Registrar, subdomain and CDN compromise¶

Attack pattern¶

Everything below a domain depends on the account that holds it. Change the NS records at the registrar and the whole zone moves, with nothing further down needing to be touched. That account is usually protected by a password, a second factor that is often still a text message, and a support desk that exists to help people who have lost both. Subdomain takeover is the same lesson at smaller scale and lower cost: a CNAME left pointing at a cloud resource that was deleted is a claim nobody withdrew, and claiming the resource claims the name. What follows is a domain-validated certificate, issued in minutes, because control of a name is precisely what that certificate attests.

1. Supply Chain Attacks [OR]

    1.1 Registrar Hijacking [OR]

        1.1.1 API Key Compromise [OR]
            1.1.1.1 Cloudflare token theft
            1.1.1.2 AWS Route 53 key leakage
            1.1.1.3 Google Domains API abuse

        1.1.2 Social Engineering [OR]
            1.1.2.1 Registrar support impersonation
            1.1.2.2 Post-GDPR WHOIS information gaps
            1.1.2.3 Phone number porting attacks

        1.1.3 Registry System Attacks [OR]
            1.1.3.1 EPP protocol exploitation
            1.1.3.2 Registry lock bypass
            1.1.3.3 Transfer process manipulation

    1.2 Subdomain Takeover [AND]

        1.2.1 Dangling Resource Identification [OR]
            1.2.1.1 CNAME mapping to unused cloud resources
            1.2.1.2 NS record pointing to decommissioned servers
            1.2.1.3 MX record targeting disabled services

        1.2.2 Malicious Content Deployment [OR]
            1.2.2.1 GitHub Pages site cloning
            1.2.2.2 S3 bucket takeover
            1.2.2.3 Azure Blob Storage hijacking

        1.2.3 Persistence Mechanisms [OR]
            1.2.3.1 SSL certificate procurement
            1.2.3.2 DNS record obfuscation
            1.2.3.3 Monitoring evasion techniques

    1.3 CDN Compromise [OR]

        1.3.1 DNS-Based CDN Manipulation [OR]
            1.3.1.1 Edge server cache poisoning
            1.3.1.2 Origin DNS spoofing
            1.3.1.3 GeoDNS manipulation

        1.3.2 Certificate Manipulation [OR]
            1.3.2.1 SAN certificate abuse
            1.3.2.2 CDN SSL termination bypass
            1.3.2.3 Multi-CDN configuration conflicts

Control of the name is control of everything under it¶

A registrar account is the root of the zone. Moving the NS records moves the domain, and no record inside it needs editing.
Registry lock is the control that stops an unauthorised transfer, and it is more often talked past than broken.
A dangling CNAME is a claim nobody withdrew. The cloud resource was deleted; the record pointing at it survived the cleanup.
Domain-validated certificates attest control of a name rather than ownership of it, so a takeover produces a valid padlock within minutes of claiming the resource.
Redacted WHOIS cuts both ways. It removes the contact detail an impersonator would use, and the detail a registrar would verify against.
Text messages remain a common second factor on registrar accounts, and porting a number costs less than any attack on the protocol.