A separate list of 117 Microsoft.com subdomains was also reportedly shared with ZDNet – which were also reported to Microsoft in 2019.<\/p>\n
He said that Microsoft largely ignored his reports while silently fixing some of the subdomains.<\/p>\n
How it works<\/strong><\/h3>\nSecurity researcher Szymon Gruszecki explained to Detectify<\/strong><\/a> how this hijacking works in 2014.<\/p>\n“Last year [I] performed a scan on [the] top 5,000 domain names from Alexa global rank and discovered 49 subdomains of different domains (that is ~1% of all ones) that point in CNAME records to not registered, forgotten domains or their subdomains,” said Gruszecki.<\/p>\n
“So in this case, if you want to own [a] not used subdomain just simply buy an expired domain name and configure its DNS zone.”<\/p>\n
He also showed an example where he implemented this with one such domain – racing.msn.com.<\/p>\n
![\"racinmsncom\"](\"https:\/\/mybroadband.co.za\/news\/wp-content\/uploads\/2020\/02\/racinmsncom-640x383.png\")
<\/a>Image via Detectify<\/p><\/div>\n
“Since the registration of msnbrickyardsweeps.com has expired, he could buy it and suddenly racing.msn.com starts showing his content since racing.msn.com has a CNAME record pointing to msnbrickyardsweeps.com,” explained Detectify.<\/p>\n
The exploit allows the new owner to set up emails using the racing.msn.com domain, and they can also receive all emails sent to addresses that use this domain.<\/p>\n
The new owner can also set up an SSL certificate on the subdomain – making the website appear more legitimate.<\/p>\n
Exploited in the wild<\/h3>\n
While this practice has been around for years, it is only recently that this exploit has been used against Microsoft in the wild.<\/p>\n
Gaschet highlighted on Twitter<\/strong><\/a> that an Indonesian Poker website was using this exploit.<\/p>\n <\/p>\n
\nhttps:\/\/t.co\/XAJfbsE4ht<\/a><\/p>\nThis kind of stuff, this is what you get by putting subdomain takeover out of scope, and don’t fix critical subdomain takeover from good peoples, rarely thanks them and generally not respond to them. Great job, @msftsecresponse<\/a> 👏<\/p>\n\u2014 Michel Gaschet (@Michel_Gaschet) February 18, 2020<\/a><\/p><\/blockquote>\n
“Last year [I] performed a scan on [the] top 5,000 domain names from Alexa global rank and discovered 49 subdomains of different domains (that is ~1% of all ones) that point in CNAME records to not registered, forgotten domains or their subdomains,” said Gruszecki.<\/p>\n
“So in this case, if you want to own [a] not used subdomain just simply buy an expired domain name and configure its DNS zone.”<\/p>\n
He also showed an example where he implemented this with one such domain – racing.msn.com.<\/p>\n
<\/a>Image via Detectify<\/p><\/div>\n
“Since the registration of msnbrickyardsweeps.com has expired, he could buy it and suddenly racing.msn.com starts showing his content since racing.msn.com has a CNAME record pointing to msnbrickyardsweeps.com,” explained Detectify.<\/p>\n
The exploit allows the new owner to set up emails using the racing.msn.com domain, and they can also receive all emails sent to addresses that use this domain.<\/p>\n
The new owner can also set up an SSL certificate on the subdomain – making the website appear more legitimate.<\/p>\n
Exploited in the wild<\/h3>\n
While this practice has been around for years, it is only recently that this exploit has been used against Microsoft in the wild.<\/p>\n
Gaschet highlighted on Twitter<\/strong><\/a> that an Indonesian Poker website was using this exploit.<\/p>\n <\/p>\n https:\/\/t.co\/XAJfbsE4ht<\/a><\/p>\n This kind of stuff, this is what you get by putting subdomain takeover out of scope, and don’t fix critical subdomain takeover from good peoples, rarely thanks them and generally not respond to them. Great job, @msftsecresponse<\/a> 👏<\/p>\n \u2014 Michel Gaschet (@Michel_Gaschet) February 18, 2020<\/a><\/p><\/blockquote>\n\n