Subdomain takeover on mta1a1.spmail.uber.com

Summary

A dangling AWS record on mta1a1.spmail.uber.com allowed a complete DNS zone takeover, giving an adversary access to mta1a1.spmail.uber.com-scoped cookies and CORS, which could facilitate phishing attacks.

Thanks again, @0x3c3e!

It's so called IP-use-after-free attack. I was able to obtain an IP address from mta1a1.spmail.uber.com A DNS record as it was possible to allocate the IP from AWS elastic IP's pool.

Edit 11/2019 - It would appear AWS has begun serving elastic IPs from a small account-specific pool (similar to GCP). This severly limits the diversity of addresses recieved. (from https://github.com/monoxgas/FlyingAFalseFlag).

As follows from the foregoing, current chances to reproduce something like that should tend to zero.

References

• Great intro article https://blog.apnic.net/2019/01/09/be-careful-where-you-point-to-the-dangers-of-stale-dns-records/
• AWS elastic IP reference https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/elastic-ip-addresses-eip.html
• BHUSA 2019: Flying a False Flag https://youtu.be/2BEwqbCbQuM?t=1945
• PoC: https://github.com/0x3c3e/recloud
• My quick research https://docs.google.com/spreadsheets/d/18gfOnxFC3rq8Z_Ecnuxdw4ldC79GbzYPqCCn5XX0DVs/