English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

The ubiquity of user accounts in websites and online services makes accounthijacking a serious security concern. Although previous research has studiedvarious techniques through which an attacker can gain access to a victim'saccount, relatively little attention has been directed towards the process ofaccount creation. The current trend towards federated authentication (e.g.,Single Sign-On) adds an additional layer of complexity because many servicesnow support both the classic approach in which the user directly sets apassword, and the federated approach in which the user authenticates via anidentity provider.  Inspired by previous work on preemptive account hijacking [Ghasemisharif etal., USENIX SEC 2018], we show that there exists a whole class of accountpre-hijacking attacks. The distinctive feature of these attacks is that theattacker performs some action before the victim creates an account, which makesit trivial for the attacker to gain access after the victim hascreated/recovered the account. Assuming a realistic attacker who knows only thevictim's email address, we identify and discuss five different types of accountpre-hijacking attacks.  To ascertain the prevalence of such vulnerabilities in the wild, we analyzed75 popular services and found that at least 35 of these were vulnerable to oneor more account pre-hijacking attacks. Whilst some of these may be noticed byattentive users, others were completely undetectable from the victim'sperspective. Finally, we investigated the root cause of these vulnerabilitiesand present a set of security requirements to prevent such vulnerabilitiesarising in future.

Pre-hijacked accounts: An Empirical Study of Security Failures in User Account Creation on the Web