On a site seemingly abandoned by Nvidia for events, called events.nsv.nvidia.com, a spam marketing operation moved in and posted more than 62,000 AI-generated articles, many of them full of incorrect or incomplete information on popularly-searched topics, like salon or restaurant recommendations and video game roundups.
On the vaccines.gov domain, topics for spam blogs include “Gay Impregnation,” “Gay Firry[sic] Porn,” and “Planes in Top Gun.”
The comments on the article provide the actual answer to how this is happening. It sounds like there are DNS records that someone at these companies didn’t clean up. The vulnerability is a “subdomain takeover”
szileaf Yesterday
As others pointed out, this is subdomain takeover [0]. Maybe add in the article to make it more clear? I got very confused while reading it as to what is going on, because it was not clear if it was a case of servers being hacked, somebody buying abandoned domains (have seen it in some phishing campaigns), subdomain takeover, or sth else.
But the main question is what are they trying to attempt? There do not seem to contain ads, the content is clickbait but bizarre, and I can see no obvious malicious attempt (I could miss sth, maybe steal parent domain’s cookies?)
[0] https://developer.mozilla.org/en-US/docs/Web/Security/Subdomain_takeovers
Found this explanation at https://0xpatrik.com/subdomain-takeover-basics/ to be good:
Subdomain takeover is a process of registering a non-existing domain name to gain control over another domain. The most common scenario of this process follows:
- Domain name (e.g., sub.example.com) uses a CNAME record to another domain (e.g., sub.example.com CNAME anotherdomain.com).
- At some point in time, anotherdomain.com expires and is available for registration by anyone.
- Since the CNAME record is not deleted from example.com DNS zone, anyone who registers anotherdomain.com has full control over sub.example.com until the DNS record is present.
But I guess in general it’s basically a company having an old DNS record that is pointing to an IP address (A or AAAA record) or domain name (CNAME record) that they no longer own.
So kind of stupid mistake to make I think?
But this kind of thing just confirms my feeling that the web and a lot of internet infrastructure is just too complex, easy to screw up, and built upon insecure technology.
If I was personally building some kind of internet service, I’d want to just provide a static IP address (so no DNS required) and use a very specific subset of the TLS protocol for security, version 1.3 only, specific ciphers only, specific X509 certificate features only.
I pity people who have to maintain web infrastructure and have to consider the intersection of all these different protocols and security problems. Would drive me crazy.
These takeovers are extremely common in Brazilian city governments websites.
Very bizarre that the article didn’t touch on it.
The comment didn’t explain it entirely but I figured all these domains pointed to a hosted content management system somewhere. Then that domain either expired or it was CNAMEs the whole way down to some “cloud” providers’ default generated DNS (eg
nvidia-hosted-cms.azurewebsites.net). Or they all used the same CMS which had an exploit developed for it.Happened to EA’s Steam competitor before: https://www.bleepingcomputer.com/news/security/ea-fixes-origin-game-platform-to-prevent-account-takeovers/
That makes a lot of sense!
I think it can also basically happen with anything where there’s a DNS record pointing to something not controlled by the same organization. Basically just make sure you keep your DNS records up to date!
(I also added another sentence or two to my earlier comment)
Why Was Nvidia Hosting Blogs About ‘Brazilian Facesitting Fart Games’?
why are you not?
