  The ubiquity of user accounts in websites and online services makes account
hijacking a serious security concern. Although previous research has studied
various techniques through which an attacker can gain access to a victim's
account, relatively little attention has been directed towards the process of
account creation. The current trend towards federated authentication (e.g.,
Single Sign-On) adds an additional layer of complexity because many services
now support both the classic approach in which the user directly sets a
password, and the federated approach in which the user authenticates via an
identity provider.
  Inspired by previous work on preemptive account hijacking [Ghasemisharif et
al., USENIX SEC 2018], we show that there exists a whole class of account
pre-hijacking attacks. The distinctive feature of these attacks is that the
attacker performs some action before the victim creates an account, which makes
it trivial for the attacker to gain access after the victim has
created/recovered the account. Assuming a realistic attacker who knows only the
victim's email address, we identify and discuss five different types of account
pre-hijacking attacks.
  To ascertain the prevalence of such vulnerabilities in the wild, we analyzed
75 popular services and found that at least 35 of these were vulnerable to one
or more account pre-hijacking attacks. Whilst some of these may be noticed by
attentive users, others were completely undetectable from the victim's
perspective. Finally, we investigated the root cause of these vulnerabilities
and present a set of security requirements to prevent such vulnerabilities
arising in future.
