Cybersecurity has become one of the top priorities of organizations in the past few years. By now, many are aware and have witnessed the impact of a weak cybersecurity posture, regardless of their company size. Some cybercrime victims have paid thousands and even millions of dollars in penalties, while others have suffered from loss of sensitive information. Worst of all, their organizations reputation was damaged, which could take years to rebuild.
An effective way to strengthen your cybersecurity posture is to look at all possible attack vectors or vulnerabilitiesincluding subdomains. In this post, we tackled how you can bolster your cybersecurity strategies when you search for subdomains. But first, let us discuss briefly how dangerous subdomain takeover or hijacking can be.
The Dangers of Subdomain Takeovers
An organization almost always has several subdomains for different purposes. For instance, you can dedicate the subdomain blog[.]example[.]com to host your blog, while shop[.]example[.]com can host your online shop. In most instances, you may also have subdomains for external services, such as example[.]zendesk[.]com and example[.]etsy[.]com.
The danger lies when these subdomains are no longer used but remain in the Domain Name System (DNS).
Consider the scenario where shop[.]example[.]com is configured to redirect to example[.]etsy[.]com in their DNS records. Threat actors can easily claim the unused or expired example[.]etsy[.]com domain by creating an Etsy account. As a result, they would have control over shop[.]example[.]com since the DNS records were not changed. Threat actors could then do almost everything, such as creating a fake login page that steals user credentials or hosting malware.
Also checkout this article by Hackedu on how to create a successful secure coding training plan.
Monitor and Secure Subdomains
A subdomain lookup tool like https://subdomains.whoisxmlapi.com/ can help you search for subdomains so you can create an inventory. By monitoring your subdomains, you can see which ones need updating and securing. Let us cite Microsoft as an example. The company has thousands of subdomains, according to Subdomains Lookup, which displayed at least 10,000 subdomains.
With this huge inventory, Microsoft would need to monitor and update their DNS records constantly. In fact, a security researcher found several Microsoft subdomains that are vulnerable to subdomain hijacking or takeover. Some of these were used by threat actors to host spammy content, although Microsoft immediately took actions to correct the errors.
Find Forgotten Subdomains
When you search for subdomains, you may also stumble upon unused and forgotten ones, which are also vulnerable to attacks. An example is the subdomain paypalsupport[.]zendesk[.]com, which has not been updated recently. Visiting the subdomain also leads to a nonexistent page.
It is essential to search for subdomains and ensure that these are not vulnerable to hijacking and other malicious attacks.
Find Typosquatting Subdomains
Threat actors are also known to use legitimate company or brand names in subdomains to make them look reputable and believable. When you search for subdomains, it would be wise to include those that you dont own or manage using a subdomain discovery tool.
A study focused on the subdomains of 10 of the most-imitated brands today and found that only an average of 0.64% of the subdomains that contained the companys brand names could be publicly attributed to them.
The remaining 99.36% were owned and controlled by other entities, which could include threat actors. In fact, about 14,719 of the subdomains in the study were found on PhishTank.
—
With the current cybersecurity landscape, organizations cant afford to leave any possible vulnerability unturned. Including subdomain search and monitoring could help strengthen their overall cybersecurity posture and help them avoid subdomain takeovers and other cyber attacks that stem from them.