Rampant CNAME misconfiguration leaves thousands of organizations open to subdomain takeover attacks

mood · Nov 25, 2020

Rampant CNAME misconfiguration leaves thousands of organizations open to subdomain takeover attacks – research
Security researchers discover more than 400,00 at-risk subdomains during an automated internet trawl
November 25, 2020
https://portswigger.net/daily-swig/...n-to-subdomain-takeover-attacks-nbsp-research

Security researchers have discovered more than 400,000 subdomains with misconfigured CNAME records, leaving many at risk of malicious takeover as a result.

When websites are externally hosted, the CNAME (Canonical Name) record is used to map their canonical domain and subdomains to the third-party host domain.
This means that the canonical, rather than host, domain appears in a browser’s address bar.

When a cloud hosted web page is deleted but the DNS entry pointing to the resource is retained, attackers can potentially re-register the host, add “the organization’s subdomain as an alias, and thus [control] what content is hosted”, explained Pinaki Mondal of India-headquartered security firm RedHunt Labs in a blog post.
Click to expand...

Unwieldy attack surface
The findings show that despite the potentially calamitous impact of subdomain takeovers, many well-resourced large organizations are struggling to comprehensively discover and track “their ever-expanding infrastructure”.

Roblox, Starbucks, and the US Department of Defense are among the organizations to remediate subdomain takeover flaws through HackerOne in the past year. However, “few reports” included exploits of “other web app functionalities”, noted Mondal.
Click to expand...

The Daily Swig has previously reported on subdomain takeover flaws stemming from the Live Tiles feature of Microsoft Windows 8, in 2019, and a misconfigured Microsoft subdomain in 2018.
Click to expand...

RedHunt Labs: Project Resonance Wave 1: Internet-Wide Analysis of Subdomain Takeover

This blog post is about one of our recent studies related to misconfigured CNAME records that can cause subdomain takeovers on a massive scale.
Click to expand...

Log in or Sign up

Rampant CNAME misconfiguration leaves thousands of organizations open to subdomain takeover attacks

mood Updates Team

Log in or Sign up

Rampant CNAME misconfiguration leaves thousands of organizations open to subdomain takeover attacks

mood Updates Team

Useful Searches