arXiv subjects

Enrique Sobrados

Publications and source records attributed to Enrique Sobrados.

2 recordsLinked to original sources

arXiv2026

The Tragedy of Convenience: Cascading User-Data Leakage from SMS-Delivered URLs

Digital Services are increasingly sending private URLs over Short Message Service (SMS) to allow users to resume sessions with a single click. While convenient, this design shifts trust from explicit authentication to a potentially vulnerable communication channel. Basically, the vulnerability lies in the assumption that the private link can only be accessed by the intended user. In this paper, we demonstrate that this assumption can be easily violated. In particular, we show how seemingly isolated link exposure can cascade into a wider data leak. Using public SMS gateways as an ethical lens, we analyze more than 322K unique private URLs extracted from over 33 million messages across 30K+ phone numbers. Across 701 URLs, we find that at least 177 web services effectively treat private URLs as bearer credentials, enabling unauthorized access to sensitive user information (e.g., financial details, national IDs) once the link is exposed. Alarmingly, we show that 125 services are potentially enumerable, i.e., a single URL can lead to a cascading effect, resulting in the data leakage of their entire user base. Moreover, we observe that 5 services that implement authentication partially reveal account information before authentication is completed and rely on lightweight parameters (e.g., date of birth, ZIP code). Even worse, in 4 out of these 5 services, the authentication is vulnerable to brute-force attacks. Further, we uncover that 20 services grant privileged access: 14 allow modification of Personally Identifiable Information (PII), 5 grant account access, and 1 allows both. We also find 84 services that expose additional PII beyond the landing page. Our disclosures led to acknowledgments from 18 services, 7 of which have already been fixed, positively impacting at least 120 million users.

cs.CR↗

arXiv2025

SpyChain: Multi-Vector Supply Chain Attacks on Small Satellite Systems

Small satellites are integral to scientific, commercial, and defense missions, but reliance on commercial off-the-shelf (COTS) hardware broadens their attack surface. Although supply chain threats are well studied in other cyber-physical domains, their feasibility and stealth in space systems remain largely unexplored. Prior work has focused on flight software, which benefits from strict security practices and oversight. In contrast, auxiliary COTS components often lack robust assurance yet enjoy comparable access to critical on-board resources, including telemetry, system calls, and the software bus. Despite this privileged access, the insider threat within COTS hardware supply chains has received little attention. In this work, we present SpyChain, the first end-to-end design and implementation of independent and colluding hardware supply chain threats targeting small satellites. Using NASA's satellite simulation (NOS3), we demonstrate that SpyChain can evade testing, exfiltrate telemetry, disrupt operations, and launch Denial of Service (DoS) attacks through covert channels that bypass ground monitoring. Our study traces an escalation from a simple solo component to dynamic, coordinating malware, introducing a taxonomy of stealth across five scenarios. We showcase how implicit trust in auxiliary components enables covert persistence and reveal novel attack vectors, highlighting a new multi-component execution technique that is now incorporated into the SPARTA matrix. Our findings are reinforced by acknowledgment and affirmation from NASA's NOS3 team. Finally, we implement lightweight onboard defenses, including runtime monitoring, to mitigate threats like SpyChain.

cs.CR↗