8 ms·
Dozens of high-traffic websites vulnerable to ‘account pre-hijacking’, study
- hker999 4y agoI discovered this flaw 3 years ago and sent it to many bug bounty programs. Almost all were closed as informative/not a security issue and I was paid $50 for one after 6 months as a low priority. This issue will most likely never get fixed as I already let most of the companies in this article know it was a problem...and they just don't care.
- donclark 4y agoThis reminds me of credit card fraud and how companies (like VISA) dont seem to care either. As long as they are not held liable for the losses (or it does not cause a drop in users) why would they? Is there a class-action lawsuit possibility in both cases?
- quesomaster9000 4y agoIT security is an insurance problem, and the insurers may stipulate you need a pentest, which makes it not their problem and not your problem - just keep paying those premiums and the liability gets passed to the end-user ;) There is no class-action lawsuit, that's just business...
- Gigachad 4y agoIt’s the same in any industry. Try telling the local council they should build a road overpass over a pedestrian crossing because it’s safer and a few people have been hurt there. What you are saying is true, but it’s unlikely anything will be done because it’s expensive and not a huge risk.
- refurb 4y agoWhat would be your class action lawsuit for credit card fraud? Who are the plaintiffs?
- guessmyname 4y agoIt’s because one of the researchers works at Microsoft. I will assume they have contact who work at all the aformentioned companies, contact that allow the security report to escalate to the appropriate channels. I have reported the same security problems too in the past to several companies, and the majority of them have been closed as “informative/non-actionable” too.
- albert_e 4y agoThe article states > Fortunately, all the affected services were notified of the vulnerabilities and have implemented the necessary fixes. this is right after they list the affected services > Top services affected > In their study, the researchers examined 75 services that ranked among Alexa’s list of top-150 high-traffic domains. At least 35 were affected by one or more account pre-hijacking attacks, including Dropbox, Instagram, LinkedIn, WordPress.com, and Zoom. Fortunately, all the affected services were notified of the vulnerabilities and have implemented the necessary fixes.
- hker999 4y agoMost likely because of the perceived bad press.
- groffee 4y agoI discovered this on my own site years ago now, at the time I thought it was just my inexperience, which to be fair it was. If you think properly about security and don't blindly rely on third parties (especially for auth) you'll be fine.
- Gigachad 4y agoBlindly relying on premade auth libraries puts you in a better position than almost any custom built solution. Even if you built it right. Some junior dev will misunderstand it years later and introduce issues. While they won’t be submitting bad PRs to an auth library.
- akeck 4y agoSigh. In the last month, I've had to close a new Robinhood account, a new Facebook account, a new Spotify account, and new credit monitoring account - all created with an email address I generally don't use and the attackers phone number (used for initial verification).
- CamperBob2 4y agoSomeone registered a Spotify account with my email address at one point, but they apparently didn't give them a phone #. I just requested a password-reset link and changed it, no 2FA needed. They have my credit card number, but not my phone number, and I guess that's enough for them...
- quesomaster9000 4y agoCredit card numbers are worse than passwords when it comes to toxic data. Why are we, on a daily basis, distributing all the information necessary to fraudulently impersonate us, and we're all OK with that. Then shrug it off 'oh yea they have my home address, credit card number, name, age, mugshot and email address... but at least they can't hijack my phone number'. Until identity as a concept on the internet catches up with 30 years of cryptography advancements then we're all still stuck in the authentication vs authorization dark ages, the problem is because there's enough critical mass that outside of large enterprise roll-outs it means we're either stuck rubbing two-sticks together caveman style or accepting Apple or Microsoft as our new god (pls upload disk encryption keys to server, and unlock them with your face etc, trust our "secure cloud" while we MITM your login and credentials)
- pid-1 4y agoI mostly use virtual credit cards for websites. My bank allows me to create an unlimited number of them. (Well, there's likely a limit but prob very high)
- FriendlyNormie 4y ago
- richdougherty 4y ago"Malicious actors can take unauthorized ownership of online accounts even before their victims sign up for services, according to new research backed by the Microsoft Security Response Center (MSRC)." "In their study, the researchers examined 75 services that ranked among Alexa’s list of top-150 high-traffic domains." Ironically, Microsoft accounts seemed to be vulnerable as of last year. I got an email from Microsoft about someone renaming an account linked to my email address - an account I didn't know about. I was never able to recover access as they wanted me to prove I owned the account and whoever had created it had all that info. If anyone in Microsoft is reading this I'd appreciate help sorting this out!
