3 ms·
No This company never created the S3 buckets at all but set them in the CNAME, for domains that were purchased but never used They can change the CNAME at any
by vmception 5y ago
No
This company never created the S3 buckets at all but set them in the CNAME, for domains that were purchased but never used
They can change the CNAME at any time, it’s a pretty dumb but inconsequential exploit. Potentially some purchaser didn’t use generally free and default whois privacy and could be associated with offbrand content.
Potentially someone observant can earn a bunch of ad dollars on a popular domain.
- yellow_lead 5y agoI don't think it's as inconsequential as you say. Coinbase.ca and google.ar were two of these domains. The author noted that TLS certs could have been minted and then used in MITM attacks, if, for example, Coinbase began operating in Canada.