Researcher Hijacks a Microsoft Service Using Loophole in Azure Cloud Platform

A cybersecurity professional today demonstrated a long-known
unpatched weakness in Microsoft’s Azure cloud service by exploiting
it to take control over Windows Live Tiles, one of the key
features Microsoft built into Windows 8 operating system.

Introduced in Windows 8, the Live tiles feature was designed to
display content and notifications on the Start screen, allowing
users to continuously pull up-to-date information from their
favorite apps and websites.

To make it easier for websites to offer their content as Live
Tiles, Microsoft had a feature available on a subdomain of a
separate domain, i.e.,
“notifications.buildmypinnedsite.com,” that allowed website
admins to automatically convert their RSS feeds into a special XML
format and use it as a meta tag on their websites.

The service, which Microsoft had already shut down, was hosted on
its own Azure Cloud platform with the subdomain configured/linked
to an Azure account operated by the company.

However, it turns out that even after disabling the RSS-to-XML
converter service, the company forgot to delete nameserver entries,
leaving the unclaimed subdomain still pointing to the Azure
servers.

Hanno Böck, who discovered this
issue, seized this opportunity to exploit the weakness and
reclaimed the same subdomain using a newly created account on
Azure.
^[1]

Apparently, the indirect control over Microsoft’s subdomain
made it possible for him to push arbitrary content or notifications
on Windows Live Tiles of various app or websites that are still
using meta tags generated by the disabled service.

This technique is usually known as “subdomain takeover,” an
important attack vector that can usually be found in the way most
online services allow their users to run web apps or blogs with a
custom domain name.
For example, when you create an app on Azure and wants to make it
available on the Internet with a custom domain name, the platform
asks users to point their domain’s nameserver to Azure and then
claim it within their account’s dashboard, without verifying the
domain ownership.

Since Microsoft Azure does not have a mechanism to verify if the
account claiming a domain really owns it, any Azure user can claim
any unclaimed domain (or left unattended) that have nameservers
pointing to the cloud service.

Google’s Blogger service also had a similar issue, which the
company patched a few years ago by making it mandatory for every
blog owner to set a separate, unique TXT record for their custom
domains in order to verify the claim.

Though it seems Microsoft has now secured its subdomain by
removing the nameservers, The Hacker News reached out to Microsoft
to learn if the company has any plans to fix the “subdomain
takeover” issue in its Azure cloud service platform that could
eventually affect other domain users as well.

We will update this report when we hear back.