{"id":121455,"date":"2025-01-23T15:46:01","date_gmt":"2025-01-23T13:46:03","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/iz-za-opechatki-v-nastrojkah-atakuyushhie-mogli-podmenit-dns-server-mastercard"},"modified":"2026-02-04T17:53:52","modified_gmt":"2026-02-04T15:53:52","slug":"iz-za-opechatki-v-nastrojkah-atakuyushhie-mogli-podmenit-dns-server-mastercard","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/iz-za-opechatki-v-nastrojkah-atakuyushhie-mogli-podmenit-dns-server-mastercard","title":{"rendered":"P\u00e5 grund af en skrivefejl i indstillingerne kunne angribere \u00e6ndre DNS-serveren for MasterCard.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

En sikkerhedsforsker fra Seralys har identificeret en mulighed for at \u00e6ndre DNS-serveren for dom\u00e6net mastercard.com, der bruges i MasterCard betalingssystemets infrastruktur. Der har v\u00e6ret en tastefejl i indstillingerne for dom\u00e6net mastercard.com siden juni 2020 \u2014 i listen over DNS-servere, der betjener zonen, var v\u00e6rten 'a22-65.akam.net' (Akamai DNS-tjeneste) angivet forkert som 'a22-65.akam.ne'. Den rodcertifikat '.ne' tilh\u00f8rer Niger og dom\u00e6net 'akam.ne' blev gjort tilg\u00e6ngeligt for salg. <\/p>\n

Dermed har enhver med interesse haft mulighed for at k\u00f8be et dom\u00e6ne<\/a> 'akam.ne', opret v\u00e6rten 'a22-65.akam.ne', implement\u00e9r en DNS-server p\u00e5 den, opret en egen version af DNS-zonen mastercard.com og omdiriger enhver underdom\u00e6ne af mastercard.com til din server. DNSSEC blev ikke anvendt for mastercard.com. Da fejltagelsen er foretaget i navnet p\u00e5 en af de fem DNS-servere, kunne en succesfuld angreb hj\u00e6lpe med at f\u00e5 kontrol over mindst 1\/5 af trafikken. Omfanget kan \u00f8ges ved at s\u00e6tte en h\u00f8j TTL (Time To Live) for den falske zone, hvilket vil medf\u00f8re, at posterne opbevares l\u00e6ngere i cachen hos offentlige resolveres, som dem der underst\u00f8ttes af Cloudflare (1.1.1.1) og Google (8.8.8.8).

\"P\u00e5<\/center> <\/p>\n

Ud over at opfange trafikken fra eksisterende v\u00e6rter kunne en mindre synlig angreb udf\u00f8res, og den oprindeligt ikke-eksisterende underdom\u00e6ne kunne bruges til phishing, for eksempel ved at oprette v\u00e6rten 'redemtion.mastercard.com' og bruge den i spam i stedet for den legitime indgang 'redemption.mastercard.com'. Blandt andet kunne kontrol over en af DNS-serverne, der betjener dom\u00e6net mastercard.com, give adgang til TLS-certifikat<\/a> tjenester, der tillader dom\u00e6neejerskabsverifikation via Web eller DNS, som for eksempel Let\u2019s Encrypt. Blandt de mulige angrebsscenarier n\u00e6vnes ogs\u00e5 oprettelsen af en falsk mailserver for at opfange korrespondance fra email navn@mastercard.com samt at organisere opsnapning af autentifikationsdata fra medarbejderes computere, der bruger Windows. <\/p>\n

En forsker, der identificerede problemer, k\u00f8bte dom\u00e6net \u00abakam.ne\u00bb for 300 $ og lancerede en DNS-sniffer for at vurdere trafikm\u00e6ngden. Analysen af de modtagne foresp\u00f8rgsler viste, at tilf\u00e6ldet med MasterCard ikke var det eneste, og der eksisterede andre dom\u00e6nesoner, hvor DNS-serverlisterne angav v\u00e6rten \u00abakam.ne\u00bb i stedet for \u00abakam.net\u00bb. Desuden blev det opdaget, at dom\u00e6net \u00abakam.ne\u00bb var registreret fra 2015 til 2018 og sandsynligvis blev brugt til at udf\u00f8re angreb. Antagelsen om angreb blev fremsat, da den tidligere ejer af \u00abakam.ne\u00bb ogs\u00e5 registrerede dom\u00e6net \u00abawsdns-06.ne\u00bb, som var stylet som DNS-serveren \u00abawsdns-06.net\u00bb. Manglende funktionalitet af en af DNS-serverne med en stavefejl i navnet kan forblive uset af administratorer i lang tid, da redundans sikres ved at angive flere DNS-servere. <\/p>\n

Virksomheden MasterCard ignorerede i f\u00f8rste omgang meddelelsen om problemet, men efter at journalisten Brian Krebs kontaktede dem, anerkendte de fejlen og rettede den og udtalte, at fejlen ikke udgjorde en trussel mod infrastrukturen. Herefter blev en anmodning fra MasterCard om at fjerne den offentliggjorte bem\u00e6rkning om h\u00e6ndelsen omdirigeret til forskeren via Bugcrowd, en tjeneste der giver betaling for identificerede s\u00e5rbarheder. <\/p>\n

