[#OSINT|#OPSEC|#DATALEAK] When you don’t renew a domain name that you use for email it creates the opportunity for a bad actor to take over accounts registered with email addresses at that domain.
1/
1/
Dataleaks allow a bad actor to use this attack vector at scale. Exporting unique domains from the email addresses, filtering by occurrence then running a whois service over the top of them is low effort.
2/
2/
A couple of years ago i spotted this with a senior developers Github account who was working at a well known tech company.
Generally speaking if you found a popular repo a bad actor could in theory introduce malicious code exploiting the dependency chain.
3/
Generally speaking if you found a popular repo a bad actor could in theory introduce malicious code exploiting the dependency chain.
3/
With the recent #Twitter #dataleak this is again a real problem; I have seen verified accounts, high follower accounts, even accounts of influence which are exposed to this attack, if the email in the dataleak is still being used.
4/
4/
I have been on the fence for a long time when it comes to talking about this attack vector, however threat actors i'm sure know about this method, where as the average person wont, therefor feel it's better to educate.
5/
5/
When registering your own domain name and using it for email, unless you are committed to renewing, it might be wiser to use a free email provider like gmail for accounts you care about to preempt this in the future.
6/
6/
• • •
Missing some Tweet in this thread? You can try to
force a refresh
