about inactive account hijacking

[innate@xxxxxx]

INACTIVE ACCOUNT HIJACKING

author:         l0om
page:           l0om.org
date:           02.05.2009

OVERVIEW:

I would like to draw your attention on a problem that is already known and is 
surely exploited for a long time, but clearly seems to be underestimated.

the problem is explained quickly:
- email service provider delete inactive accounts after six or twelve months of 
inactivity and release the adresse (nearly every big email provider does it)
- many platforms (webshops, forums, etc...) do NOT delete inactive accounts

This asymmetry in handling inactive accounts has the consequence that thousands 
of accounts of various online platforms can be hijacked by attackers without 
any technical difficulties.

The procedure is so simple that it hardly needs to be mentioned:
- An attacker takes an old email address and try to register this email account 
at the email service provider.
- If it can be registered, it is assumed that the account has been released (or 
has never existed).
- Then the attacker tries at a variety of online platforms to create accounts 
for the just mentioned email address.

+ If the registration would be successful, there is no account for this email 
address at this online platform registered
+ If the registration fails, because it already have an account there, there 
has been found a registered account for this email address and now its getting 
ugly.
        
an attacker can hijack the account of the online platform if he simply register 
the email account and now uses the forgotten-the-password-function. the 
attacker gets a link which can be used to set a new password. Now he has the 
user data and the functions of the original owner in his control.

jeopardized are all possible online systems with such a 
forgotten-password-functional in use.

furthermore on holidays an attacker gets newsletter emails which lead the 
attacker to another accounts.

one interesting fact is that especailly very big platforms (webshops and forums 
which are kinda oldschool for the net) are vulnerable.

DEFENSE:

it is necessary to process as quick as possible the 
forgotten-the-password-function on large platforms. instead of just ask for the 
emailaddress to identify yourself you should be asked for eg. the last numbers 
of your banking account. this information shouldnt be found somewhere in the 
internet. this will make the efficient execution of the attack impossible.
furthermore newsletter scripts should check for delivery-faild messages caused 
by non existing accounts. such accounts can be locked and should be locked 
(maybe deleted).

GREETINGS:

John K., I², Molke, McFly, Takt, Proxy, johnny long, murfie, Maximilian, 
Theldens, Commander Jansen, detach, ole 
and last but not least Jquade

FLAMES:

salem, the knilch