Handcrafted Fraud and Extortion

TLDR

Online accounts are valuable resources that attract criminals who steal or hijack them. This study investigates manual account hijacking performed by humans rather than botnets. The authors detail a hijacking workflow that includes attack vectors, an exploitation phase, and post‑hijacking remediation. They report that certain defense strategies effectively curb manual hijacking.

Abstract

Online accounts are inherently valuable resources---both for the data they contain and the reputation they accrue over time. Unsurprisingly, this value drives criminals to steal, or hijack, such accounts. In this paper we focus on manual account hijacking---account hijacking performed manually by humans instead of botnets. We describe the details of the hijacking workflow: the attack vectors, the exploitation phase, and post-hijacking remediation. Finally we share, as a large online company, which defense strategies we found effective to curb manual hijacking.