Hackers can hack your online accounts before you even register them

By Bill Toulas, Bleeping Computer

Security researchers have revealed that hackers can hijack your online accounts before you even register them by exploiting flaws that have been already been fixed on popular websites, including Instagram, LinkedIn, Zoom, WordPress, and Dropbox.

Andrew Paverd, a researcher at Microsoft Security Response Center, and Avinash Sudhodanan, an independent security researcher, analyzed 75 popular online services and found that at least 35 are vulnerable to account pre-hijacking attacks.

These attacks vary in type and severity, but they all stem from poor security practices on the side of the websites themselves.

As some vulnerable websites run bug bounty programs, it is surprising and worrying to see that such elementary attacks are still possible against their users.


Comments

Post a Comment

Popular posts from this blog

Ukraine targeted by DDoS attacks from compromised WordPress sites

Image
By Bill Toulas, Bleeping Computer Ukraine's computer emergency response team (CERT-UA) has published an announcement warning of ongoing DDoS (distributed denial of service) attacks targeting pro-Ukraine sites and the government web portal. The threat actors, who at this time remain unknown, are compromising WordPress sites and injecting malicious JavaScript code to perform the attacks. These scripts are placed in the HTML structure of the main files of the website and are base64-encoded to evade detection. The code runs on the website visitor's computer and directs their available computational resources to generate an abnormal number of requests to attack objects (URLs) defined in the code. The result is that some of the target websites are overwhelmed by the requests and, as a result, rendered inaccessible to their regular visitors. This all happens without the owners or the visitors of the compromised sites ever realizing it, except for maybe some barely noticeable performan...
Read more

Microsoft fixes new PetitPotam Windows NTLM Relay attack vector

By Lawrence Abrams,  Bleeping Computer A recent security update for a Windows NTLM Relay Attack has been confirmed to be a previously unfixed vector for the PetitPotam attack. During the May 2022 Patch Tuesday, Microsoft released a security update for an actively exploited NTLM Relay Attack labeled as a 'Windows LSA Spoofing Vulnerability' and tracked as CVE-2022-26925 . "An unauthenticated attacker could call a method on the LSARPC interface and coerce the domain controller to authenticate to the attacker using NTLM. This security update detects anonymous connection attempts in LSARPC and disallows it." An NTLM Relay Attack allows threat actors to force devices, even domain controllers, to authenticate against malicious servers they control. Once a device authenticates, the malicious server can impersonate the device and gain all of its privileges. These attacks are significant problems as they could allow a threat actor to gain complete control over the domain. Whi...
Read more

Microsoft Azure outage takes down services across North America

Image
By Sergiu Gatlan,  Bleeping Computer ​Microsoft has mitigated an Azure outage that lasted more than two hours and took down multiple services for customers across North and Latin America. The company says the incident started around 18:22 UTC and impacted services that leverage Azure Front Door (AFD), its modern cloud Content Delivery Network (CDN). "This issue is impacting multiple geographies, mostly in North America and Latin America," Redmond explained when it first acknowledged the outage on the Azure status page, saying it was caused by what it described as a "configuration change." "We have rolled back this change and, from 19:25 UTC, the majority of services are seeing recovery. Many Microsoft services have failed away from AFD, in response to this issue." However, customers have also reported experiencing errors connecting to Azure services (including Azure DevOps) in the United Kingdom, with the Azure DevOps status page also tagging the issues ...
Read more