The assault targets the account creation process, which is common on websites and other online platforms, allowing an adversary to carry out a series of operations before an unwary victim establishes an account with a target service.

Avinash Sudhodanan, an independent security researcher, led the investigation alongside Andrew Paverd of the Microsoft Security Response Center (MSRC).

Pre-hijacking relies on an attacker already having a unique identifier linked with a victim, such as an email address or phone number, which may be gained through the target’s social media accounts or from publicly available credential dumps.

The assaults may then take five various forms, including both the adversary and the victim using the same email address when creating the account, possibly providing both sides concurrent access to the account.

“If an attacker can establish an account at a target service using the victim’s email address before the victim opens an account, the attacker may use different approaches to place the account in a pre-hijacked state,” the researchers said.

“After the victim regained access to the account and began using it, the attacker may regain access and take control the account.” The following are the five kinds of pre-hijacking attacks:

• The Traditional-Federated Merge Attack allows the victim and the attacker to access the same account by merging two accounts established using classic and federated identity routes with the same email address.
• Unused Session Identifier Attack, in which the attacker establishes an account using the victim’s email address and keeps it active for a long time. Because the password reset did not end the attacker’s session, when the user restores the account using the same email address, the attacker retains access.
• An attacker establishes an account using the victim’s email address and then adds a trojan identifier, such as a secondary email address or a phone number under their control, to the account. When the genuine user regains access to the account after a password reset, the attacker may utilize the trojan identification to acquire access.
• Unexpired Email Change Attack: An attacker opens an account using the victim’s email address and then changes the email address to one they control. When the service provides the new email address a verification URL, the attacker waits for the victim to recover and start using the account before completing the change-of-email procedure and seizing control of the account.
• Non-Verifying Identity Provider (IdP) Attack, in which the attacker uses a non-verifying IdP to establish an account with the target service. Whether the victim uses the traditional registration process or uses the same email address, the attacker is able to obtain access to the account.

In an Alexa examination of 75 of the most popular websites, 56 pre-hijacking vulnerabilities on 35 services were discovered. There are 13 Classic-Federated Merge attacks, 19 Unexpired Session Identifier attacks, 12 Trojan Identifier attacks, 11 Unexpired Email Change attacks, and one Non-Verifying IdP attack.

• Dropbox – Unexpired Email Change Attack
• Instagram – Trojan Identifier Attack
• LinkedIn – Unexpired Session and Trojan Identifier Attacks
• WordPress.com – Unexpired Session and Unexpired Email Change Attacks, and
• Zoom – Classic-Federated Merge and Non-verifying IdP Attacks

“The inability to verify ownership of the claimed identity is the fundamental cause of all assaults,” the researchers concluded.

“Although many services do this sort of verification, they often do it in an asynchronous manner, enabling the user to access some account functions before the identification is validated. While this may increase usability (by reducing user friction while signal up), it also exposes the user to pre-hijacking attempts.”

While stringent identification verification in services is critical for preventing pre-hijacking attempts, users should employ multi-factor authentication to protect their accounts (MFA).

“Correctly designed MFA will prohibit the attacker from authenticating to a pre-hacked account once the victim begins using it,” the researchers said. “To avoid the Unexpired Session attack, the service must additionally invalidate any sessions formed previous to the activation of MFA.”

In addition, for a defense-in-depth approach to account management, online services should remove unverified accounts on a regular basis, impose a short timeframe to authenticate a change of email address, and invalidate sessions during password resets.

“When a service combines a conventional route account with a federated route account (or vice versa), the service must confirm that the user presently manages both accounts,” Sudhodanan and Paverd said.

The post Learn How Hackers Can Hijack Your Online Accounts Even Before You Create Them appeared first on B6G.NET| for all information technology.

If your site is not configured and optimized for mobile devices, you will lose many visitors and may even lose your work soon, so make it a precedence for your work. According to a study conducted by internetretailer.com, speed in loading pages is the most preferred by Internet surfers using smart phones 16% of browsers By phones, they do not return to the site if it is slow.

Before going into these tips, I advise programmers to read this reference from Google

Tips to make your site compatible with smartphones:

• Simplify the design and make it proportional

The design for smartphones does not have to be like the design for ordinary large-screen devices, it is better to make your design for smartphones one column for the visitor to browse vertically, not to go right or left, this would distract the visitor, so it is always better to speed it up one column. The small screen should not display a lot of information that would distract the reader through the mobile phone.

1. There are several ways to do this either by purchasing optimized and ready-made themes , or add- ons that will improve your blog whether the site is based on a blog.
2. Or rely on Google’s reference to build the style from scratch and improve it for mobile. I recommend this method for programmers.

• Content Optimization

Know what the visitor needs from your site. Visitors to the B6g.net News usually need to browse the news quickly, and they can only read the headlines, so do not make them read the entire topic and put a lot of text on the screen. Give them addresses. Whether they find that the title attracts them, take them to another page, which is the topic page or The news.

• Make navigation easier

Make the navigation between the sections of your site easier and better, visitors do not want a thousand pages and a thousand links for each section, and it is always preferable to make the most important sections on the start page of the site.

Do not forget that phones have a small screen, so do not make the important links too small so that the visitor cannot click on them, or press five links together due to their smallness. Larger or use rather large icons to move between sections.

Use the moving menu (as it is in the world of technology) whether there are a lot of sections you want to show the visitor.

• Make your site faster

Whether you successfully made the first point (simplifying the design), this will really do the job and will facilitate and speed up browsing, of course Flash I advise against using it moreover to that it is not compatible with the SEO of your site, it also causes you problems browsing by phone and will slow down Browsing in general, do not use too much JavaScript either, an alternative is to use HTML 5 , which everyone likes.

