{"id":21967,"date":"2022-12-12T15:09:12","date_gmt":"2022-12-12T15:09:12","guid":{"rendered":"https:\/\/www.intelligentcio.com\/apac\/?p=21967"},"modified":"2022-12-20T11:00:05","modified_gmt":"2022-12-20T11:00:05","slug":"account-takeover-fraud-and-how-to-avoid-falling-victim","status":"publish","type":"post","link":"https:\/\/www.intelligentcio.com\/apac\/2022\/12\/12\/account-takeover-fraud-and-how-to-avoid-falling-victim\/","title":{"rendered":"Account takeover fraud… and how to avoid falling victim"},"content":{"rendered":"\n

Anthony Daniel, Regional Director \u2013 Australia, New Zealand and Pacific Islands, WatchGuard Technologies, tells us how cybercriminals exploit victims through account takeover fraud.<\/em><\/p>\n\n\n

\n
\"\"
Anthony Daniel, Regional Director for Australia, New Zealand and Pacific Islands, WatchGuard Technologies<\/strong><\/figcaption><\/figure><\/div>\n\n\n

Cybercriminals target their victims in many different ways, and one of the lesser-known methods is account takeover fraud (ATF).<\/p>\n\n\n\n

ATF is not new, but it\u2019s a tactic that is being used more aggressively. Back in 2018, it caused estimated losses of around US$4 billion across the globe. During 2021, this figure rose by more than 200% and, as of today, it is estimated to be more than US$12 billion.<\/p>\n\n\n\n

One of the methods used to mount such an attack is deceptively simple, yet the impact on a victim can be profound. It involves hijacking an account before a user has actually registered it.<\/p>\n\n\n\n

For example, an attacker can create a new account on a service such as Dropbox or Zoom using a victim\u2019s credentials that have been stolen from another source. When the user themselves attempts to create a legitimate account, they are told that one in their name already exists. They are prompted to reset the password, however the cybercriminal maintains access.<\/p>\n\n\n\n

This type of cyberattack requires a number of factors to occur:<\/p>\n\n\n\n

\u2022 The account must not have already been created by the user with the ID that is used; <\/p>\n\n\n\n

\u2022 The cybercriminal needs to have acquired some form of legitimate user identification, such as an email address or a phone number;<\/p>\n\n\n\n

\u2022 There must be a flaw in the setup process that allows an account to be created without needing to be verified.<\/p>\n\n\n\n

It\u2019s important to recognize that an attacker does not have to have access to a victim\u2019s email account or mobile phone to successfully carry out this type of attack. There simply has to be no previous account on the service in the victim\u2019s name.<\/p>\n\n\n\n

There are a range of methods that cybercriminals can use to mount an account takeover attack. They include:<\/p>\n\n\n\n

\u2022 Unexpired session ID attack:
<\/strong>In these types of attacks, the cybercriminal generates a new account using a victim’s email address as an identifier. When the victim tries to create an account, they are notified that it has already been created and are prompted to change their password. However, this does not prevent the attacker from continuing to gain access as the service allows multiple simultaneous sessions.<\/p>\n\n\n\n

\u2022 Trojan identifier attack:<\/strong>
This method involves an attacker generating an identifier on the new account, and then creating a secondary login with real customer data, such as an email address or phone number. Even if the victim tries to log in by recovering their password, the attacker will remain active in the account as a trojan.<\/p>\n\n\n\n

\u2022 Non-verifying IdP attack:<\/strong>
These types of attacks involve cybercriminals creating their own identity provider (IdP) and opening an account using its federated path. They then add a user by using that user\u2019s email address. When the victim then tries to create an account, the system reminds them that it already exists. When recovering their password, the attacker gains access through the federated account.<\/p>\n\n\n\n

\u2022 Unexpired email change attack:<\/strong>
Using this method, a cybercriminal generates an account using the victim’s email address without waiting for verification and then changes it to another one under their control. Then, if the victim tries to create an account, the attacker takes control of it before the email change process is completed.<\/p>\n\n\n\n

\u2022 Email verification trick:<\/strong>
Many online services do not allow an account to be created without verification by email. In this method, an attacker creates the account using an email address that is under their control, and then takes advantage of the ‘change email’ function by entering the victim\u2019s email address. Therefore, when the user wants to create an account, they can start the change process but the attacker will have already compromised it.<\/p>\n\n\n\n

Protecting against attacks<\/strong><\/strong><\/p>\n\n\n\n

The most effective way to protect against these types of attacks is by implementing a strong multi-factor authentication (MFA) system. These systems explicitly identify users via an additional personal device such as a mobile phone or token.<\/p>\n\n\n\n

It is also important for users to be aware of the tactics that are being used and the dangers of simply requesting a password change to an existing account when they can\u2019t remember establishing it in the first place. As with any online activity, being vigilant at all times is key.<\/p>\n","protected":false},"excerpt":{"rendered":"

Anthony Daniel, Regional Director \u2013 Australia, New Zealand and Pacific Islands, WatchGuard Technologies, tells us how cybercriminals exploit victims through account takeover fraud. Cybercriminals target their victims in many different ways, and one of the lesser-known methods is account takeover fraud (ATF). ATF is not new, but it\u2019s a tactic that is being used more aggressively. Back in 2018, it caused estimated losses of around US$4 billion across the […]<\/p>\n","protected":false},"author":18,"featured_media":21989,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[4,52,55,43,44,54],"tags":[4063,2327,4064,76,1092,77,1333],"class_list":["post-21967","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-analysis","category-main-story-newsletter","category-oceania","category-thought-leadership","category-top-stories","category-used","tag-account-takeover-fraud","tag-anthony-daniel","tag-atf","tag-australia","tag-cybercriminals","tag-new-zealand","tag-watchguard-technologies"],"acf":[],"publishpress_future_workflow_manual_trigger":{"enabledWorkflows":[]},"_links":{"self":[{"href":"https:\/\/www.intelligentcio.com\/apac\/wp-json\/wp\/v2\/posts\/21967","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.intelligentcio.com\/apac\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.intelligentcio.com\/apac\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/apac\/wp-json\/wp\/v2\/users\/18"}],"replies":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/apac\/wp-json\/wp\/v2\/comments?post=21967"}],"version-history":[{"count":10,"href":"https:\/\/www.intelligentcio.com\/apac\/wp-json\/wp\/v2\/posts\/21967\/revisions"}],"predecessor-version":[{"id":22261,"href":"https:\/\/www.intelligentcio.com\/apac\/wp-json\/wp\/v2\/posts\/21967\/revisions\/22261"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/apac\/wp-json\/wp\/v2\/media\/21989"}],"wp:attachment":[{"href":"https:\/\/www.intelligentcio.com\/apac\/wp-json\/wp\/v2\/media?parent=21967"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/apac\/wp-json\/wp\/v2\/categories?post=21967"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/apac\/wp-json\/wp\/v2\/tags?post=21967"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}