Security News > 2020 > March > Researcher finds 670 Microsoft subdomains vulnerable to takeover
The CNAME points to a subdomain on a hosting service like Azure, which allows users to create websites using subdomains of.
No verification, no alert to Microsoft that one of their old subdomains has been taken over, and no easy way for enterprise security systems to detect that this apparently legit domain is anything but.
Our team claimed some of those critical subdomains before attackers and reported them ethically to Microsoft.
The issue of subdomain takeover has been around for years and can affect subdomains belonging to any company on any cloud platform and not only Microsoft's.
The issue of vulnerable Microsoft subdomains is becoming an ongoing theme with a separate researcher, Michel Gaschet, finding and reporting another 280 in this state between 2017 and 2019.