论文标题
预先使用的帐户：网络上用户帐户创建的安全失败的实证研究
Pre-hijacked accounts: An Empirical Study of Security Failures in User Account Creation on the Web
论文作者
论文摘要
用户帐户在网站和在线服务中的无处不在，使帐户劫持了严重的安全问题。尽管以前的研究研究了攻击者可以访问受害者帐户的各种技术，但对账目创建过程的关注很少。联合身份验证的当前趋势（例如，单登录）增加了一层复杂性，因为现在许多服务都支持用户直接设置密码的经典方法，又支持用户通过身份提供者进行认证的联合方法。 受到先前关于劫持的劫持工作的启发[Ghasemisharif等人，USENIX SEC 2018]，我们表明存在整个帐户的预种行攻击。这些攻击的独特特征是，攻击者在受害人创建一个帐户之前采取了一些行动，这使攻击者在受害者创建/恢复帐户后能够访问访问。假设一个仅知道受害者的电子邮件地址的现实攻击者，我们会识别并讨论五种不同类型的帐户预种行攻击。 为了确定野外这种脆弱性的流行率，我们分析了75种流行服务，发现其中至少35个容易受到一个或多个帐户的预种行攻击的影响。尽管细心的用户可能会注意到其中的一些，但从受害者的角度来看，其他一些人完全无法检测到。最后，我们研究了这些漏洞的根本原因，并提出了一套安全要求，以防止将来出现这种漏洞。
The ubiquity of user accounts in websites and online services makes account hijacking a serious security concern. Although previous research has studied various techniques through which an attacker can gain access to a victim's account, relatively little attention has been directed towards the process of account creation. The current trend towards federated authentication (e.g., Single Sign-On) adds an additional layer of complexity because many services now support both the classic approach in which the user directly sets a password, and the federated approach in which the user authenticates via an identity provider. Inspired by previous work on preemptive account hijacking [Ghasemisharif et al., USENIX SEC 2018], we show that there exists a whole class of account pre-hijacking attacks. The distinctive feature of these attacks is that the attacker performs some action before the victim creates an account, which makes it trivial for the attacker to gain access after the victim has created/recovered the account. Assuming a realistic attacker who knows only the victim's email address, we identify and discuss five different types of account pre-hijacking attacks. To ascertain the prevalence of such vulnerabilities in the wild, we analyzed 75 popular services and found that at least 35 of these were vulnerable to one or more account pre-hijacking attacks. Whilst some of these may be noticed by attentive users, others were completely undetectable from the victim's perspective. Finally, we investigated the root cause of these vulnerabilities and present a set of security requirements to prevent such vulnerabilities arising in future.
