Exploiting Android's MMI Functionality to Bypass OTP Security Mechanisms
Year: 2025
Type: article
Abstract: This paper presents a detailed attack methodology demonstrating how an adversary can bypass SMS/voice OTP-based two-factor authentication by abusing Android’s built-in Man-Machine Interface (MMI) codes. The attack chain involves (1) open-source intelligence gathering to profile the target, (2) social engineering to persuade the user to dial a special code, (3) abusing an MMI code to enable call forwarding to the attacker’s phone, (4) triggering an OTP delivery that is forwarded to the attacker, and (5) using the intercepted OTP to hijack the victim’s account. Prior reports have shown that call-forwarding codes can silently redirect a victim’s calls – including authentication calls – to criminals. We document each step of this chain in a rigorous manner, referencing real-world examples and technical details where available.
Author: Issa, Nour
Language: English
Subfield: Information Systems
Field: Computer Science
Domain: Physical Sciences
Open Access status: green
OpenAlex ID: W7081966330
FWCI:
Cites:
Cited by:
Related to: