Account pre-hijacking
Account pre-hijacking attacks are a class of
security exploit related to online services. They involve anticipating a user signing up for an online service and signing up to the service in their name, and then taking over their account when they attempt to register it themselves.[1][2][3] The attack relies on confusion between accounts created by federated identity services and accounts created using e-mail addresses and passwords, and the failure of services to resolve this confusion correctly.[1]
Pre-hijacking was first identified as a class of vulnerabilities in 2022, based on research funded by
Out of 75 online services surveyed, 35 were found to be vulnerable to various forms of the exploit. Vulnerable services included Dropbox, Instagram, LinkedIn, WordPress and Zoom. The existence of the vulnerability was reported to all the service providers before publication of the paper.[5]
See also
References
- ^ a b Kovacs, Eduard (May 24, 2022). "Hackers Can 'Pre-Hijack' Online Accounts Before They Are Created by Users". Security Week. Retrieved 2022-05-31.
- ^ Brinkmann, Martin (2022-05-24). "Pre-hijacking Attacks of user accounts are on the rise". gHacks Technology News. Retrieved 2022-05-31.
- ^ Andrew Paverd (May 23, 2022). "New Research Paper: Pre-hijacking Attacks on Web User Accounts". Microsoft Security Response Center. Retrieved 2022-05-31.
- ^ Dickson, Ben (2022-05-30). "Dozens of high-traffic websites vulnerable to 'account pre-hijacking', study finds". The Daily Swig. Retrieved 2022-05-31.
- ^ arXiv:2205.10174 [cs.CR].