{"id":121455,"date":"2025-01-23T15:46:01","date_gmt":"2025-01-23T13:46:03","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/iz-za-opechatki-v-nastrojkah-atakuyushhie-mogli-podmenit-dns-server-mastercard"},"modified":"2026-02-04T17:53:52","modified_gmt":"2026-02-04T15:53:52","slug":"iz-za-opechatki-v-nastrojkah-atakuyushhie-mogli-podmenit-dns-server-mastercard","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pl\/blog\/news\/iz-za-opechatki-v-nastrojkah-atakuyushhie-mogli-podmenit-dns-server-mastercard","title":{"rendered":"Z powodu liter\u00f3wki w ustawieniach, atakuj\u0105cy mogli podmieni\u0107 serwer DNS MasterCard","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Badacz bezpiecze\u0144stwa z firmy Seralys wykaza\u0142 mo\u017cliwo\u015b\u0107 podmiany serwera DNS dla domeny mastercard.com, u\u017cywanej w infrastrukturze systemu p\u0142atniczego MasterCard. W ustawieniach strefy domeny mastercard.com od czerwca 2020 roku znajdowa\u0142 si\u0119 b\u0142\u0105d \u2014 w li\u015bcie serwer\u00f3w DNS obs\u0142uguj\u0105cych stref\u0119 zamiast hosta \u201ea22-65.akam.net\u201d (us\u0142uga DNS Akamai) wskazano host \u201ea22-65.akam.ne\u201d. Strefa g\u0142\u00f3wna \u201e.ne\u201d jest zarejestrowana w Republice Nigru, a domena \u201eakam.ne\u201d sta\u0142a si\u0119 dost\u0119pna na sprzeda\u017c. <\/p>\n

W ten spos\u00f3b przez cztery i p\u00f3\u0142 roku ka\u017cdy ch\u0119tny m\u00f3g\u0142 kupi\u0107 domen\u0119<\/a> \u201eakam.ne\u201d, stworzy\u0107 host \u201ea22-65.akam.ne\u201d, uruchomi\u0107 na nim serwer DNS, za\u0142o\u017cy\u0107 w\u0142asn\u0105 wersj\u0119 strefy DNS mastercard.com i przekierowa\u0107 ka\u017cd\u0105 subdomen\u0119 mastercard.com na sw\u00f3j serwer. DNSSEC dla mastercard.com nie by\u0142 u\u017cywany. Poniewa\u017c b\u0142\u0105d wyst\u0105pi\u0142 w nazwie jednego z pi\u0119ciu serwer\u00f3w DNS, w przypadku udanej ataku mo\u017cna by\u0142o uzyska\u0107 kontrol\u0119 nad co najmniej 1\/5 ruchu. Zasi\u0119g mo\u017cna zwi\u0119kszy\u0107, ustawiaj\u0105c dla podstawionej strefy d\u0142ugi TTL (Time To Live), co spowoduje d\u0142u\u017csze przechowywanie rekord\u00f3w w pami\u0119ci podr\u0119cznej publicznych resolver\u00f3w, na przyk\u0142ad wspieranych przez firmy Cloudflare (1.1.1.1) i Google (8.8.8.8).

\"Z<\/center> <\/p>\n

Opr\u00f3cz przechwytywania ruchu istniej\u0105cych host\u00f3w mo\u017cna by\u0142o przeprowadzi\u0107 mniej zauwa\u017calny atak i wykorzysta\u0107 pierwotnie nieistniej\u0105c\u0105 subdomen\u0119 do organizacji phishingu, na przyk\u0142ad za\u0142o\u017cy\u0107 host \u201eredemtion.mastercard.com\u201d i u\u017cy\u0107 go w spamie zamiast legitnej bramy \u201eredemption.mastercard.com\u201d. Mi\u0119dzy innymi, maj\u0105c kontrol\u0119 nad jednym z serwer\u00f3w DNS obs\u0142uguj\u0105cych domen\u0119 mastercard.com, mo\u017cna by\u0142o uzyska\u0107 TLS certificate<\/a> dost\u0119p do us\u0142ug, kt\u00f3re pozwalaj\u0105 na weryfikacj\u0119 posiadania domeny przez Web lub DNS, takich jak Let\u2019s Encrypt. W\u015br\u00f3d mo\u017cliwych scenariuszy atak\u00f3w wspominane jest r\u00f3wnie\u017c stworzenie fa\u0142szywego serwera pocztowego do przechwytywania korespondencji z adresem email imi\u0119@mastercard.com oraz organizacja podchwytywania danych uwierzytelniaj\u0105cych z komputer\u00f3w pracownik\u00f3w korzystaj\u0105cych z systemu Windows. <\/p>\n

