Mastercard DNS Error Went Unnoticed for Years (krebsonsecurity.com) 29
A security researcher discovered and fixed a critical domain name server misconfiguration in Mastercard's systems that persisted undetected for nearly five years, potentially exposing the credit card giant to traffic interception risks.
Philippe Caturegli, founder of security firm Seralys, found that one of Mastercard's five DNS servers incorrectly pointed to "akam.ne" instead of "akam.net" from June 2020 to January 2025. He spent $300 to register the domain through Niger's domain authority to prevent potential exploitation. Mastercard said the typo has been corrected, insisting there was "not a risk to our systems."
Philippe Caturegli, founder of security firm Seralys, found that one of Mastercard's five DNS servers incorrectly pointed to "akam.ne" instead of "akam.net" from June 2020 to January 2025. He spent $300 to register the domain through Niger's domain authority to prevent potential exploitation. Mastercard said the typo has been corrected, insisting there was "not a risk to our systems."
Not Suprising (Score:5, Insightful)
Re: (Score:2)
a threat actor could have gotten a fifth of the traffic headed to destinations that used that same NS record content... which looks like it included their own API gateways!
Yes. But there should still be DNSSEC signing to prevent an accidentally listed DNS server for publishing anything right?
Furthermore you would need a valid TLS certificate in order spoof an API gateway in order to intercept data. So I guess they could say the risk is none since the ability to intercept and reply to authoritative D
Re:Not Suprising (Score:4, Informative)
Re: (Score:2)
Now, without DNSSEC, you could plausibly get a Lets Encrypt certificate with a dns-01 challenge, so it's still vulnerable.
They ought to correct their zone.. I guess that is just more evidence someone is asleep at the switch over there. It's basically inexcusable for a payment processing company to not have basic DNS security in place for that infrastructure. If BankofAmerica, Amex, and Discover.com can do it, then so can Mastercard.
In theory Multi-VA [letsencrypt.org] should still prevent getting a TLS certificate.
Re: (Score:2)
Yeah, that's why I only said plausibly, rather than possibly, as it'd take that 1:20 shot to make it happen. But plausibly may be overstating it a bit, still.
Given everything we've learned here, do you think they're actually monitoring CT logs
But... (Score:5, Funny)
"He spent $300 to register the domain through Niger's domain authority to prevent potential exploitation"
Did he put it on his mastercard?
Re: (Score:2)
Re: (Score:3)
He should have put the charge on a clean mastercard account and then refused to pay the bill, when they complained he should have pointed them to a policy document hosted on "their domain" that said he doesn't have to pay.
not a risk to our systems? (Score:3)
From TFS:
not a risk to our systems
Of course not, it's a risk to whoever tries to use their systems although. And it could even be a risk to their systems if their systems try to connect to other of their systems...
Re: (Score:3)
It's also a reputational risk to their organization... which would normally be a bigger potential cost than a systems compromise; even for mastercard.
Re:not a risk to our systems? (Score:4)
Re:not a risk to our systems? (Score:5, Interesting)
They do comprehend it. They know it is mostly a myth perpetuated by the infosec industry to justify the spending of a lot of money on their products and services.
Let's face it, anyone refusing to shop at TJ Max, Target, Home Depot, how many people moved of o365 because of various Microsoft Cloud security failures?
Even in the Security industry where it really ought to matter it does not seem to. Citrix Netscalers are as popular as ever, people buy Cisco products after so so many embarrassing security failures, PaloAlto has had their RCEs still everyones favorite layer-7 device.
Hell how much business has Crowd Strike even lost of the availability crisis of their own making?
Even Solar Winds I am not sure the fact that it isn't as popular as it once was has anything to do with reputation, more so just generalized competition from cloud and other dev-ops platforms.
Re: (Score:3)
Re: (Score:2)
Exactly. HPE and Verizon Enterprise both lost many clients after their large breaches and so did crowdstrike despite it being glossed over. They are still around but are you hearing much about AshleyMadison these days?
It's hard to say how much their poor security related reputation has cost Microsoft over the years but it is definitely billions to trillions as any serious organization has limited their footprint to endpoint and endpoint related services using solutions deemed more secure and stable for seri
Is Mastercard PCI compliant? (Score:1)
How did this configuration go unnoticed? Were resolution failures not logged or were logs not reviewed? Either answer is a violation of PCI DSS requirements.
Re: (Score:1)
Please. PCI DSS certification is for punishing mom-and-pop businesses with IT consultant fees, not for holding the overlords accountable for their cheap Sec spending.
Re: (Score:2)
This wouldn't have caused any resolution failure on their side. "akam.ne" is returned instead of "akam.net" and whoever tries to connect to akam.ne then get the failure unless somebody sets a server to listen for that traffic. Also, they say it was only 1 out of 5 DNS and DNS lookups will transparently try another server in one doesn't answer.
Re: (Score:2)
And we know what akam.net was used for, most likely Akamai edge cache content. Wonder why any dev did not notice they were not retrieving the expected content? How many timeouts, even a 408?
This should have been obvious at some point, and resolved. Ugly, marginally competent dev teams. A bad look. Expect a few months of deep dive auditing to find the other problems yet to be found.
Oh, and I know, a failover somewhere masked this. Is that better?
Re: (Score:2)
Plenty we don't know so many possibilities. Example: the faulty DNS was never hit by the dev team and was only returned to serve queries from some other countries, etc. etc. etc.
Re: (Score:2)
'never hit by the dev team'
Gotcha, the test team is not part of the dev team. We ultimately blame the test team, right?
Re: (Score:2)
PCI DSS wouldn't require a DNS resolution error to be logged.
Also it is not possible for the domain nameserver operator to log what would happen.
Since it's only 1 nameserver; you don't get a resolution error - most DNS clients will send a parallel query to multiple nameservers, and whichever nameserver you get the first answer from wins. In this case the incorrect nameserver never returns an answer (SERVFAIL condition), so peoples' DNS clients just ignore it - no resolution failure occurs.
"It was DNS" (Score:2)
... got the T-shirt.
Priceless (Score:5, Funny)
Re: (Score:3)
Doesn't Mastercard follow the same hiring procedures as all the other corporate assholes? Seven interviews. Must have two PhDs. Top .0001%. No white guys. Best of the best right?
Fuckups all the way down. Then three miles of wreckage.
But I'm sure that's all just a coincidence. You keep right on hiring those H1Bs.
If they're anything like American Express, they're an H1-B mill.
they out soured that part of IT to the lowest bidd (Score:2)
they out soured that part of IT to the lowest bidder!
for tech errors it's always DNS... (Score:5, Funny)