Identify Digital Assets Vulnerable to Subdomain Takeover

This post has been republished via RSS; it originally appeared at: Microsoft Tech Community - Latest Blogs - .

Subdomain takeover vulnerabilities are, in most cases, the result of an organization using an external service and letting it expire. However, that expired subdomain is still a part of the organization's external attack surface, with domain DNS entries pointing to it. An attacker could then claim this subdomain and take control of it with little to no effort, a considerable blow to an organization's security posture.

How does this happen? For example, a company might enlist a service desk provider, "FreshDesk.' It would point a subdomain like "support.mycompany.com" to FreshDesk and then claim this domain with the Freshdesk service to activate it. However, a problem arises when the organization abandons the service because they migrate to other services or for some other reason. Meanwhile, after the service agreement expires, the subdomain remains pointing to the FreshDesk platform.

While this might not seem bad initially, the risk of allowing attackers to execute scripts under the subdomain enables them to obtain data from the main website. The risk becomes even more significant when this scenario involves a service that handles PPI, PHI, or trade secrets. Microsoft Defender External Attack Surface Management continuously maps the external-facing resources across your organization's attack surface to identify, classify, and prioritize risks, including subdomain expiration and takeover.

MDEASM Is Purpose-Built to Detect Expired Subdomains

Microsoft Defender External Attack Surface Management discovers your organization's digital assets exposed to the Internet through its unique crawling and scanning capabilities. It maintains a complete inventory of the internet-facing resources connected to your organization and the unique attributes of each. It also offers the necessary tools to manage this inventory for different assets, including hosts, IP addresses, web pages, domains, IP blocks, ASNs, SSL Certs, and contacts.

MDEASM Inventory enables querying for all available attributes (over 200 currently) with multiple search operators, including "Expired Service" and "Service." A service is a hostname making use of a service. An expired service is a hostname (possibly susceptible to takeovers) that previously pointed to an active external service via DNS but now does not resolve.

 Customers should use these two inventory filters in tandem because when a rule is written for an "Expired Service" category component, a "Service" category component is written concurrently to show when a service in question was in use and when it expired. This way, customers will always have visibility into the statuses of the services they use and can easily detect the presence of a working or inactive service.

Try it yourself: In MDEASM, query your approved inventory using the "Expired Service" search operator. It will return all digital assets matching this search criterion:

You can select each one of these assets - Host (server, Web Page, or IP Address, to see its full asset details and view all the available data and history:

Below are some of the Web Component details for one of the above-searched assets:

You should now be able to query for hosts susceptible to a subdomain takeover attack and search all associated services and their current state. You can discover your attack surface discovery journey today for free.