This field-guide entry has not been reviewed in its new form yet. The studies are summarized as published; no review date is implied.
Key findings #
At least 35 of 75 popular online services were vulnerable to one or more account pre-hijacking attacks.
In an account pre-hijacking attack, an attacker who knows only the victim’s email address acts before the victim creates an account and gains access after the victim has signed up.
Of 27 hack-for-hire services that researchers approached as buyers, only 5 succeeded in attacking the email accounts of the test identities.
Hack-for-hire attackers relied mainly on tailored phishing messages that were sophisticated enough to bypass SMS two-factor authentication.
Evidence #
| Study | Year | Sample | Method | Finding |
|---|---|---|---|---|
| Pre-hijacked accounts: An Empirical Study of Security Failures in User Account Creation on the WebIndependent researcher, Microsoft Security Response Center | 2022 | 75 popular online services | Attack design and testing against live services | At least 35 services were vulnerable to one or more of 5 pre-hijacking attacks. |
| Hack for Hire: Exploring the Emerging Market for Account HijackingUC San Diego, Google | 2019 | 27 English, Russian and Chinese hack-for-hire services | Posing as buyers against synthetic victim identities | 5 services succeeded, mostly through tailored phishing. |
What to do #
For engineers #
- Don’t let anyone use an account before they have proven they control its identifier. Verify the email address before the account becomes usable, and before you merge a password account with a federated login for the same address.
- Only trust email addresses from identity providers that verify them. One of the 5 attacks relies on a non-verifying identity provider.
- End all sessions and expire pending email-change links when the password is reset or the email address changes. Two of the attacks rely on unexpired sessions and email changes.
- Offer phishing-resistant factors. The hack-for-hire services got past SMS codes with phishing. See passwordless authentication and my critical notes on passkeys.
For product and UX #
- Show users which sign-in methods are linked to their account, and notify them when one is added.
- When someone signs up with an address that already has a pending or unverified account, guide them through verification instead of silently signing them in.
- Recovery flows are another takeover path. The account recovery entry lists the common weaknesses.
The studies in detail #
Account Pre-Hijacking Attacks: Security Failures in User Account Creation #
“The ubiquity of user accounts in websites and online services makes account hijacking a serious security concern. Although previous research has studied various techniques through which an attacker can gain access to a victim’s account, relatively little attention has been directed towards the process of account creation.”
In this study, Avinash Sudhodanan and Andrew Paverd show that there is a whole class of account pre-hijacking attacks. The key point: “The distinctive feature of these attacks is that the attacker performs some action before the victim creates an account, which makes it trivial for the attacker to gain access after the victim has created/recovered the account.”
The authors assume a realistic attacker who knows only the victim’s email address. They describe 5 attacks: Classic-Federated Merge, Unexpired Session, Trojan Identifier, Unexpired Email Change and Non-verifying IdP. Of 75 popular services they analyzed, at least 35 were vulnerable to one or more of them. Some attacks were completely undetectable from the victim’s point of view. The paper closes with security requirements that prevent these vulnerabilities.
Hack for Hire: Exploring the Emerging Market for Account Hijacking #
In this paper, researchers from UC San Diego and Google “study a segment of targeted attackers known as ‘hack for hire’ services to understand the playbook that attackers use to gain access to victim accounts.”
Posing as buyers, they contacted 27 English, Russian and Chinese black-market services, and only 5 succeeded in attacking the synthetic but realistic identities the researchers controlled. The attackers mostly used tailored phishing that could bypass SMS two-factor authentication. The authors also observed low volume, poor customer service and multiple scammers in this market. The paper is a good read if you want to understand the commercial account hijacking ecosystem and the techniques criminals use.