Wiz Adds AWS Dangling-Domain Detection to Help Prevent Subdomain Takeovers
Summary
Wiz says its new feature checks AWS Route 53 records daily for dangling domains, including CNAMEs without an associated S3 bucket or linked to a bucket outside the organization.
Key points
- Dangling DNS records can enable subdomain takeovers and redirect users to malicious sites, potentially supporting phishing or cookie theft.
- Wiz’s feature checks Route 53 records daily for CNAMEs associated with AWS resources that lack an S3 bucket or point to a bucket outside the organization.
- The feature is available to Wiz Advanced customers; the article says support for other cloud providers is planned.
- The article recommends deleting unused DNS aliases and regularly monitoring for dangling records.
Article Details
- Event Type
- Wiz announced Dangling Domain Detection, a feature for identifying potentially dangling DNS records and subdomain takeover risk in AWS environments.
- Impact
- The feature checks Route 53 DNS records daily and flags CNAME records associated with AWS resources that lack an associated S3 bucket, as well as domains associated with S3 buckets that do not belong to the organization. The article describes dangling records as a risk for domain hijacking, traffic redirection, phishing, and cookie harvesting. The feature is available to Wiz Advanced customers; support for other cloud providers is described as forthcoming.
Vendors
Products
Amazon Route 53Wiz is here to give you piece of mind, providing you visibility for those domains registered with Amazon Route 53. To fully understand what this solution is and why dangling domains is an issue, let us firstDangling Domain DetectionWe are excited to announce Dangling Domain Detection, a new feature to help you identify DNS entries within your organization that might be dangling. Amazon Web Services (AWS) customers can now detect domains with a