- deleted 4y ago[deleted]
- thimkerbell 4y agoIs there a low-friction way to inform the institution (and have them hear you) that you did not create the account?
- richdougherty 4y agoI'd love to know! I got this email. Your Microsoft account has been renamed. We just wanted to check with you that it's okay. - Old account name: <my email address> - New account name: <someone else>@outlook.com If this is correct, you don't need to do anything. If this is incorrect, please follow these steps: 1. Reset your password by going to https://account.live.com/password/Reset 2. Rename your account by going to https://account.live.com/ Neither link worked for me because I couldn't authenticate the account that someone else created. I couldn't stop the account name being changed, even though I had control of the original email address. Later when I submitted a request to reset the account I was asked for more information at this link: https://account.live.com/acsr https://account.live.com/acsr. Again, this required me to know info about the account someone else created. I managed to link my email address to another Microsoft account, but I'm not confident that someone still doesn't have another Microsoft account with partial control of my identity. If anyone has any tips about who to talk to at Microsoft other than an automated system I'd appreciate it!
- thoughtexprmnt 4y agoMaybe I'm missing something in the description of the exploit, but don't sites that use email address during account creation typically send some sort of link/code to the provided email to verify ownership? So does this vulnerability assume the attacker has access to the victim's email? If that's the case it seems like "pre-hijacking" would be the least of concerns.
- georgyo 4y agoNo, many sites let you continue to use your account _before_ you validate your email address. They let you configure settings and explore before the address is validated. An attacker can use this to poison an account without ever having access to the actual email address.
- TheGeminon 4y agoI haven’t read the actual report, but I would imagine a scenario like this would be possible: 1. Mallory registers an account for alice@example.com using a password. 2. Alice receives an account activation email, but doesn’t do anything about it. 3. At a later date Alice registers an account on the service using a social login/SSO (e.g. Google, GitHub) 4. Alice properly activates the account (may or may not be required, depending on the service). 5. The service merges the password account together with the SSO account since they have the same email. 6. Mallory can access Alice’s account with their original password from step 1, while Alice continues to use social login, unaware they also have a password set.
- vanous 4y agoAs the article mentioned, adding 2FA is solving the issue.
- julianlam 4y agoNot really, solving the issue via added complexity is not the ideal solution. ... and I say this as a vigorous proponent of second factor authentication. The real fix here is to completely change how the service handles email addresses. You can continue to request it, but it cannot be used as an identifier until it is confirmed.
- jfoster 4y agoServices that allow sign-up without proof of email (eg. by clicking a link in a verification email) ownership are just obnoxious in general. I have a gmail address that simply represents my name, and tend to get something intended for someone else pretty much daily.
- tlavoie 4y agoI get those quite often. As far as I've been able to tell, they're typically someone else sharing my first and last name, and they're using a Gmail address without the '.' in my usual first.last@gmail.com address. Gmail doesn't care about the period, so firstlast@gmail.com gets to me as well. And only me... You might think that if trying to access utilities, or apply for a job, you might use an address you can actually receive messages on.
- jfoster 4y agoYeah, usually, though when I tried to sign up to Doordash my account already had someone else's details filled, and even though I corrected them to my details, I could never place an order; Doordash had pre-banned me. Many calls to customer service couldn't fix it, despite promises each time. Now that I'm aware of this security flaw, I'm not sure whether that instance was incompetence or malice.
- tlavoie 4y agoI've occasionally let my curiosity take me down the rabbit hole, to see if I can figure what it's all about. In one case, the email reminder about an upcoming job interview gave me enough to call the recruiter, and ask if they have alternate contact means for the interviewee. Apparently yes, there's a phone, so I suggested that they use it to ask them for their real email address. Also, if someone uses my email to sign up for some site, you know I'll be using the password reset functionality immediately, then checking that site out ASAP.
