onmicrosoft.com accounts

This is an old discussion that doesn't appear to have been resolved - but it's the 1st thing that came up that seemed relevant from the threat analysis service for an email I was evaluating that looks like a phishing attack. I recently got that email through O365 and it was in a Junk folder. It looks to be rightly placed there. I'm a customer of O365 too.

From the link provided by the originator of this thread, Erin Scupham, the Microsoft documentation regarding "onmicrosoft.com" seems to contradict what I'm seeing.

From the docs referenced above:
(i.e. https://docs.microsoft.com/en-us/microsoft-365/admin/setup/domains-faq?redirectSourcePath=%252fen-us%252farticle%252fAbout-your-initial-onmicrosoft-com-domain-in-Office-365-b9fc3018-8844-43f3-8db1-1b3a8e9cfd5a&view=o365-worldwide)

The email in question looks like a phishing attack from:

"Ryoko Wifi Router <Email address removed>"

So the domain is "onmicrosoft.com" and there's a subdomain of nonsensical randomized characters "rpahcxialx".

The documentation from above says:

"Can I add custom subdomains or multiple domains to Microsoft 365?

Yes. To add subdomains, **you must manage your own DNS settings at your registrar's website**. If you are letting Microsoft manage your DNS settings with NS records, or if you bought the domain from Microsoft, **you can't add subdomains**."

Since "onmicrosoft.com" is a Microsoft domain - I would assume that the Microsoft rule would apply "you can't add subdomains". This person/user is obviously not managing their own DNS or domain. But they have a subdomain of gibberish under a legit Microsoft domain making it look somewhat benign and they are using the service to spam people (at a minimum), but it looks more like a phishing attack. That's NOT good! I assume you understand the concept - bad, unreputable subdomains under your good, reputable domain is a terrible business practice.

So, what is going on? Why, or how, can someone use a legitimate domain from a major SaaS/Cloud vendor to spam, or much worse, attack other people? By using a subdomain from a legit domain makes this email looks harmless to most normal people. I don't know how dangerous this email is, if at all, and I'm not going to find out by clicking on anything. In the USA - we recently had 40% of the petrol to the east coast shut down by a ransomware attack and this is the primary method to gain access by criminals. I haven't done a full analysis of the header yet. I wanted to do a threat lookup of the domain first. I thought the domain name was a rather clever spoof of Microsoft, but whois says Microsoft owns the domain…! Well I'll be…

I'm scratching my head here on how a rogue subdomain can be launched under a legit "big-3" cloud provider domain…???!!!!

I have to say that I'm literally tired and warn out from patching all the holes and chasing down attacks to eliminate them before they can do damage. You guys need to do A LOT better! A 2 trillion dollar company should have the resources to make a huge difference, but… the issues just keep piling up… on us.

Any insight would be appreciated.

Jeff

P.S. Steve Gibson, a real security expert, has some awesome and pointed critiques of the continued degradation of Windows security outcomes.

See:

Aug 17th 2021
SECURITY NOW 832
MICROSOFT’S CULPABLE NEGLIGENCE
https://twit.tv/shows/security-now/episodes/832
We invite you to read our show notes at https://www.grc.com/sn/SN-832-Notes.pdf

Aug 24th 2021
SECURITY NOW 833
MICROSOFT’S REASONED NEGLECT
https://twit.tv/shows/security-now/episodes/833
We invite you to read our show notes at https://www.grc.com/sn/SN-833-Notes.pdf

Sep 28th 2021
SECURITY NOW 838
AUTODISCOVER.FIASCO
https://twit.tv/shows/security-now/episodes/838?autostart=false

Live Shows
https://twit.tv/shows/security-now

Transcripts and audio & video downloads:
https://www.grc.com/securitynow.htm

test

a lot of companys start with Onmicrosoft.com accounts and after they add the domain they change it. you should check if you did not add aliasses to the onmicrosoft.com accounts before deleteing. In another case they use the Onmicrosoft.com accounts for admin accounts so it is clear who is a admin. kr, Paul

You can change these accounts to your public routable UPN which is normally the users email address. If you run the following command to change this using PowerShell Set-MsolUserPrincipalName -UserPrincipalName test.me@onmicrosoft.com -NewUserPrincipalName test.me@primarysmtp.com or if you want to change lots of users you can import from a CSV file the list of addresses you want changed and changed to import-csv c:\temp\names.csv | foreach{Set-MsolUserPrincipalName -UserPrincipalName $_.Users -NewUserPrincipalName $_.Email }

wanna check