Microsoft loses control over Windows Tiles subdomain

guest · Apr 17, 2019

Microsoft loses control over Windows Tiles
After the service has been disabled, we were able to take over the corresponding subdomain and display our own Tile contents.
April 17, 2019
https://www.golem.de/news/subdomain...s-control-over-windows-tiles-1904-140717.html

The Tiles service Microsoft introduced with Windows 8 has never been particularly successful. Microsoft has disabled a web service for the system but forgot to delete nameserver entries. This made the host vulnerable for a subdomain takeover attack - allowing us to control the contents. By doing so we were able to show arbitrary pictures and text within the tiles of other web pages.
Microsoft service converts RSS feed to Tiles
With a special XML-based file format, web pages can control the content of the tiles; for example, they can show the latest news. To make it easier for web pages to provide this function, Microsoft ran a service that automatically converted RSS feeds into that special XML format.
Azure subdomain could be re-registered
The takeover works via a so-called CNAME nameserver entry. It redirects all requests for the host to the unregistered Azure subdomain. With an ordinary Azure account, we were able to register that subdomain and add the corresponding host name. Thus we were able to control which content is served on that host.
Click to expand...

Microsoft does not answer
We have informed Microsoft about this problem but haven't received a reply yet. We won't keep the host registered permanently.
Once we cancel the subdomain a bad actor could register it and abuse it for malicious attacks.
Click to expand...

xxJackxx · Apr 17, 2019

Always be careful of what you let expire. The new owner gets all of the traffic to it. Domains, email addresses on those domains, etc.

mirimir · Apr 17, 2019

THat's just so funny

Log in or Sign up

Microsoft loses control over Windows Tiles subdomain

guest Guest

xxJackxx Registered Member

mirimir Registered Member

Log in or Sign up

Microsoft loses control over Windows Tiles subdomain

guest Guest

xxJackxx Registered Member

mirimir Registered Member

Useful Searches