Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft subdomain takeover

cseo-coherence.microsoft.com

Post reply on HN
Print view View original

51–60 of 71 posts

Re: Microsoft subdomain takeover

#51

Post by idealmedtech »

ericpauley wrote: post #28

Security vulnerabilities due to resource reuse (subdomain takeover is just one example of this) are rampant and readily exploitable for tons of major companies, especially as cloud providers and SaaS often overlook these as being client responsibilities. Shameless plug, I’ve worked on identifying/characterizing these issues on cloud providers: https://arxiv.org/pdf/2204.05122.pdf It’s only a matter of time before adv…

About to take a whack at reading your paper, but in plain programmer speak, can you explain a few ways this might be exploited in the wild?

Re: Microsoft subdomain takeover

#52

Post by ericpauley »

idealmedtech wrote: post #51
ericpauley wrote: post #28

Security vulnerabilities due to resource reuse (subdomain takeover is just one example of this) are rampant and readily exploitable for tons of major companies, especially as cloud providers and SaaS often overlook these as being client responsibilities. Shameless plug, I’ve worked on identifying/characterizing these issues on cloud providers: https://arxiv.org/pdf/2204.05122.pdf It’s only a matter of time before adv…

About to take a whack at reading your paper, but in plain programmer speak, can you explain a few ways this might be exploited in the wild?

Biggest finding is that adversaries can easily allocate many IPs on public clouds. From this, automated traffic analysis can find what we call latent configurations (e.g., subdomain takeover) and exploit these. For instance you could allocate cloud IPs to collect SNS messages with PII to phish people, or receive passwords or data intended for other sites.

More high-level description here: https://pauley.me/post/2022/cloud-squatting/

Re: Microsoft subdomain takeover

#53

Post by idealmedtech »

ericpauley wrote: post #52
idealmedtech wrote: post #51

Earlier quoted context omitted.

About to take a whack at reading your paper, but in plain programmer speak, can you explain a few ways this might be exploited in the wild?

Biggest finding is that adversaries can easily allocate many IPs on public clouds. From this, automated traffic analysis can find what we call latent configurations (e.g., subdomain takeover) and exploit these. For instance you could allocate cloud IPs to collect SNS messages with PII to phish people, or receive passwords or data intended for other sites. More high-level description here: https://pauley.me/post/2022/…

That's so interesting! Giving me an idea for a side project that I'm sure has been done many times before :)

Re: Microsoft subdomain takeover

#56

Post by davchana »

chollida1 wrote: post #42

Can someone explain this? The link just 404's

Microsoft pointed abc.microsoft.com to GitHub pages through dns. That GitHub repo name was deleted; & eventually available back for anybody to get it. New user gets that repo name. Now new user publishes his content on that repo. Now if you type abc.microsoft.com you will see new user's content.

Re: Microsoft subdomain takeover

#58

Post by slaymaker1907 »

davchana wrote: post #56
chollida1 wrote: post #42

Can someone explain this? The link just 404's

Microsoft pointed abc.microsoft.com to GitHub pages through dns. That GitHub repo name was deleted; & eventually available back for anybody to get it. New user gets that repo name. Now new user publishes his content on that repo. Now if you type abc.microsoft.com you will see new user's content.

TIL why aka.ms/whatever is used redirects instead of having the redirect service be on a *.microsoft.com domain. Besides being shorter, I assume that this greatly reduces the risk for subdomain takeover as aka.ms shouldn’t have any associated cookies.

Re: Microsoft subdomain takeover

#60

Post by 0xfffafaCrash »

blitzd wrote: post #38
0xfffafaCrash wrote: post #21

Isn’t Truffle Security opening themselves up to litigation from this? It’s harmless, but is the risk of having Microsoft’s army of lawyers throw CFAA at you really worth this?

These takeovers are often just a case of finding stale DNS entries that are pointed at resources which can be re-allocated by third parties, i.e. elastic IP addresses on AWS. So it's very likely that the person had legit access to that IP, not their fault MS pointed a DNS entry at it when they did not control it.

Fair. I don’t think MS would have a great case in court, assuming the court was technically competent enough to understand the situation upon hearing the case, which is not an easy thing to assume, but I also think many applications of the CFAA (including e.g. the one against Aaron Swartz) also make little more sense when you get to the nuts and bolts of what actually happened. You don’t have to be in the wrong to be bankrupted by the costs of litigation against you from a corporation like Microsoft — not in the US justice system in any case.

Maybe I’m just risk averse here. I assume most of big tech with more legal weight than they know what to do with have about a 50/50 chance of having someone upstairs greenlighting legal to throw a tantrum even if it’s not in anyone’s best interests.

Maybe if this firm demonstrated an exploit of CORS headers elsewhere open to *.microsoft.com or something, they’d be on worse footing legally.

Post reply on HN