4 ms·

Shopify Subdomain Takeovers

4 points by alexandrfox 3y ago

Per the tin. Looks like a coordinated "attack" on Shopify customers. Malicious entities are spinning up various fake shops under the "ftp" CNAME that is quite regularly auto-provisioned by various registrars. No validation needed! Google Search Console access included! Similar (same?) vulnerability was reported to Shopify in 2018 and it's still there: https://medium.com/@thebuckhacker/how-to-do-55-000-subdomain-takeover-in-a-blink-of-an-eye-a94954c3fc75 Whilst I get that it's not necessarily a Shopify's fault that people leave dangling records I'd expect more from a company that offers a no-code solution. 1) https://support.google.com/webmasters/thread/257728643/unknown-person-added-themselves-as-owner-of-my-domain-in-search-console 2) https://support.google.com/webmasters/thread/258587184/subdomain-hacking-and-new-owner 3) https://www.reddit.com/r/shopify/comments/19dd6p6/my_shopify_stores_ftp_has_been_hijacked_any_ideas/ 4) https://community.shopify.com/c/shopify-discussions/help-unidentified-person-added-as-owner/m-p/2435684

Exuma 3y ago
So how does it actually work? The article is so poorly written I don’t understand the exact mechanism that would allow this
- alexandrfox 3y ago
  Quite simple really. Imagine you buy a domain (e.g. foo.com) and park it on some popular registrar. Many of those create a few "CNAME" DNS records like ftp.foo.com, mail.foo.com, etc. by default. Then you decide to use Shopify with this domain you bought, so you modify its "A" DNS record to point to Shopify's IP address. Boom, you're now susceptible to this "attack" -- >anyone< can go ahead and register a Shopify account and attach one of your dangling subdomains to it!
  - Exuma 3y ago
    But why would shopify ever treat a subdomain as an entirely separate store outside of the main domain? That makes no sense. If i register xyz.example.com as my store, then that should just be in my ONE account which verifies example.com, then by adding a second store, i can only add it as a subdomain from that main account, not just an entirely separate account. Or, lets say its a separate account, then it should make me add records from that NEW account, even if there are already existing records. So i still dont understand how this is possible
    - alexandrfox 3y ago
      Yes, that makes no sense, but that's how it is, because Shopify allows it. My friend's subdomain got taken over like that just a couple weeks ago.

4 points by alexandrfox 3y ago

Exuma 3y ago

So how does it actually work? The article is so poorly written I don’t understand the exact mechanism that would allow this

alexandrfox 3y ago
Quite simple really. Imagine you buy a domain (e.g. foo.com) and park it on some popular registrar. Many of those create a few "CNAME" DNS records like ftp.foo.com, mail.foo.com, etc. by default. Then you decide to use Shopify with this domain you bought, so you modify its "A" DNS record to point to Shopify's IP address. Boom, you're now susceptible to this "attack" -- >anyone< can go ahead and register a Shopify account and attach one of your dangling subdomains to it!
- Exuma 3y ago
  But why would shopify ever treat a subdomain as an entirely separate store outside of the main domain? That makes no sense. If i register xyz.example.com as my store, then that should just be in my ONE account which verifies example.com, then by adding a second store, i can only add it as a subdomain from that main account, not just an entirely separate account. Or, lets say its a separate account, then it should make me add records from that NEW account, even if there are already existing records. So i still dont understand how this is possible
  - alexandrfox 3y ago
    Yes, that makes no sense, but that's how it is, because Shopify allows it. My friend's subdomain got taken over like that just a couple weeks ago.