Microsoft has a subdomain hijacking problem

guest · Feb 18, 2020

Microsoft has a subdomain hijacking problem
February 18, 2020
https://www.zdnet.com/article/microsoft-has-a-subdomain-hijacking-problem/

A security researcher has pointed out today that Microsoft has a problem in managing its thousands of subdomains, many of which can be hijacked and used for attacks against users, its employees, or for showing spammy content.

The issue has been brought up today by Michel Gaschet, a security researcher and a developer for NIC.gp.
In an interview with ZDNet, Gaschet said that during the past three years, he's been reporting subdomains with misconfigured DNS records to Microsoft, but the company has either been ignoring reports or silently securing some subdomains, but not all.
RESEARCHER: ONLY 5%-10% GOT FIXED
Gaschet says he reported 21 msn.com subdomains that were vulnerable to hijacks to Microsoft in 2017 [1, 2], and then another 142 misconfigured microsoft.com subdomains in 2019 [1, 2].
BLAME DNS MISCONFIGURATIONS
Gaschet told ZDNet the OS maker usually fixes big subdomains, like cloud.microsoft.com and account.dpedge.microsoft.com, but leaves the other subdomains exposed to hijacks.
Click to expand...

SUBDOMAIN HIJACKS LEAD TO SPAM ON MICROSOFT.COM
But until now, these misconfigurations have never caused Microsoft any problems or headaches, despite being an attractive attack surface.
Luckily, no dangerous threat groups have noticed this problem.

Sadly, others have.
Today, Gaschet pointed out on Twitter that at least one spam group has figured out they could hijack Microsoft's subdomains and boost their spammy content by hosting it on a reputable domain.
Click to expand...

Gaschet says he spotted ads for Indonesian poker casinos on at least four legitimate Microsoft subdomains. These include portal.ds.microsoft.com, perfect10.microsoft.com, ies.global.microsoft.com, and blog-ambassadors.microsoft.com.

The spammy ads are still live at the time of writing.
Click to expand...

guest · Mar 4, 2020

Download this update from mybrowser.microsoft.com. Oh, sorry, that was malware on a hijacked sub-domain. Oops
Lax DNS leaves door wide open for miscreants to impersonate Windows giant on its own websites
March 4, 2020
https://www.theregister.co.uk/2020/03/04/microsoft_subdomain_takeover/

If you saw a link to mybrowser.microsoft.com, would you have trusted it? Downloaded and installed an Edge update from it? How about identityhelp.microsoft.com to change your password?

Now, as we said, Microsoft has loads of these sub-domains, and after a while it just stops updating some of them and abandons them. [...] for example, mybrowser.microsoft.com would still point to webserver9000.azurewebsites.net even though the server instance handling it was long since shut down.
This is where the miscreants swoop in. They get an Azure account, and spin up a web server instance, and request the hostname webserver9000, or webserver9000.azurewebsites.net in its full form.

"An attacker can upload his own files, create his own databases, track traffic, and create a clone of the main website," Ozdemir and Agdepe explained in an advisory seen by The Register earlier this week ahead of its publication today.
Microsoft's response is concerning. It has known about this danger for ages, yet persists with lax DNS management, and has refused to pay out bug bounties for the issue.
"They can detect those vulnerabilities by comparing DNS records and HTTP responses, just as we did."
Click to expand...

670+ Subdomains of Microsoft are Vulnerable to Takeover (Lead to Account Takeover)

If a subdomain is vulnerable to controlling by another persons excluding system authorities, its called as subdomain takeover. It may happen because of expired hosting services or DNS misconfigurations. Attacker will has full-privilege on the system after tookover the subdomain.
How We Discovered 670+ Vulnerable Subdomains of Microsoft?
Our automated system scanned all subdomains of some Microsoft domains and found hundreds of vulnerable subdomains in a short time.

This article written just for educational purpose and show the dangers about a potential subdomain takeover attacks. Subdomains are ethically reported to Microsoft and fixed in a short time. It is not aiming an illegal activity.
Click to expand...

Log in or Sign up

Microsoft has a subdomain hijacking problem

guest Guest

guest Guest

Log in or Sign up

Microsoft has a subdomain hijacking problem

guest Guest

guest Guest

Useful Searches