this post was submitted on 27 Feb 2024
70 points (100.0% liked)

Technology

58303 readers
19 users here now

This is a most excellent place for technology news and articles.

Our Rules

  1. Follow the lemmy.world rules.
  2. Only tech related content.
  3. Be excellent to each another!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, to ask if your bot can be added please contact us.
  9. Check for duplicates before posting, duplicates may be removed

Approved Bots

founded 1 year ago
MODERATORS
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
70
Guardio Uncovers Large-Scale "SubdoMailing" Campaign Abusing Well-known Brands (MSN, VMware, McAfee, etc.) (labs.guard.io)
submitted 8 months ago by [email protected] to c/[email protected]
4 comments fedilink hide all child comments
 

Researchers at Guardio Labs discovered a vast campaign hijacking thousands of subdomains belonging to well-known brands (MSN, VMware, McAfee, The Economist, Cornell University, CBS, Marvel, eBay, etc.).

The attackers use these compromised subdomains to send millions of spammy and malicious emails daily, bypassing security measures by leveraging the trust associated with the hijacked brands.

Here's how it works:

  • Attackers hijack subdomains of established brands through various methods like complex DNS manipulation and exploiting abandoned domains.
  • They manipulate the hijacked subdomains' SPF records to make emails appear as if they originated from the legitimate brands.
  • These emails often contain deceptive content like fake cloud storage warnings, phishing attempts, or misleading advertisements.

The campaign is alarming for several reasons:

  • The scale: Over 8,000 domains have been compromised, and the number is growing.
  • The potential harm: Millions of spam and malicious emails are being sent daily.
you are viewing a single comment's thread
view the rest of the comments
[–] [email protected] 12 points 8 months ago (1 children)

There's nothing "complex" about any of this... they just go looking for subdomains that were CNAME'd one upon a time to domains which are now abandoned (eg. marthastewart.msn.com -> msnmarthastewartsweeps.com). So they register the domain, set its DNS records, and then can verify SMTP as the subdomain as well.

There's no DNS vulnerability or anything, just large organizations with subdomains slipping through the cracks. It will take a while to be resolved too because we're probably talking hundreds of records in each case that need to be checked manually.

[–] [email protected] 4 points 8 months ago (1 children)

need to be checked manually

You're joking if you think that this couldn't be scripted to a significant degree.

CNAMEs, where whatever it resolves to is an external site, where the external does not respond to ping or where the external site's WHOIS/ICANN records were updated or created in the last year. Filter out records that match known partners/vendors.

Adjust specifics as makes sense and you cut the problem space significantly. The final steps will still need human verification, but there's no need for this to be manual checks of literal hundreds of records.

[–] [email protected] 2 points 8 months ago (1 children)

That's cute.

  • Assuming all DNS records are in one place.
  • "External site" means nothing.
  • Ping response means nothing.
  • Register date means nothing.
  • Known partners/vendors takes time.

In a large organization it will take months to track down all this stuff to make sure a subdomain should or should not be there, pointing at a domain that should or should not be there.

Nobody will risk taking anything down with multi-million dollar advertising campaigns potentially riding on each one. If you're not familiar with how these campaigns work, they work like hot shit: they pay everything in advance and then put together all the technical details. Sometimes literally the night before the campaign is supposed to begin.

So what you see now in DNS may be obsolete, or it may be valid, or it may be from an upcoming campaign. Gotta dig through contracts and crawl the corporate structure to figure it out.

Also, there's no big enough incentive to fix this. Spam for third parties? Eh, fuck 'em. Until it grows into something bad enough for the FBI to get involved they won't care.

[–] [email protected] 0 points 8 months ago

Nobody will risk taking anything down

Anyone who hasn't worked in enterprise simply doesn't understand this aversion to risk. Above all else, don't break something.

Too many techies think "well, then we'll fix it". Umm, no.