Study Reveals Risks of Long-Lasting SMS Links Exposing Personal Data

The study conducted by researchers from The University of New Mexico revealed alarming vulnerabilities associated with one-time SMS links, which are often considered low-risk by online services. The researchers collected over 33 million messages tied to more than 30,000 phone numbers, identifying 701 URLs that exposed personal data from 177 different services. These links remained active for extended periods, with over half being between one and two years old, and 46% older than two years, raising concerns about long-term data exposure.

Among the exposed data were names, phone numbers, email addresses, and sensitive financial information. The study found that possession of the URL acted as the sole credential for access, allowing anyone with the link to view associated data. This bearer link model poses significant risks, especially as many services failed to implement adequate security measures to protect these links.

Some services even allowed users to modify personal data through exposed links, increasing the potential for account takeovers. In one instance, a loan application page enabled unauthorized edits to sensitive information, while other services directly linked users to authenticated sessions upon opening the URL.

The researchers also noted that backend systems often sent more personal data than what was displayed on the page, with 76 services revealing hidden information in network responses. Weak token designs further compounded the issue, with approximately 73% of token-based services having less than 64 bits of entropy, making them easier to guess.

Despite the risks, only a small number of services implemented secondary verification checks, and those that did provided limited protection. The study challenges the assumption that SMS delivery creates a secure boundary, highlighting the need for improved security practices in handling sensitive links.

Implications for Users and Organizations

This study serves as a wake-up call for everyday users and organizations alike. The reliance on SMS for sensitive transactions must be re-evaluated, as SMS does not provide a secure boundary. Users should be cautious about clicking on links received via SMS, especially if they involve sensitive information.

Organizations should prioritize implementing stronger security measures for SMS-based authentication, including better token designs and additional verification checks. Regular audits of exposed links and user data can help mitigate risks associated with long-lasting URLs.