Private Links, Public Leaks: Consequences of Frictionless User Experience on the Security and Privacy Posture of SMS-Delivered URLs

TL;DR

This work reveals that frictionless SMS-delivered private URLs create meaningful privacy and security risks. By collecting and analyzing over 322K URLs from public SMS gateways and applying a hierarchical LLM- and expert-validated PII-detection pipeline, the study uncovers 701 vulnerable endpoints across 177 services, including widespread token-based access, overcollection of data, and potential for account takeovers. It also documents long-lived PII leaks (many >1 year) and 206 distinct user profiles that could fuel targeted spear-phishing attacks, with 18 remediations improving privacy for roughly 120M users. The findings underscore the need for tighter URL-design controls, stronger authentication, data minimization, and improved vulnerability disclosure practices to mitigate cascading privacy risks in SMS-based service access.

Abstract

Digital service providers often prioritize a frictionless user experience by adopting technologies that simplify access to their services. One widely used mechanism is the Short Message Service (SMS) to deliver links (URLs) that enable single-click access to online services with little to no resistance. However, SMS is inherently insecure, and numerous reports have documented message interception and data leaks. Thus, attributing excessive trust in such an insecure channel opens avenues for unintended access and exploitation by adversaries. In this paper, we present a comprehensive investigation of the implications of SMS-delivered URLs from the lens of public SMS gateways. We conduct the study on more than 322K unique SMS-delivered URLs extracted from more than 33 million messages across more than 30K phone numbers, revealing critical security and privacy vulnerabilities. We identify and validate critical Personally Identifiable Information (PII) exposure in 701 endpoints affecting 177 services. Our manual investigation of the root cause of the exposure reveals a weak authentication model which hinges upon tokenized bearer links as sufficient authorization proofs, thereby allowing anyone with the URL to access private user information, including social security number, date of birth, bank account number, and credit score. Additionally, we identify 125 services allowing mass enumeration of valid URLs due to low entropy within tokens, thereby cascading the privacy risks beyond the initially compromised users. Furthermore, we identify mismatches between the GUI and data fetched by the client, extending the scale of privacy leakages. Particularly, we identify 76 services that perform data overfetching. Finally, 18 services have acknowledged and addressed the weaknesses in their services, thereby enhancing the privacy of at least 120M users.

Figures (14)

• Figure 1: Our pipeline proceeds in four stages: (1) Data Collection: collect messages from public SMS gateways, extract URLs and crawl them using Playwright to capture Network Logs, HTML, and UI; (2) Preprocessing: run multilingual OCR on de-duplicated UI captures and extract JSON objects from Network Logs and HTML; (3) PII Detection & Validation: refine the PII lexicon and use LLM to detect PII followed by manual validation; (4) Analysis: deeper study of exposure time, user profiles, initial access, privileged exposure, account takeover, UI navigation, overfetching, and brute force.
• Figure 2: Top domains among 322,949 unique URLs extracted from SMS messages (10,903 domains total).
• Figure 3: Top domains after byte-identical UI de-duplication (87,080 unique URLs across 3,958 domains)
• Figure 4: Distribution of 701 PII-exposing URLs by exposure time
• Figure 5: wannacash.com