Jump to content

Account pre-hijacking

Edit links
From Wikipedia, the free encyclopedia

This is an old revision of this page, as edited by Citation bot (talk | contribs) at 17:08, 31 May 2022 (Alter: title, template type. Add: eprint, class, authors 1-1. Removed parameters. Some additions/deletions were parameter name changes. | Use this bot. Report bugs. | Suggested by Headbomb | #UCB_toolbar). The present address (URL) is a permanent link to this revision, which may differ significantly from the current revision.

Account pre-hijacking attacks are a class of security exploit related to online services. They involve anticipating a user signing up for an online service and signing up to the service in their name, and then taking over their account when they attempt to register it themselves.[1][2][3] Pre-hijacking was first identified as a class of vulnerabilites in 2022, based on research funded by Microsoft's Security Response Center.[4][5]

Out of 75 online services surveyed, 35 were found to be vulnerable to various forms of the exploit. Vulnerable services included Dropbox, Instagram, LinkedIn, Wordpress and Zoom. The existence of the vulnerability was reported to all the service providers before publication of the paper.[5]

References

  1. ^ Kovacs, Eduard (May 24, 2022). "Hackers Can 'Pre-Hijack' Online Accounts Before They Are Created by Users". Security Week. Retrieved 2022-05-31.
  2. ^ Brinkmann, Martin (2022-05-24). "Pre-hijacking Attacks of user accounts are on the rise". gHacks Technology News. Retrieved 2022-05-31.
  3. ^ Andrew Paverd (May 23, 2022). "New Research Paper: Pre-hijacking Attacks on Web User Accounts". Microsoft Security Response Center. Retrieved 2022-05-31.
  4. ^ Dickson, Ben (2022-05-30). "Dozens of high-traffic websites vulnerable to 'account pre-hijacking', study finds". The Daily Swig. Retrieved 2022-05-31.
  5. ^ a b Sudhodanan, Avinash; Paverd, Andrew (2022-05-20). "Pre-hijacked accounts: An Empirical Study of Security Failures in User Account Creation on the Web". arXiv:2205.10174 [cs.CR].

See also


Stub icon

This computer security article is a stub. You can help Wikipedia by expanding it.

Retrieved from "https://en.wikipedia.org/w/index.php?title=Account_pre-hijacking&oldid=1090835057"