Ethical Hacking News
Thousands of websites and applications still rely on abandoned CDN domains that have been re-registered and now hold wildcard DNS. This allows any hostname under it to resolve to infrastructure controlled by a stranger, making it difficult for security teams to monitor and control third-party scripts. The adoption of Content Security Policy (CSP) is growing rapidly, but its implementation and monitoring require careful attention to ensure that organisations remain one step ahead of malicious actors.
Thousands of websites still rely on a domain abandoned years ago, which has been re-registered and now holds wildcard DNS, allowing unknown hosts to resolve to hostile infrastructure. The issue highlights the problem of third-party scripts compromising websites and applications, as security teams have no control over malicious code fetched by visitors' browsers. Conventional testing methods are ineffective against third-party scripts, which can vary by geography, user agent, referrer, time of day, and session. Content Security Policy (CSP) can control what code runs on a website, block unauthorized code, and provide visibility into third-party scripts executed on a site. Report URI, a client-side security platform, demonstrates the potential of CSP to address the issue by monitoring scripts served to real users and identifying changes over time. The adoption of CSP has grown rapidly, with a 12,000% increase in adoption across the top 1 million sites over the past decade.
The web security landscape has become increasingly complex, with the emergence of third-party scripts playing a significant role in compromising websites and applications. A recent development has shed light on the issue, revealing that thousands of sites still rely on a domain that was abandoned years ago. This domain, which used to belong to a content delivery network (CDN), has been re-registered and now holds wildcard DNS across the entire domain, allowing any hostname under it to resolve to infrastructure controlled by a stranger.
The new owner of the domain has set up an ad-heavy media downloader page, which appears unremarkable. However, the remarkable part is that the decision about what those thousands of pages load next belongs to a stranger, and nobody involved has been notified, because from the outside, nothing broke. This pattern is not hypothetical and is not uncommon, as evidenced by the recent case of the polyfill.io domain, which changed ownership and began serving conditional redirects to mobile visitors.
The polyfill.io domain, which was embedded in over 110,000 sites, is a prime example of the problem at hand. The sites running it had not been hacked; they had simply outsourced a
