Researchers Find 670+ Microsoft Subdomains Vulnerable to Takeover

The now-fixed flaw could have enabled attackers to trick users into downloading malicious content or sharing credentials.

Dark Reading Staff, Dark Reading

March 6, 2020

1 Min Read
Dark Reading logo in a gray background | Dark Reading

Security researchers discovered more than 670 Microsoft subdomains vulnerable to account takeover, potentially giving attackers the ability to trick users into sharing their usernames and passwords or downloading malicious files.

Subdomain takeover occurs when a subdomain can be controlled by anyone other than system admins, explain Numan Ozdemir and Ozan Agdepe of security alert service Vullnerability, in a blog post. This can happen due to expired hosting services or DNS misconfigurations, and it can allow an adversary to upload files, create databases, track data traffic, or create a clone of a primary website. If a subdomain seems legitimate, users will likely enter their information.

This discovery means attackers could have potentially accessed the subdomains of hundreds of Microsoft services and used them in phishing and malware campaigns. Victims can't tell whether a subdomain has been compromised. As a result, if they visit a hijacked subdomain and are prompted to enter their credentials or download a malicious file, they'll likely do it.

Ozdemir and Agdepe created an automated system to scan all subdomains of some Microsoft domains and found the vulnerable subdomains. These included identityhelp.microsoft.com, mybrowser.microsoft.com, web.visualstudio.com, and dev.social.microsoft.com, among others. The researchers shared their findings with Microsoft, which fixed the affected subdomains.

Read more details here.

Edgepromohorizontal.jpgCheck out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's featured story: "The Perfect Travel Security Policy for a Globe-Trotting Laptop."

About the Author

Dark Reading Staff

Dark Reading

Dark Reading is a leading cybersecurity media site.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like


More Insights