Security implications of misconfigurations
Summary: Cisco Talos described how abandoned and typo'd domain names can leave organizations exposed: CentralSquare let Tiburon's domain names expire in April 2019 while DNS traffic to tiburoninc.net continued, with most requests seeking a wpad.dat file used by the Web Proxy Autodiscovery protocol. Talos also found that an administrator at ASSA ABLOY had likely typo'd the intranet domain as 'asssaabloy.net' in a distributed VPN configuration file, and identified almost 150 domains misconfigured in this fashion, including MX record typos pointing at unregistered domains such as 'mxyandex.net' and 'mxzoho.com'.
Key Takeaway: An attacker who registered the typo'd ASSA ABLOY domain could have posed as the legitimate VPN endpoint and intercepted employee traffic to internal resources, and a single registered typo'd MX domain lets an attacker begin intercepting email for any domain carrying that typo in its DNS records.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026