news

The comments on the article provide the actual answer to how this is happening. It sounds like there are DNS records that someone at these companies didn't clean up. The vulnerability is a "subdomain takeover"

szileaf Yesterday

As others pointed out, this is subdomain takeover [0]. Maybe add in the article to make it more clear? I got very confused while reading it as to what is going on, because it was not clear if it was a case of servers being hacked, somebody buying abandoned domains (have seen it in some phishing campaigns), subdomain takeover, or sth else.

But the main question is what are they trying to attempt? There do not seem to contain ads, the content is clickbait but bizarre, and I can see no obvious malicious attempt (I could miss sth, maybe steal parent domain's cookies?)

[0] https://developer.mozilla.org/en-US/docs/Web/Security/Subdomain_takeovers

Found this explanation at https://0xpatrik.com/subdomain-takeover-basics/ to be good:

Subdomain takeover is a process of registering a non-existing domain name to gain control over another domain. The most common scenario of this process follows:

• Domain name (e.g., sub.example.com) uses a CNAME record to another domain (e.g., sub.example.com CNAME anotherdomain.com).
• At some point in time, anotherdomain.com expires and is available for registration by anyone.
• Since the CNAME record is not deleted from example.com DNS zone, anyone who registers anotherdomain.com has full control over sub.example.com until the DNS record is present.

But I guess in general it's basically a company having an old DNS record that is pointing to an IP address (A or AAAA record) or domain name (CNAME record) that they no longer own.

So kind of stupid mistake to make I think?

But this kind of thing just confirms my feeling that the web and a lot of internet infrastructure is just too complex, easy to screw up, and built upon insecure technology.

If I was personally building some kind of internet service, I'd want to just provide a static IP address (so no DNS required) and use a very specific subset of the TLS protocol for security, version 1.3 only, specific ciphers only, specific X509 certificate features only.

I pity people who have to maintain web infrastructure and have to consider the intersection of all these different protocols and security problems. Would drive me crazy.