进行了全面调查。我们研究了超过322,000个唯一的短信传递URL，这些URL来自超过3300万条消息，涉及超过30,000个电话号码，揭示了关键的安全和隐私漏洞。我们识别并验证了影响177个服务的701个终端中暴露的个人可识别信息（PII）。我们对暴露的根本原因进行手动调查，发现其弱认证模型依赖于令牌化承载链接作为足够的授权证明，因此任何人都可以通过URL访问私有用户信息，包括社会保障号码、出生日期、银行账户号码和信用评分。此外，我们识别了125个服务允许大规模枚举有效URL，因为令牌中的熵值较低，从而将隐私风险扩展到最初被入侵的用户之外。此外，我们识别了GUI与客户端获取的数据之间的不匹配，扩大了隐私泄露的规模。特别是，我们识别了76个服务进行数据过度获取。最后，18个服务已承认并解决了其服务中的弱点，从而提高了至少1.2亿用户的隐私。
英文摘要：
Digital Services are increasingly sending private URLs over Short Message Service (SMS) to allow users to resume sessions with a single click. While convenient, this design shifts trust from explicit authentication to a potentially vulnerable communication channel. Basically, the vulnerability lies in the assumption that the private link can only be accessed by the intended user. In this paper, we demonstrate that this assumption can be easily violated. In particular, we show how seemingly isolated link exposure can cascade into a wider data leak. Using public SMS gateways as an ethical lens, we analyze more than 322K unique private URLs extracted from over 33 million messages across 30K+ phone numbers. Across 701 URLs, we find that at least 177 web services effectively treat private URLs as bearer credentials, enabling unauthorized access to sensitive user information (e.g., financial details, national IDs) once the link is exposed. Alarmingly, we show that 125 services are potentially enumerable, i.e., a single URL can lead to a cascading effect, resulting in the data leakage of their entire user base. Moreover, we observe that 5 services that implement authentication partially reveal account information before authentication is completed and rely on lightweight parameters (e.g., date of birth, ZIP code). Even worse, in 4 out of these 5 services, the authentication is vulnerable to brute-force attacks. Further, we uncover that 20 services grant privileged access: 14 allow modification of Personally Identifiable Information (PII), 5 grant account access, and 1 allows both. We also find 84 services that expose additional PII beyond the landing page. Our disclosures led to acknowledgments from 18 services, 7 of which have already been fixed, positively impacting at least 120 million users.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