Badacz, kt\u00f3ry wykry\u0142 problemy, kupi\u0142 domen\u0119 \u00abakam.ne\u00bb za 300 USD i uruchomi\u0142 na niej sniffer DNS, aby oceni\u0107 obj\u0119to\u015b\u0107 ruchu. Analiza otrzymywanych zapyta\u0144 wykaza\u0142a, \u017ce przypadek MasterCard nie jest jedyny i istniej\u0105 inne strefy domenowe, w kt\u00f3rych na li\u015bcie serwer\u00f3w DNS wskazany jest host \u00abakam.ne\u00bb zamiast \u00abakam.net\u00bb. Co wi\u0119cej, ustalono, \u017ce w latach 2015-2018 domena \u00abakam.ne\u00bb zosta\u0142a zarejestrowana i prawdopodobnie by\u0142a wykorzystywana do przeprowadzania atak\u00f3w. Przypuszczenie dotycz\u0105ce atak\u00f3w wynika z faktu, \u017ce by\u0142y w\u0142a\u015bciciel \u00abakam.ne\u00bb zarejestrowa\u0142 r\u00f3wnie\u017c domen\u0119 \u00abawsdns-06.ne\u00bb, kt\u00f3rej stylizowana nazwa przypomina serwer DNS \u00abawsdns-06.net\u00bb. Niedost\u0119pno\u015b\u0107 jednego z serwer\u00f3w DNS z liter\u00f3wk\u0105 w nazwie mo\u017ce d\u0142ugo pozostawa\u0107 niezauwa\u017cona przez administrator\u00f3w, poniewa\u017c odporno\u015b\u0107 na awarie zapewniana jest poprzez wskazanie kilku serwer\u00f3w DNS. <\/p>\n

Firma MasterCard pocz\u0105tkowo zignorowa\u0142a zg\u0142oszenie o problemie, jednak po tym, jak skontaktowa\u0142 si\u0119 z ni\u0105 dziennikarz Brian Krebs, przyzna\u0142a i poprawi\u0142a b\u0142\u0105d, twierdz\u0105c, \u017ce b\u0142\u0105d nie stanowi\u0142 zagro\u017cenia dla infrastruktury. Nast\u0119pnie poprzez serwis Bugcrowd, kt\u00f3ry umo\u017cliwia otrzymywanie wynagrodze\u0144 za wykryte luki, badacz otrzyma\u0142 \u017c\u0105danie od MasterCard o usuni\u0119cie opublikowanej notatki o incydencie. <\/p>\n

W odpowiedzi badacz stwierdzi\u0142, \u017ce cho\u0107 ma konto w serwisie Bugcrowd, nie wysy\u0142a\u0142 \u017cadnych wniosk\u00f3w o nagrody, a bezpo\u015brednio powiadomi\u0142 firm\u0119 MasterCard o problemie. Notatka zosta\u0142a opublikowana, aby zwr\u00f3ci\u0107 uwag\u0119 na problem po tym, jak firma MasterCard nie by\u0142a ju\u017c zagro\u017cona, a domena \u00abakam.ne\u00bb nale\u017ca\u0142a do badacza. W rezultacie firma MasterCard nie tylko nie zrekompensowa\u0142a 300 USD wydanych na domen\u0119, ale nawet s\u0142ownie nie podzi\u0119kowa\u0142a badaczowi. <\/p>\n

Co do twierdzenia, \u017ce b\u0142\u0105d nie stwarza\u0142 dodatkowych zagro\u017ce\u0144, badacz przedstawi\u0142 statystyki otrzymanych zapyta\u0144 DNS, w kt\u00f3rych znajduj\u0105 si\u0119 domeny *.az.mastercard.com, wskazuj\u0105ce na dzia\u0142aj\u0105ce komponenty infrastruktury MasterCard umieszczone w chmurze Microsoft Azure. Kompromitacja takich komponent\u00f3w, jak si\u0119 wydaje, stanowi\u0142a krytyczne zagro\u017cenie dla bezpiecze\u0144stwa.

