Research: Hundreds of high-traffic web domains vulnerable to same-site attacks

guest · Aug 12, 2021

Research: Hundreds of high-traffic web domains vulnerable to same-site attacks
‘The same-site security boundary is becoming more and more relevant’
August 12, 2021
https://portswigger.net/daily-swig/...c-web-domains-vulnerable-to-same-site-attacks

The underrated threat of related-domain attacks can enable malicious actors to circumvent many advanced website protection mechanisms, a group of researchers at the Technical University of Vienna (TU Wien) have found.

Published in a paper (PDF) that was presented at the annual Usenix Security Symposium this week, the researchers’ findings show that more than 800 high-traffic websites could be compromised through other sites hosted on a related domain.
Click to expand...

One key vulnerability vector is dangling DNS records, records in the authoritative DNS servers of a domain that point to expired resources that can be acquired by an adversary.

“The most common cause of a takeover vulnerability is due to dangling records,” Squarcina said.
“As an example, consider a subdomain of example.org, like foo.example.org, pointing to an expired domain name (e.g., fooexample.org) via a CNAME DNS entry. Attackers could simply register fooexample.org to fully control the page served at foo.example.org.”

In their paper, the researchers also explore subdomain hijacking on corporate networks and roaming services, hosting providers and dynamic DNS services, and compromised hosts and websites.
Click to expand...

Vulnerable domains
In their research, Squarcina and his colleagues examined the top 50,000 domains in the Tranco list.

According to their findings, 15% of these domains were vulnerable. The researchers found subdomain takeover vulnerabilities on news websites like cnn.com and time.com, university portals like harvard.edu and mit.edu, government websites like europa.eu and nih.gov, and IT companies like lenovo.com and cisco.com.

“Overall, we identified 887 sites among the top 50,000 with takeover vulnerabilities,” Squarcina said.
Click to expand...

Paper: Can I Take Your Subdomain? Exploring Same-Site Attacks in the Modern Web
(PDF): https://www.usenix.org/system/files/sec21-squarcina.pdf

Log in or Sign up

Research: Hundreds of high-traffic web domains vulnerable to same-site attacks

guest Guest

Log in or Sign up

Research: Hundreds of high-traffic web domains vulnerable to same-site attacks

guest Guest

Useful Searches