UnRegister Me: hunting and securing user registration vulnerabilities

Why Registration Bugs Matter

A Microsoft senior red teamer shares field notes on authentication and authorization flaws rooted in user registration across web and mobile apps. Because registration is the weakest entry point, these bugs often yield account takeover without traditional privilege escalation.

OTP and Identity Assumptions

The talk dissects phone-number OTP flows where email is collected but never verified. Attackers register high-value emails like executive addresses using their own phone, exploiting users' tendency to trust email identities over phone numbers in chat and collaboration apps.

Chaining Low-Severity Issues

A case study shows registration returning a long-lived pin, an active post-registration endpoint, and an API that leaks authentication tokens. Chained together, an attacker maintains persistent access even after the victim resets credentials via forgot-password.

Pre-Registration Account Takeover

The speaker introduces pre-registration ATO: controlling an account slot before the legitimate user arrives. Manual hunting produces little noise and evades typical detection because activity resembles legitimate user behavior. Fixes require email verification, disabling registration endpoints after signup, and never returning sensitive tokens.