- wang_li 4y agoThat happens to me too. My suspicion is that the sign ups are happening via telephone and the agent handling the sign up is fucking up the spelling or leaving off the disambiguating elements, digits or whatever.
- tinus_hn 4y agoSomeone every so often uses my email address instead of his/her own and you’d be surprised how many services don’t do any validation at all and you have to consider yourself lucky if you can get them to close the account without resetting the password, which is illegal.
- CM30 4y agoThe thing that confuses me here is why these sites would 'merge' accounts if you sign it with another identity provider after supposedly having signed up with that email address separately. Shouldn't it just create another account? Or maybe say that the email associated with the account has already been used on this site, and to reset your password instead? Feels like the issue stems from these sites opening a huge security hole in their sign up process in exchange for the tiniest piece of convenience that most people will never encounter or need.
- bradgessler 4y agoI wrote a library for Rails a few weeks ago at https://github.com/rocketshipio/nopassword https://github.com/rocketshipio/nopassword that eliminates passwords for login by making folks login with an email address and then emailing them a code. It eliminates the vulnerability this article speaks of and eliminates passwords, along with all the support headaches that comes with.
- WA 4y agoOnly if existing sessions are invalidated. Otherwise, magic login links like this have a problem: - Attacker signs up with victim's email address and is immediately logged in (signup usually triggers a login/session creation). The session could last forever - Victim tries to sign up, but it doesn't work, because the account is already registered. Victim assumes they forgot about them signing up already and requests a login-link/token. Victim logs in using the method and adds sensitive data to the account. - Attacker session is still active, attacker can read victim's information.
- bradgessler 4y agoAttacker can’t sign in with victims email unless they have gained access to victims email account. No session gets created for the authorized user until they provide a valid code and salt (within 3 tries and 5 min).
- alipitch 4y agoWhat would the CWEs be for the five classes of attacks? - Classic-Federated Merge (CFM) - Unexpired Session (US) - Trojan Identifier (TID) - Unexpired Email Change (UE) - Non-verifying IdP (NV)
- alipitch 4y ago- Unexpired Email Change (UE)
- alipitch 4y agopossibly CWE-306? CWE-306: Missing Authentication for Critical Function <https://cwe.mitre.org/data/definitions/306.html https://cwe.mitre.org/data/definitions/306.html> Looking at the CWE-306 wording, this does not look like the right CWE, but OWASP ASVP 3.7.1 points to this CWE. OWASP ASVP 3.7.1 <https://github.com/OWASP/ASVS/blob/v4.0.3_release/4.0/en/0x12-V3-Session-management.md#description-of-the-half-open-attack https://github.com/OWASP/ASVS/blob/v4.0.3_release/4.0/en/0x1...> 3.7.1 Verify the application ensures a full, valid login session or requires re-authentication or secondary verification before allowing any sensitive transactions or account modifications. CWE-306
- alipitch 4y agoFor all five classes of attacks, the paper states that the root cause & mitigation is "Strict Identifier Verification". 6.2 Root Cause & Mitigation 6.2.1 Strict Identifier Verification The root cause of all of the attacks identified in the preceding sections is failure to verify ownership of the claimed identifier.
- alipitch 4y ago"Strict Identifier Verification" look kind of like CWE-304. CWE-304: Missing Critical Step in Authentication <https://cwe.mitre.org/data/definitions/304.html https://cwe.mitre.org/data/definitions/304.html> Looking at the CWE-304 wording, this does not look like the right CWE, but OWASP ASVP 2.2.2 points to this CWE. OWASP ASVP 2.2.2 <https://github.com/OWASP/ASVS/blob/v4.0.3_release/4.0/en/0x11-V2-Authentication.md#v22-general-authenticator-security https://github.com/OWASP/ASVS/blob/v4.0.3_release/4.0/en/0x1...> 2.2.2 Verify that the use of weak authenticators (such as SMS and email) is limited to secondary verification and transaction approval and not as a replacement for more secure authentication methods. Verify that stronger methods are offered before weak methods, users are aware of the risks, or that proper measures are in place to limit the risks of account compromise. CWE-304
- Adkins082 4y ago