Som svar sagde forskeren, at selvom han har en konto hos Bugcrowd, har han ikke indsendt nogen bel\u00f8nningsbeg\u00e6ringer, men direkte underrettet MasterCard om problemet. Notatet blev offentliggjort for at v\u00e6kke opm\u00e6rksomhed p\u00e5 problemet, efter at der ikke l\u00e6ngere var nogen trussel mod MasterCard, og dom\u00e6net \u00abakam.ne\u00bb tilh\u00f8rte forskeren. Som et resultat kompenserede MasterCard ikke kun de 300 $, der blev brugt p\u00e5 dom\u00e6net, men de takkede heller ikke forskeren mundtligt. <\/p>\n

N\u00e5r det kommer til p\u00e5standen om, at fejlen ikke skabte yderligere risici, pr\u00e6senterede forskeren statistikken for modtagne DNS-foresp\u00f8rgsler, der inkluderede dom\u00e6ner som *.az.mastercard.com, hvilket angiver fungerende komponenter i MasterCards infrastruktur, som er hosted i Microsoft Azure's cloud-service. Kompromittering af s\u00e5danne komponenter udgjorde \u00e5benbart en kritisk sikkerhedstrussel.

\"P\u00e5<\/center>
\n
Kilde: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Seralys \u0432\u044b\u044f\u0432\u0438\u043b \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043f\u043e\u0434\u043c\u0435\u043d\u044b DNS-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043b\u044f \u0434\u043e\u043c\u0435\u043d\u0430 mastercard.com, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0433\u043e \u0432 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0435 \u043f\u043b\u0430\u0442\u0451\u0436\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b MasterCard. \u0412 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430\u0445 \u0434\u043e\u043c\u0435\u043d\u043d\u043e\u0439 \u0437\u043e\u043d\u044b mastercard.com \u0441 \u0438\u044e\u043d\u044f 2020 \u0433\u043e\u0434\u0430 \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u043e\u0432\u0430\u043b\u0430 \u043e\u043f\u0435\u0447\u0430\u0442\u043a\u0430 — \u0432 \u0441\u043f\u0438\u0441\u043a\u0435 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u044e\u0449\u0438\u0445 \u0437\u043e\u043d\u0443 DNS-\u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u0432\u043c\u0435\u0441\u0442\u043e \u0445\u043e\u0441\u0442\u0430 «a22-65.akam.net» (DNS-\u0441\u043b\u0443\u0436\u0431\u0430 Akamai) \u0431\u044b\u043b \u0443\u043a\u0430\u0437\u0430\u043d \u0445\u043e\u0441\u0442 «a22-65.akam.ne». \u041a\u043e\u0440\u043d\u0435\u0432\u0430\u044f \u0437\u043e\u043d\u0430 «.ne» \u0437\u0430\u043a\u0440\u0435\u043f\u043b\u0435\u043d\u0430 \u0437\u0430 \u0420\u0435\u0441\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0439 \u041d\u0438\u0433\u0435\u0440 \u0438 \u0434\u043e\u043c\u0435\u043d «akam.ne» \u043e\u043a\u0430\u0437\u0430\u043b\u0441\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":121456,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-121455","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47P\u00e5 grund af en skrivefejl i indstillingerne kunne angriberne erstatte DNS-serveren for MasterCard | ProHoster","description":"En sikkerhedsforsker fra f\u00f6retaget Seralys har afsl\u00f8ret muligheden for at \u00e6ndre DNS-serveren for dom\u00e6net mastercard.com, der bruges i MasterCards betalingssystems infrastruktur.","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/iz-za-opechatki-v-nastrojkah-atakuyushhie-mogli-podmenit-dns-server-mastercard","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0418\u0437-\u0437\u0430 \u043e\u043f\u0435\u0447\u0430\u0442\u043a\u0438 \u0432 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430\u0445 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435 \u043c\u043e\u0433\u043b\u0438 \u043f\u043e\u0434\u043c\u0435\u043d\u0438\u0442\u044c DNS-\u0441\u0435\u0440\u0432\u0435\u0440 MasterCard | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Seralys \u0432\u044b\u044f\u0432\u0438\u043b \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043f\u043e\u0434\u043c\u0435\u043d\u044b DNS-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043b\u044f \u0434\u043e\u043c\u0435\u043d\u0430 mastercard.com, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0433\u043e \u0432 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0435 \u043f\u043b\u0430\u0442\u0451\u0436\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b MasterCard.","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/iz-za-opechatki-v-nastrojkah-atakuyushhie-mogli-podmenit-dns-server-mastercard","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-01-23T13:46:03+00:00","article:modified_time":"2026-02-04T15:53:52+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"121455","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-08 21:04:47","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 09:56:19","updated":"2026-02-08 21:04:47","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/121455","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=121455"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/121455\/revisions"}],"predecessor-version":[{"id":158134,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/121455\/revisions\/158134"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media\/121456"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=121455"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=121455"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=121455"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}