Forgot your password?
Close
typodupeerror
Microsoft IT

Microsoft Was Routing Example-Domain Traffic To a Japanese Cable Company for Five Years (arstechnica.com) 15

Posted by msmash from the stranger-things dept.
Microsoft has quietly suppressed an unexplained anomaly on its network that was routing traffic destined for example.com -- a domain reserved under RFC2606 specifically for testing purposes and not obtainable by any party -- to sei.co.jp, a domain belonging to Japanese electronics cable maker Sumitomo Electric.

The misconfiguration meant anyone attempting to set up an Outlook account using an example.com email address could have inadvertently sent test credentials to Sumitomo Electric's servers. Under RFC2606, example.com resolves only to IP addresses assigned to the Internet Assigned Names Authority. Microsoft confirmed it has "updated the service to no longer provide suggested server information for example.com" and said it is investigating.

Security researcher Dan Tentler of Phobos Group noted the company appears to have simply removed the problematic endpoint rather than fixing the underlying routing -- "not found" errors now appear where the JSON responses previously occurred. Tinyapps.org, which noted the behavior earlier this month, said the misconfiguration had persisted for five years. Microsoft has not explained how Sumitomo Electric's domain entered its configuration. The incident follows 2024's revelation that a forgotten test account with admin privileges enabled Russia-state hackers to monitor Microsoft executives' email for two months.
This discussion has been archived. No new comments can be posted.

Microsoft Was Routing Example-Domain Traffic To a Japanese Cable Company for Five Years More

Microsoft Was Routing Example-Domain Traffic To a Japanese Cable Company for Five Years

Comments Filter:
  • I'm guessing someone either requested or accidentally took the initiative to add a C-Name pointing to the Japanese domain name. Normally this would be considered a small mistake and non service impacting... I disagree with the cybersecurity risk of someone using a fake account@example.com with real passwords. That seems like an odd concern (unless I'm missing something)

  • Well done (Score:3, Funny)

    by ichthus ( 72442 ) on Tuesday January 27, 2026 @02:35PM (#65952764) Homepage
    Haha. Microsoft -- the absolute bastions of security.

  • Such a convoluted and manufactured premise.

    But the "security" company got their name in the news. So, they've got that going for them.

    If you want passwords, there are plenty of lists available for free and for sale. There's no need to go to all this trouble.

  • I checked out RFC 2606 [rfc-editor.org], and there is nothing there about using IANA assigned IP addresses (in case of IPv6, it's 2001::/23). It would seem to me that the most appropriate IP address to use for example.com would be 2001:db8:1:1::0af5, since one would be mapping example.com to an address from the reserved space for examples in IPv6

    Sorry, I don't know if there is an equivalent block in IPv4 for documentation purposes like the 2001:db8::/32. The only IANA assigned addresses have 0 in the first byte of an IP

    • Re: (Score:3)

      by flink ( 18449 )

      The RFC states the following:

      6. DNS server operators SHOULD be aware that example names are
      reserved for use in documentation.

      7. DNS Registries/Registrars MUST NOT grant requests to register
      example names in the normal way to any person or entity. All
      example names are registered in perpetuity to IANA:

  • ... Slashdot (or its advertisers) seem to be loading from known scam sites. error-report.com being the primary example. And attempting to follow that trail who-knows-where leads me to another "evil" page, html-load.com. Both of which (being scam sites) have been blocked by my ISP (thank you very much).

    I understand the link between these sites and ad-blocker walls. But there are a couple of issues: 1) I'm not running an ad blocker. That's my ISP doing the blocking, so I can't "turn it off". 2) Why, upon de

  • ...MCSE school. Having an illuminating discussion wit the instructor over using the .local TLD for internal DNS. Followed by "well, just use .mslocal, that will be safe forever."

    Admittedly this was 1993, when no one could conceive of new TLDs. Except for a few of us CNEs who were trained to think ahead, occasionally.

    We were trained to have our clients register their domain, immediately, and run their own internal DNS, back when it was truly wizardry. But worth it.

    Why does Outlook etc. even permit this? Wel

Slashdot Top Deals

You had mail, but the super-user read it, and deleted it!

Close