Hacker News Reader

>Domain like "abcde.teams.microsoft.com" has a CNAME that points to a domain like "abcde.microsoft-teams.com", but "microsoft-teams.com" is no longer registered to or controlled by Microsoft.

Can you elaborate a bit on this? I get that these are example domains, but why would "abcde.teams.microsoft.com" (which is presumably controlled by Microsoft) point to a domain "microsoft-teams.com" that is not controlled by Microsoft? Was that a mistake on Microsoft's part, or did the attackers do something clever to gain control of that domain/point a Microsoft-owned subdomain to the attacker's domain?

Yup, in my hypothetical example, at some point "microsoft-teams.com" was registered by Microsoft. At that time, some engineer deployed something that involved the CNAME. Over time, "microsoft-teams.com" was moved elsewhere and the domain became unregistered, but the engineer maybe forgot or left the team, and nobody remembered that there's this out of date "abcde.teams.microsoft.com" DNS record just sitting there.

Microsoft has a lot of these, just random Microsoft-ish domains that were used at one point or another. It's a problem because it makes it harder to look at the domain name as a sanity check against phishing.

Microsoft and other large companies are made up of many smaller groups, and to make this work there are a lot of extra rules. For the most part those rules serve a purpose and the benefit outweighs the cost. Sometimes these rules create extra problems, because of how people actually make choices and use the resulting system.

It is likely there is a detailed change approval process for updating a *.microsoft.com DNS record. Or that only certain depts can make changes, and only for certain reasons. Someone involved with Teams avoided that by using a separate domain and a cname record, then they could update their separate domain records more easily. Later someone forgot to register this domain, and/or forgot to update the DNS to somewhere that is over their control, or forgot to put in sufficient checks to prevent tokens being shared with unauthorized servers.

I don't think you got it quite right. No one would ever see microsoft-teams.com and you wouldn't need an SSL cert for it. The CNAME affects the DNS lookup, so if you ask "where's abcde.teams.microsoft.com", the server replies "it's at the same IP as "microsoft-teams.com, so go look there".

Since you control the DNS for microsoft-teams.com, you can point it to your server. Now both domains point at your server and you get all requests to abcde.teams.microsoft.com. That's how they get cookies.

You can get an SSL certificate because you can serve anything for abcde.teams.microsoft.com. That includes abcde.teams.microsoft.com/.well-known/acme-challenge/* and the .gif (or other) resource you use to steal cookies.

Either abcde.microsoft-teams.com is a typo or you seem to think CNAMEs work like an HTTP redirect, which they don't.

Aha! Thank you munchbunny. Another title for this article could be "How some major tech companies DNS record management practices left your organization vulnerable to attack". This is a great lesson for all of us. Leaving old records in DNS is so easy to do.

> I'd bet that plenty of whitehats and blackhats have bots automatically crawling domains belonging to tech companies searching for subdomain takeover opportunities.

If Microsoft had one of these, they could've caught this before it was exploited.