Short Message Service (SMS) is a popular channel for online service providers to verify accounts and authenticate users registered to a particular service. Specialized applications, called Public SMS Gateways (PSGs), offer free Disposable Phone Numbers (DPNs) that can be used to receive SMS messages. DPNs allow users to protect their privacy when creating online accounts. However, they can also be abused for fraudulent activities and to bypass security mechanisms like Two-Factor Authentication (2FA). In this paper, we perform a large-scale and longitudinal study of the DPN ecosystem by monitoring 17,141 unique DPNs in 29 PSGs over the course of 12 months. Using a dataset of over 70M messages, we provide an overview of the ecosystem and study the different services that offer DPNs and their relationships. Next, we build a framework that (i) identifies and classifies the purpose of an SMS; and (ii) accurately attributes every message to more than 200 popular Internet services that require SMS for creating registered accounts. Our results indicate that the DPN ecosystem is globally used to support fraudulent account creation and access, and that this issue is ubiquitous and affects all major Internet platforms and specialized online services.

翻译：短消息服务（SMS）是在线服务提供商验证账户及认证注册用户身份的一种常用渠道。被称为公共短信网关（PSG）的专用应用程序提供免费的一次性电话号码（DPN），可用于接收短信。DPN使用户在创建在线账户时能够保护隐私，但同时也可能被滥用于欺诈活动，并绕过双因素认证（2FA）等安全机制。本文通过对29个PSG中的17,141个唯一DPN进行为期12个月的监测，对DPN生态系统开展了大规模纵向研究。基于超过7000万条消息的数据集，我们概述了该生态系统的整体情况，并研究了提供DPN的不同服务及其相互关系。随后，我们构建了一个框架，能够：(i) 识别并分类短信的用途；(ii) 将每一条消息精确归属到超过200个需通过短信创建注册账户的流行互联网服务。研究结果表明，DPN生态系统在全球范围内被用于支持欺诈性账户创建与访问，这一问题普遍存在，并影响所有主要互联网平台及专业在线服务。