\"Z<\/center>
\n
\u0179r\u00f3d\u0142o: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Seralys \u0432\u044b\u044f\u0432\u0438\u043b \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043f\u043e\u0434\u043c\u0435\u043d\u044b DNS-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043b\u044f \u0434\u043e\u043c\u0435\u043d\u0430 mastercard.com, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0433\u043e \u0432 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0435 \u043f\u043b\u0430\u0442\u0451\u0436\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b MasterCard. \u0412 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430\u0445 \u0434\u043e\u043c\u0435\u043d\u043d\u043e\u0439 \u0437\u043e\u043d\u044b mastercard.com \u0441 \u0438\u044e\u043d\u044f 2020 \u0433\u043e\u0434\u0430 \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u043e\u0432\u0430\u043b\u0430 \u043e\u043f\u0435\u0447\u0430\u0442\u043a\u0430 — \u0432 \u0441\u043f\u0438\u0441\u043a\u0435 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u044e\u0449\u0438\u0445 \u0437\u043e\u043d\u0443 DNS-\u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u0432\u043c\u0435\u0441\u0442\u043e \u0445\u043e\u0441\u0442\u0430 «a22-65.akam.net» (DNS-\u0441\u043b\u0443\u0436\u0431\u0430 Akamai) \u0431\u044b\u043b \u0443\u043a\u0430\u0437\u0430\u043d \u0445\u043e\u0441\u0442 «a22-65.akam.ne». \u041a\u043e\u0440\u043d\u0435\u0432\u0430\u044f \u0437\u043e\u043d\u0430 «.ne» \u0437\u0430\u043a\u0440\u0435\u043f\u043b\u0435\u043d\u0430 \u0437\u0430 \u0420\u0435\u0441\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0439 \u041d\u0438\u0433\u0435\u0440 \u0438 \u0434\u043e\u043c\u0435\u043d «akam.ne» \u043e\u043a\u0430\u0437\u0430\u043b\u0441\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":121456,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-121455","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Z powodu liter\u00f3wki w ustawieniach, atakuj\u0105cy mogli zamieni\u0107 serwer DNS MasterCard | ProHoster","description":"Badacz bezpiecze\u0144stwa z firmy Seralys zidentyfikowa\u0142 mo\u017cliwo\u015b\u0107 podmiany serwera DNS dla domeny mastercard.com, u\u017cywanej w infrastrukturze systemu p\u0142atniczego MasterCard.","canonical_url":"https:\/\/prohoster.info\/pl\/blog\/news\/iz-za-opechatki-v-nastrojkah-atakuyushhie-mogli-podmenit-dns-server-mastercard","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pl_PL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0418\u0437-\u0437\u0430 \u043e\u043f\u0435\u0447\u0430\u0442\u043a\u0438 \u0432 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430\u0445 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435 \u043c\u043e\u0433\u043b\u0438 \u043f\u043e\u0434\u043c\u0435\u043d\u0438\u0442\u044c DNS-\u0441\u0435\u0440\u0432\u0435\u0440 MasterCard | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Seralys \u0432\u044b\u044f\u0432\u0438\u043b \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043f\u043e\u0434\u043c\u0435\u043d\u044b DNS-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043b\u044f \u0434\u043e\u043c\u0435\u043d\u0430 mastercard.com, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0433\u043e \u0432 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0435 \u043f\u043b\u0430\u0442\u0451\u0436\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b MasterCard.","og:url":"https:\/\/prohoster.info\/pl\/blog\/news\/iz-za-opechatki-v-nastrojkah-atakuyushhie-mogli-podmenit-dns-server-mastercard","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-01-23T13:46:03+00:00","article:modified_time":"2026-02-04T15:53:52+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"121455","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-08 21:04:47","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 09:56:19","updated":"2026-02-08 21:04:47","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/121455","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/comments?post=121455"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/121455\/revisions"}],"predecessor-version":[{"id":158134,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/121455\/revisions\/158134"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/media\/121456"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/media?parent=121455"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/categories?post=121455"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/tags?post=121455"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}