From SMS to SIM: Security Analysis of Phone Number Verification