I incidentally learned about another DNS issue at the same time.
Hi Omri, I got your email about Subdomain Takeover issue on: xxxxxxxx.
The company that ran the domain does not exist anymore. However, I sincerely appreciate your work bringing this to my attention. I’m sorry I can’t send more than a small token of my thanks.
https://arxiv.org/pdf/2204.05122
Clouds providing elastic computing assign IP addresses (or IPs) from a shared pool. An IP address can be used by a deployed server instance and referenced by managed cloud services (e.g., server-to-server messaging), third-party applications deployed by the tenant (e.g., using the deployed server as a database or computer resource), or directly configured in Domain Name System (DNS) records. Importantly, when the service is decommissioned, the IP is released and may be reallocated to other tenants [4]. This decommissioning process and shared IP architecture causes a vulnerability: configurations (e.g., dangling DNS [5]) that are not updated in tandem with the decommissioning process will continue to refer to the (now obsolete) IP.
Preventing misconfiguration. Classical web service models often relied on static IPs assigned to services [63], with longlived configuration such as DNS referencing these addresses. In public clouds, this assumption can break down to the detriment of security. When designing services on public clouds, care should be taken to ensure that references to service IPs are either managed by the cloud provider (i.e., the cloud provider resolves a unique resource, such as a domain name, to an IP address while ensuring latent configuration is prevented), or some configuration manager or policy. In each case, cloud providers also have the opportunity to encourage best practices and alert tenants when latent configuration exists.
https://cheatsheetseries.owasp.org/cheatsheets/Subdomain_Takeover_Prevention_Cheat_Sheet.html
- Track DNS zone changes. Use version-controlled DNS management (e.g., Terraform, OctoDNS, or DNSControl) so all record additions and removals are reviewed, approved, and logged. This also creates an audit trail for investigating how a dangling record was introduced.
https://blog.adobe.com/security/researcher-qa-friends-who-work-together-hack-better-together
lessons learned
- keep old email addresses live
- have some mechanism for cloud server to set the IP instead of manually, so I can’t forget to update it somewhere