A ‘dangling DNS takeover’ is a known attack method that allows a bad actor to take over a subdomain whenever a DNS record points to a cloud resource after the resource has been deleted. The link is left ‘dangling’, pointing to nothing. It is a simple case of poor security hygiene, but not uncommon.
If an attacker can find that link – which is not difficult with internet scans – and reconstruct the cloud resource but now under his own control, he can then gain access to the subdomain. Historically, the attack has primarily been used by cybercriminals for financial gain.
Security firm Silent Push asked itself, “What if we looked at it the same way a trained nation-state attacker would?” Nation states prioritize the generation of chaos and disruption over monetization; and have a new tool at their disposal – artificial intelligence. The result of its consequent research has now been published.
AI proved to be a force multiplier for dangling DNS takeover in the project and research Silent Push calls ‘DangleGeddon’. It massively expanded domain and subdomain discovery. Claude Opus 5 was used for context enriched takeover script generation, targeting 12,500 domains.
AI was also used to filter out those resources that lacked allocation or DNS registration, reducing the initial large dataset to a precise list of several hundred exploitable targets. This process found new targets, broadening the attack surface beyond what was known to possible human attackers.
The researchers were then able to automate infrastructure build-out for exploitation, “setting us,” write the researchers, “one button push away from Dangle Day.” In short, it continues, “The hypothetical scenario of a DangleGeddon became a very real threat in minutes.”
The researchers ran a range of safe tests to examine what could have become available to attackers had they proceeded. It disclosed its actions to the domain owners by leaving a “Security Notice: This subdomain had a dangling DNS record pointing to a deprovisioned cloud storage endpoint, leaving it vulnerable to subdomain takeover. It is being held by a security researcher solely to prevent abuse (e.g., phishing or malware hosting) while the owner removes the stale record. No data is collected on this page.”
In one US federal government domain, where a dangling record pointed to an unassigned Azure blob storage container, takeover allowed the creation of phishing pages bypassing government trust filters. “The domain can now bypass automated safeguards by leveraging the trust associated with .gov domains,” report the researchers.
In banking, the largest French bank, Société Générale. left an unassigned Azure Blob storage resource pointing to an application.
In manufacturing, Fortune 500 Ford had a dangling DNS record pointing to a developmental application gateway hosted by an Azure VM. Developers’ credentials (API keys and authentication headers) could be harvested for reuse, expanding access into the company, or be used as a platform for malware hosting.
In pharmaceuticals, Eli Lilly left a record pointing to an Apple device guide, which could allow an attacker to focus on a specific set of targets and events.
From its research, Silent Push projected the downstream impact of this hypothetical DangleGeddon.
For the government, it could affect thousands of systems and millions of employees, causing multiple disruptions, “with the potential impact on national security arguably being severe.”
In banking, if DangleGeddon is applied globally, multinational firms such as Bank of America, UBS and the Bank of Montreal would suffer downstream effects including paralysis of online banking and real-time payments, as well as blocked trading platforms.
In the manufacturing sector, using automotive Ford as an example, domain takeover could host malicious content and serve phishing pages, malware, or other malicious content under the legitimate car maker’s domain. Knock on effects could have catastrophic results on supply chain integration across thousands of other organizations.
For Big Pharma, Silent Push warns, “The speed of a takeover cascading into a magnitude involving multiple global pharma organizations would undermine high-performance R&D, disrupt clinical trials, and pose even more serious consequences for the supply chain necessary to deliver drug and therapeutic solutions on a global scale. Estimated losses across organizations could be in the hundreds of billions.”
The research from Silent Push suggests that a hypothetical DangleGeddon is eminently achievable with the assistance of AI. The process and effect of such an operation would not attract financially motivated cybercriminals, but is precisely the objective of a geopolitically adversarial nation state – to inflict cost and chaos at a massive scale. But if AI can assist in dangling DNS takeover at nation state level, it could also be used more locally by individual cybercriminals for direct monetization.
The moral is simple. Silent Push has demonstrated that it behooves every organization to not leave anything dangling from their sites. Don’t be a Dangler.
Related: Dangling DNS Used to Hijack Subdomains of Major Organizations
Related: Chinese Hackers Have Been Probing DNS Networks Globally for Years: Report
Related: Over 35k Domains Hijacked in ‘Sitting Ducks’ Attacks