From threatpost.com
Poor DNS housekeeping opens the door to account takeover.
A proof-of-concept (PoC) attack details how an attacker can gain access a victim’s Microsoft Live webmail session, without having the person’s credentials. It relies upon the hijack of a Microsoft-owned Live.com website subdomain.
The PoC, developed by CyberInt, demonstrates what it characterizes as a “high-severity vulnerability” in a Microsoft Live subdomain (now fixed) that could have been leveraged for full Microsoft account takeover. From there, an adversary could have carried out broad attacks against multiple organizations and their customers.
While the PoC was specifically for a fixed issue, it demonstrates that session hijacking can open the door to advanced attacks, depending on the domain in question.