Account pre-hijacking attacks are a class ofsecurity exploit related toonline services. They involve anticipating a user signing up for an online service and signing up to the service in their name, and then taking over their account when they attempt to register it themselves.[1][2][3] The attack relies on confusion between accounts created byfederated identity services and accounts created using e-mail addresses and passwords, and the failure of services to resolve this confusion correctly.[1]
Pre-hijacking was first identified as a class of vulnerabilities in 2022, based on research funded byMicrosoft's Security Response Center.[4][5]
Out of 75 online services surveyed, 35 were found to be vulnerable to various forms of the exploit. Vulnerable services includedDropbox,Instagram,LinkedIn,WordPress andZoom. The existence of the vulnerability was reported to all the service providers before publication of the paper.[5]
 | Thiscomputer security article is astub. You can help Wikipedia byadding missing information. |