I'm trying to understand how the attack described in this article could work. Let's grant that this attacker, not associated with
company.com, managed to take control of
oldsub.company.com. Here's a description from the article:
Monsegur had used a trick known as domain name system enumeration to dig up one of the company’s defunct subdomains that had once directed visitors to a third-party service. He’d built his phishing site on the same URL of that service, so that the fake login page appeared to be hosted inside the company’s own network.
Here's the part I can't figure out: Presumably this company has a CA-signed certificate for
company.com. Unless he was also able to steal the private key for that certificate, wouldn't anyone navigating to the stolen
oldsub.company.com domain get a big browser security warning, that whatever certificate the hacker attempted to use for the stolen domain is not trusted?
Of course, since this was a staged, white-hat attack, maybe the attacker did have access to the real certificate. If that's the case, would a "victim" of the attack be able to claim that they checked the domain and received no certificate error, and that should prove the site is legitimate?