Abo
  • IT-Karriere:

Subdomain Takeover: Microsoft loses control over Windows Tiles

A service from Microsoft used to allow web page owners to deliver news on Windows Tiles as so-called Windows Live Tiles. After the service has been disabled, we were able to take over the corresponding subdomain and display our own Tile contents.

Artikel veröffentlicht am , Hanno Böck
Microsoft tried to introduce a new user interface with a tiled layout in Windows 7 but failed to impress the customers.
Microsoft tried to introduce a new user interface with a tiled layout in Windows 7 but failed to impress the customers. (Bild: Screenshot / Hanno Böck / Martin Wolf)

The Tiles service Microsoft introduced with Windows 8 has never been particularly successful. Microsoft has disabled a web service for the system but forgot to delete nameserver entries. This made the host vulnerable for a subdomain takeover attack - allowing us to control the contents. By doing so we were able to show arbitrary pictures and text within the tiles of other web pages.

Stellenmarkt
  1. Mey GmbH & Co. KG, Albstadt-Lautlingen
  2. Modis GmbH, Köln

The tiles can fullfil a number of functions. They allow web pages to display news on the tiles with a special meta tag. This function is called Windows Live Tiles. Web pages which support this service can be pinned as a tile.

Microsoft service converts RSS feed to Tiles

With a special XML-based file format, web pages can control the content of the tiles; for example, they can show the latest news. To make it easier for web pages to provide this function, Microsoft ran a service that automatically converted RSS feeds into that special XML format.

The web page that allows creating the corresponding meta tags is still online, although the service no longer works. The host that should deliver the XML files - notifications.buildmypinnedsite.com - only showed an error message from Microsoft's cloud service Azure.

The abandoned host was vulnerable for a so-called subdomain takeover attack. The host was redirected to a subdomain of Azure. However this subdomain wasn't registered with Azure.

Azure subdomain could be re-registered

The takeover works via a so-called CNAME nameserver entry. It redirects all requests for the host to the unregistered Azure subdomain. With an ordinary Azure account, we were able to register that subdomain and add the corresponding host name. Thus we were able to control which content is served on that host.

Web pages using the defunct service from Microsoft included the Russian mail provider Mail.ru, Engadget, and German news sites Heise Online and Giga. Web pages that include these meta tags should remove them or, if they want to keep the functionality, create the corresponding XML files themselves.

Microsoft does not answer

We have informed Microsoft about this problem but haven't received a reply yet. We won't keep the host registered permanently. There's a decent amount of traffic reaching this host and running up costs to hold the domain and block the corresponding subdomain even if we stop the web service and don't provide any content. Once we cancel the subdomain a bad actor could register it and abuse it for malicious attacks.

Windows Tiles were introduced on the start screen of Windows 8 and moved to the start menu in Windows 10. They have never been particularly popular. The web page Windowscentral speculated in January that the Tiles may be deprecated soon. The upcoming Windows Lite is rumored to come without Tiles already.

Update from April 18th, 11:56

Microsoft has now deleted the nameserver record and we no longer control the subdomain. We still haven't received a reply from Microsoft.



Anzeige
Top-Angebote
  1. (u. a. Conan Exiles 12,99€, PSN Card 25 Euro für 21,99€)
  2. 229,99€
  3. 5,55€
  4. (u. a. GRAND THEFT AUTO V: PREMIUM ONLINE EDITION 13,99€, Shadows: Awakening 12,50€)

bst (golem.de) 17. Apr 2019

Hallo, wenn wir eine internationale Relevanz sehen, stellen wir ausgewählte Exklusiv...

FaDam 17. Apr 2019

Means, whats a nice Service to embedd in this tiles. Post your Ideas. A weather tile for...


Folgen Sie uns
       


ANC-Kopfhörer im Lautstärkevergleich

Wir haben Microsofts Surface Headphones und die Jabra Elite 85h bei der ANC-Leistung verglichen. Für einen besseren Vergleich zeigen wir auch die besonders leistungsfähigen ANC-Kopfhörer von Sony und Bose, die WH-1000XM3 und die Quiet Comfort 35 II.

ANC-Kopfhörer im Lautstärkevergleich Video aufrufen
Mobile-Games-Auslese: Magischer Dieb trifft mogelnden Doktor
Mobile-Games-Auslese
Magischer Dieb trifft mogelnden Doktor

Ein Dieb mit Dolch in Daggerhood, dazu ein (historisch verbürgter) Arzt in Astrologaster sowie wunderschön aufbereitetes Free-to-Play-Mittelalter in Marginalia Hero: Golem.de stellt die spannendsten neuen Mobile Games vor.
Von Rainer Sigl

  1. Hyper Casual Games 30 Sekunden spielen, 30 Sekunden Werbung
  2. Mobile-Games-Auslese Rollenspiel-Frühling mit leichten Schusswechseln
  3. Gaming Apple Arcade wird Spiele-Flatrate für iOS und MacOS

Ocean Discovery X Prize: Autonome Fraunhofer-Roboter erforschen die Tiefsee
Ocean Discovery X Prize
Autonome Fraunhofer-Roboter erforschen die Tiefsee

Öffentliche Vergaberichtlinien und agile Arbeitsweise: Die Teilnahme am Ocean Discovery X Prize war nicht einfach für die Forscher des Fraunhofer Instituts IOSB. Deren autonome Tauchroboter zur Tiefseekartierung schafften es unter die besten fünf weltweit.
Ein Bericht von Werner Pluta

  1. JAB Code Bunter Barcode gegen Fälschungen

Ada und Spark: Mehr Sicherheit durch bessere Programmiersprachen
Ada und Spark
Mehr Sicherheit durch bessere Programmiersprachen

Viele Sicherheitslücken in Software sind auf Programmierfehler zurückzuführen. Diese Fehler lassen sich aber vermeiden - und zwar unter anderem durch die Wahl einer guten Programmiersprache. Ada und Spark gehören dazu, leider sind sie immer noch wenig bekannt.
Von Johannes Kanig

  1. Das andere How-to Deutsch lernen für Programmierer
  2. Programmiersprachen, Pakete, IDEs So steigen Entwickler in Machine Learning ein
  3. Software-Entwickler Welche Programmiersprache soll ich lernen?

    •  /