CocoaPods is THE dependency manager for iOS and Mac projects. It helps software developers easily add pre-made pieces of code (called “libraries” or “dependencies”) to their iOS or Mac projects.

These libraries of code can help developers add extra features or functionality to their apps without having to write all of the code themselves. Think of it like adding pre-made Lego pieces to a Lego creation to make it better or more interesting.

Subdomain Hijacking

Subdomain hijacking is a type of cyber-attack where an attacker takes control of a subdomain of a legitimate domain and uses it to host their malicious content or to launch further attacks.

In a subdomain hijacking attack, the attacker can find forgotten settings on free hosting websites such as GitHub Pages which are not mapped anymore and the weak validation grant attackers permission to use those subdomains.

CocoaPods Casino

Guy Nachshon, a brilliant security researcher in my team, found out the subdomain cdn2.cocoapods.org was used years ago and abandoned, but the DNS records still point to GitHub Pages hosting service, and attackers hijacked it to host a fishy casino website.

While we are investigating this, the subdomain got freed on GitHub Pages (probably due to an update/mistake of the attackers)

We jumped on the opportunity and created a simple repository to hold this subdomain and prevent another takeover by those casino attackers.

This works as long as the subdomain is unoccupied by another GitHub Pages project and is super simple to set up — settings, enable GitHub Pages, type the subdomain “cdn2.cocoapods.org”:

Watch this short demo video to see it in action:

Impact

Generally speaking, the impact of hijacking a subdomain of a known website can trick users into thinking the content they are seeing is legitimate and created by the known brand.

Furthermore, organizations usually allow network traffic to such dev-related legitimate resources from sensitive networks to support the engineering process.

We’ve seen last year's cases in which attackers hosted malicious exe file on GitHub and another example where an image hosted on imgur.com contained malicious python code. Hence, it’s quite clear why attackers what’s the potential to hijack a subdomain of a popular and legitimate brand.

Conclusion

I disclosed the findings to CocoaPods in this GitHub issue, and huge respect for the fast response and removing the subdomain record.

It’s ridiculous how easy it is to takeover an abandoned subdomain. This made me wonder — should this be that easy? Should GitHub enforce 2-way validation when linking domain to GitHub Pages project? Like, validating the exact repository URL? IMHO — yes.

See this case as a warning if you have created subdomain records for side-projects that over time became obsolete like cdn2.cocoapods.org. I suggest removing them as someone might hijack your subdomain.

This is How I Hijacked CocoaPods Subdomain Using GitHub Pages was originally published in Checkmarx Zero on Medium, where people are continuing the conversation by highlighting and responding to this story.