Large images and high resolution also cause slow browsing, think are these images very important, provided not, how much you reduce them or even cancel them whether they are not important. Use the page speed that I talked about in a previous article of mine to make Optimized images.

• Make your website or business name visible

You should not forget the logo of your site and make it visible in browsing through phones, this will add a good impression to the visitor who visits your site for the first time, whether he sees it compatible with his device and fast, he will always prefer you over any other competitor when he is looking for something particular.

These are some simple tips for website owners, but whether you are a programmer, I advise you to look at the Google guide that explains and details more.

The post Make your site compatible with smartphones appeared first on B6G.NET| for all information technology.

Multiple versions of a WordPress plugin by the name of “School Management Pro” harbored a backdoor that could grant an adversary total control over vulnerable websites.

The issue, spotted in premium versions before 9.9.7, has been assigned the CVE identifier CVE-2022-1609 and is rated 10 out of 10 for severity.

The backdoor, which is believed to have existed since version 8.9, enables “an unauthenticated attacker to execute arbitrary PHP code on sites with the plugin installed,” Jetpack’s Harald Eilertsen said in a Friday write-up.

School Management, developed by an India-based company called Weblizar, is billed as a WordPress add-on to “manage complete school operation.” It also claims more than 340,000 customers of its premium and free WordPress themes and plugins.

The WordPress security company noted that it uncovered the implant on May 4 after it was alerted to the presence of heavily obfuscated code in the license-checking code of the plugin. The free version of School Management, which doesn’t pack the licensing code, is not impacted.

While the backdoor has since been removed, the exact origins of the compromise remains unclear, with the vendor stating that “they do not know when or how the code came into their software.”

Customers of the plugin are recommended to update to the latest version (9.9.7) to prevent active exploitation attempts.

The post Researchers Find Backdoor in School Management Plugin for WordPress appeared first on B6G.NET| for all information technology.

Every minute, more than 500 new websites are created on the web, in addition to the billions that already exist. And when a new site is launched, the main challenge is getting visitors to visit the site. Search engines like Google are the leading engine of internet traffic, and provided you want to improve your site’s visibility, your site should rank higher in search results. Statistics show that nearly 60% of users click on the first 5 search results that Google shows, so getting the highest ranking in search results has become a top precedence for numerous companies nowadays.

There are 5 ways to make your website stand out at the top of search engine results:

1. Post content that answers your customers’ questions

The popular saying that “content is king” is indeed true. The best way to improve your site’s visibility is by posting new content on a regular basis. This content should have real value and should answer users’ questions. Research by RBI shows that question-based searches have increased exponentially in recent years, due to the fact that search engines have become trusted sources for the right information.

If a search engine considers this page to be the best source for answering a question, it makes it to the top of the search engine results and places it in an answer box, which automatically gets the most clicks possible. For example, when typing “who is the ruler of Dubai” on Google, it will display the answers it deems most appropriate at the top of the page (in the answer boxes). In order to benefit from the higher-ranked answer box results, you need to discover user questions and improve your website performance accordingly.

2. Use local content for your target audience

Translating your content is not enough whether you want to target an audience in another country. To better target the audience, it is fundamental that you make the content speak the dialect of that country using a native speaker of the dialect, particularly whether you are targeting an Arabic speaking audience. For example, the Word house has several versions in the Arabic language, for example in the United Arab Emirates it is used (house), and (dar) in the state of Morocco. And also for the names of cities that have different versions in Arabic. For example, Damascus can be written in another way like “the Levant” and Casablanca can be written “Casablanca”.

3. Optimizing your site for long search terms

In search results for some sectors, such as banking, it can be difficult to rank broad terms in the highest rank on Google – for example “banker” or “loans”. It can be more effective when using Long Tail Searches. They are long phrases or sentences that ask particular questions in a big way.

When optimizing your website, your page title should contain the most important keywords and summarize what the page is about. Instead of using a generic title such as “Bank in the UAE” (Short Tail Keywords), use a more specific product and website (Long Tail Keywords) such as “Personal Banking in Dubai”. You can also use this technique in content content, where merging keywords or long-tail queries is relatively easier and appears in search automatically.

4. Your site is compatible with mobile phones

Google has recently started indexing and ranking pages on its search engine based on mobile versions of websites instead of desktop versions, which will negatively impact non-mobile websites, as the update will further improve the ranking of mobile websites in search results. Compared to inappropriate sites. It is therefore necessary that the website be as mobile friendly as possible so that brands can ensure that their sites appear in search engine results. The United Arab Emirates and Saudi Arabia have the highest smartphone penetration rates in the world, so providing a mobile-friendly site will provide a better user experience and will ensure that visitors browse your site more.

5. Use paid search to get instant exposure

It usually takes 2-3 months for a website to rank usually on Google. You can use a paid search service like Google Adwords, which enables your site to appear at the top of the ranking instantly. There is also a Pay Per Click service which is an online advertisement form used to direct visits to the site, which you can use to promote your site to get immediate results. Pay on Click service also helps you manage your budget and degree your return on investment easier. It also allows for specific geo-targeting (at the city level, for example, the ad will only be shown in Dubai) that gives you more control over how to target the correct audience.

There are no shortcuts to improving your website’s visibility on the Internet. It may take some time so you should be patient, and try to proactively meet user requirements and market fluctuations. In the long term, your business will grow and take your company to new heights of profitability, brand recognition and success.

The post 5 tips to improve the visibility of your website on the Internet appeared first on B6G.NET| for all information technology.