  A fundamental premise of SMS One-Time Password (OTP) is that the used
pseudo-random numbers (PRNs) are uniquely unpredictable for each login session.
Hence, the process of generating PRNs is the most critical step in the OTP
authentication. An improper implementation of the pseudo-random number
generator (PRNG) will result in predictable or even static OTP values, making
them vulnerable to potential attacks. In this paper, we present a vulnerability
study against PRNGs implemented for Android apps. A key challenge is that PRNGs
are typically implemented on the server-side, and thus the source code is not
accessible. To resolve this issue, we build an analysis tool, \sysname, to
assess implementations of the PRNGs in an automated manner without the source
code requirement. Through reverse engineering, \sysname identifies the apps
using SMS OTP and triggers each app's login functionality to retrieve OTP
values. It further assesses the randomness of the OTP values to identify
vulnerable PRNGs. By analyzing 6,431 commercially used Android apps downloaded
from \tool{Google Play} and \tool{Tencent Myapp}, \sysname identified 399
vulnerable apps that generate predictable OTP values. Even worse, 194
vulnerable apps use the OTP authentication alone without any additional
security mechanisms, leading to insecure authentication against guessing
attacks and replay attacks.
