Pre-hijacked accounts: An Empirical Study of Security Failures in User Account Creation on the Web

05/20/2022
by   Avinash Sudhodanan, et al.
0

The ubiquity of user accounts in websites and online services makes account hijacking a serious security concern. Although previous research has studied various techniques through which an attacker can gain access to a victim's account, relatively little attention has been directed towards the process of account creation. The current trend towards federated authentication (e.g., Single Sign-On) adds an additional layer of complexity because many services now support both the classic approach in which the user directly sets a password, and the federated approach in which the user authenticates via an identity provider. Inspired by previous work on preemptive account hijacking [Ghasemisharif et al., USENIX SEC 2018], we show that there exists a whole class of account pre-hijacking attacks. The distinctive feature of these attacks is that the attacker performs some action before the victim creates an account, which makes it trivial for the attacker to gain access after the victim has created/recovered the account. Assuming a realistic attacker who knows only the victim's email address, we identify and discuss five different types of account pre-hijacking attacks. To ascertain the prevalence of such vulnerabilities in the wild, we analyzed 75 popular services and found that at least 35 of these were vulnerable to one or more account pre-hijacking attacks. Whilst some of these may be noticed by attentive users, others were completely undetectable from the victim's perspective. Finally, we investigated the root cause of these vulnerabilities and present a set of security requirements to prevent such vulnerabilities arising in future.

READ FULL TEXT

page 7

page 8

research
05/14/2018

User Blocking Considered Harmful? An Attacker-controllable Side Channel to Identify Social Accounts

This paper presents a practical side-channel attack that identifies the ...
research
08/24/2018

"Should I Worry?" A Cross-Cultural Examination of Account Security Incident Response

Digital security technology is able to identify and prevent many threats...
research
05/18/2020

DALock: Distribution Aware Password Throttling

Large-scale online password guessing attacks are wide-spread and continu...
research
11/17/2019

Web-sites password management (in)security: Evidence and remedies

Single-factor password-based authentication is generally the norm to acc...
research
07/22/2023

An Empirical Study Evaluation of Modern CAPTCHAs

For nearly two decades, CAPTCHAs have been widely used as a means of pro...
research
03/08/2019

A Novel Approach for Protection of Accounts' Names against Hackers Combining Cluster Analysis and Chaotic Theory

The last years of the 20 th century and the beginning of the 21 th mark ...
research
04/05/2019

Efficient attack countermeasure selection accounting for recovery and action costs

The losses arising from a system being hit by cyber attacks can be stagg...

Please sign up or login with your details

Forgot password? Click here to reset