Shopify Subdomain Takeovers | Hacker News Reader

Shopify Subdomain Takeovers

4 pointsalexandrfox4 comments

Per the tin. Looks like a coordinated "attack" on Shopify customers. Malicious entities are spinning up various fake shops under the "ftp" CNAME that is quite regularly auto-provisioned by various registrars. No validation needed! Google Search Console access included!

Similar (same?) vulnerability was reported to Shopify in 2018 and it's still there: https://medium.com/@thebuckhacker/how-to-do-55-000-subdomain-takeover-in-a-blink-of-an-eye-a94954c3fc75

Whilst I get that it's not necessarily a Shopify's fault that people leave dangling records I'd expect more from a company that offers a no-code solution.

1) https://support.google.com/webmasters/thread/257728643/unknown-person-added-themselves-as-owner-of-my-domain-in-search-console

2) https://support.google.com/webmasters/thread/258587184/subdomain-hacking-and-new-owner

3) https://www.reddit.com/r/shopify/comments/19dd6p6/my_shopify_stores_ftp_has_been_hijacked_any_ideas/

4) https://community.shopify.com/c/shopify-discussions/help-unidentified-person-added-as-owner/m-p/2435684

So how does it actually work? The article is so poorly written I don’t understand the exact mechanism that would allow this

Quite simple really. Imagine you buy a domain (e.g. foo.com) and park it on some popular registrar. Many of those create a few "CNAME" DNS records like ftp.foo.com, mail.foo.com, etc. by default. Then you decide to use Shopify with this domain you bought, so you modify its "A" DNS record to point to Shopify's IP address. Boom, you're now susceptible to this "attack" -- >anyone< can go ahead and register a Shopify account and attach one of your dangling subdomains to it!

But why would shopify ever treat a subdomain as an entirely separate store outside of the main domain? That makes no sense.

If i register xyz.example.com as my store, then that should just be in my ONE account which verifies example.com, then by adding a second store, i can only add it as a subdomain from that main account, not just an entirely separate account.

Or, lets say its a separate account, then it should make me add records from that NEW account, even if there are already existing records.

So i still dont understand how this is possible

Yes, that makes no sense, but that's how it is, because Shopify allows it. My friend's subdomain got taken over like that just a couple weeks ago.

Reply on news.ycombinator.com