#SubdomainHijacking

[osintelligence]

https://bit.ly/45Ua6ba - 🌐 Subdomain Hijacking is a rising concern where attackers gain control of websites on subdomains of reputable organizations. This allows them to distribute malware, spread disinformation, launch phishing attacks, and execute social engineering campaigns. The increase in cloud service adoption has amplified this vulnerability. #SubdomainHijacking #CybersecurityThreat 🔍 Certitude Consulting identified over 1,000 organizations at risk, including the Australian Department of Foreign Affairs and Trade, CNN, Stanford University, and FPÖ. The actual number of affected domains could be much higher. The implications of a subdomain takeover are vast, from malware distribution to manipulating public opinion. #CertitudeConsulting #DigitalVulnerability 🛡️ To mitigate potential threats, Certitude Consulting has proactively taken control of websites from particularly vulnerable organizations, informing them of the risk. Affected entities include government, party, university, and media websites, such as the Australian Department of Foreign Affairs and Trade, the UK Meteorological Office, and the US states of Rhode Island and Nebraska. #ProactiveSecurity #DigitalProtection 📚 Subdomain Hijacking occurs when a domain or subdomain linked to a specific cloud service becomes "dangling" after the service is no longer in use. Attackers can then register an account on the cloud platform, linking it to these dangling DNS records, effectively taking over the subdomain. #DNSVulnerability #CloudSecurity 🛠️ Preventive measures include regular DNS record audits and deactivating cloud resources only after associated DNS records are removed. Cloud service providers can also prevent hijacking by verifying domain ownership and not immediately releasing previously used identifiers. While Microsoft has implemented such measures for Azure Storage Accounts, other providers like Amazon Web Services have yet to do so. #PreventionMeasures #CloudServiceSafety 🔬 Certitude Consulting's research methods and specific vulnerability details will remain undisclosed for now. All highlighted organizations have been informed, and coordination with the Austrian CERT is ongoing.