{"id":121455,"date":"2025-01-23T15:46:01","date_gmt":"2025-01-23T13:46:03","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/iz-za-opechatki-v-nastrojkah-atakuyushhie-mogli-podmenit-dns-server-mastercard"},"modified":"2026-02-04T17:53:52","modified_gmt":"2026-02-04T15:53:52","slug":"iz-za-opechatki-v-nastrojkah-atakuyushhie-mogli-podmenit-dns-server-mastercard","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pt\/blog\/news\/iz-za-opechatki-v-nastrojkah-atakuyushhie-mogli-podmenit-dns-server-mastercard","title":{"rendered":"Devido a um erro de digita\u00e7\u00e3o nas configura\u00e7\u00f5es, os atacantes conseguiram substituir o servidor DNS da MasterCard.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Um pesquisador de seguran\u00e7a da empresa Seralys identificou uma falha na troca do servidor DNS para o dom\u00ednio mastercard.com, que \u00e9 utilizado na infraestrutura do sistema de pagamentos MasterCard. Desde junho de 2020, uma digita\u00e7\u00e3o incorreta nas configura\u00e7\u00f5es da zona de dom\u00ednio mastercard.com fez com que, na lista de servidores DNS, o host «a22-65.akam.net» (servi\u00e7o DNS da Akamai) fosse substitu\u00eddo pelo host «a22-65.akam.ne». A zona raiz «.ne» est\u00e1 atrelada \u00e0 Rep\u00fablica Niger e o dom\u00ednio «akam.ne» tornou-se dispon\u00edvel para venda. <\/p>\n

Assim, durante quatro anos e meio, qualquer pessoa poderia comprar um dom\u00ednio<\/a> Com «akam.ne», foi poss\u00edvel criar um host «a22-65.akam.ne», implementar um servidor DNS nele, configurar uma variante pr\u00f3pria da zona DNS mastercard.com e redirecionar qualquer subdom\u00ednio de mastercard.com para o seu servidor. O DNSSEC n\u00e3o foi utilizado para mastercard.com. Como a digita\u00e7\u00e3o errada ocorreu no nome de um dos cinco servidores DNS, em caso de ataque bem-sucedido, seria poss\u00edvel obter controle de pelo menos 1\/5 do tr\u00e1fego. O alcance poderia ser ampliado configurando um TTL (Time To Live) alto para a zona falsificada, o que resultaria em uma reten\u00e7\u00e3o mais longa dos registros no cache de resolvedores p\u00fablicos, como os suportados pelas empresas Cloudflare (1.1.1.1) e Google (8.8.8.8).

\"Devido<\/center> <\/p>\n

Al\u00e9m da intercepta\u00e7\u00e3o do tr\u00e1fego dos hosts existentes, seria poss\u00edvel realizar um ataque menos percept\u00edvel e utilizar um subdom\u00ednio originalmente ausente para phishing, por exemplo, criando um host «redemtion.mastercard.com» e utilizando-o em spams em vez do leg\u00edtimo ponto de entrada «redemption.mastercard.com». Entre outras coisas, ao controlar um dos servidores DNS que atendem ao dom\u00ednio mastercard.com, seria poss\u00edvel obter Certificado TLS<\/a> acesso a servi\u00e7os que permitem verificar a propriedade do dom\u00ednio via Web ou DNS, como o Let’s Encrypt. Outros poss\u00edveis cen\u00e1rios de ataque incluem a cria\u00e7\u00e3o de um servidor de email falso para interceptar correspond\u00eancias do email nome@mastercard.com e a organiza\u00e7\u00e3o da intercepta\u00e7\u00e3o de dados de autentica\u00e7\u00e3o de computadores de funcion\u00e1rios que utilizam Windows. <\/p>\n

O pesquisador que identificou os problemas comprou o dom\u00ednio \"akam.ne\" por $300 e lan\u00e7ou um sniffador DNS para avaliar o volume de tr\u00e1fego. A an\u00e1lise das solicita\u00e7\u00f5es recebidas mostrou que o caso com a MasterCard n\u00e3o era \u00fanico e que havia outras zonas de dom\u00ednio na lista de servidores DNS que tinham o host \"akam.ne\" em vez de \"akam.net\". Al\u00e9m disso, foi identificado que de 2015 a 2018 o dom\u00ednio \"akam.ne\" foi registrado e, provavelmente, utilizado para realizar ataques. A suposi\u00e7\u00e3o sobre os ataques foi feita, pois o antigo propriet\u00e1rio de \"akam.ne\" tamb\u00e9m registrou o dom\u00ednio \"awsdns-06.ne\", que \u00e9 estilizado para se parecer com o servidor DNS \"awsdns-06.net\". A falha de um dos servidores DNS com um erro de digita\u00e7\u00e3o no nome pode permanecer n\u00e3o detectada pelos administradores por muito tempo, pois a resist\u00eancia a falhas \u00e9 garantida pela indica\u00e7\u00e3o de v\u00e1rios servidores DNS. <\/p>\n

A empresa MasterCard inicialmente ignorou a mensagem sobre o problema, mas ap\u00f3s ser contatada pelo jornalista Brian Krebs, reconheceu e corrigiu o erro, afirmando que o problema n\u00e3o apresentava uma amea\u00e7a \u00e0 infraestrutura. Em seguida, atrav\u00e9s do servi\u00e7o Bugcrowd, que permite a obten\u00e7\u00e3o de recompensas por vulnerabilidades descobertas, o pesquisador recebeu um pedido da MasterCard para remover a nota publicada sobre o incidente. <\/p>\n

Em resposta, o pesquisador afirmou que, embora ele tenha uma conta no servi\u00e7o Bugcrowd, n\u00e3o enviou nenhuma solicita\u00e7\u00e3o de recompensa e notificou diretamente a empresa MasterCard sobre o problema. A nota foi publicada para chamar a aten\u00e7\u00e3o para o problema ap\u00f3s a empresa MasterCard j\u00e1 n\u00e3o estar mais em perigo e o dom\u00ednio \"akam.ne\" pertencer ao pesquisador. Como resultado, a empresa MasterCard n\u00e3o apenas n\u00e3o reembolsou os $300 gastos com o dom\u00ednio, mas nem mesmo agradeceu ao pesquisador verbalmente. <\/p>\n

Quanto \u00e0 afirma\u00e7\u00e3o de que o erro n\u00e3o criava riscos adicionais, o pesquisador apresentou estat\u00edsticas das solicita\u00e7\u00f5es DNS recebidas, nas quais figuram os dom\u00ednios *.az.mastercard.com, que apontam para componentes ativos da infraestrutura da MasterCard, localizados no servi\u00e7o de nuvem da Microsoft Azure. A comprometimento de tais componentes, aparentemente, representava uma amea\u00e7a cr\u00edtica \u00e0 seguran\u00e7a.

\"Devido<\/center>
\n
Fonte: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Seralys \u0432\u044b\u044f\u0432\u0438\u043b \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043f\u043e\u0434\u043c\u0435\u043d\u044b DNS-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043b\u044f \u0434\u043e\u043c\u0435\u043d\u0430 mastercard.com, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0433\u043e \u0432 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0435 \u043f\u043b\u0430\u0442\u0451\u0436\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b MasterCard. \u0412 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430\u0445 \u0434\u043e\u043c\u0435\u043d\u043d\u043e\u0439 \u0437\u043e\u043d\u044b mastercard.com \u0441 \u0438\u044e\u043d\u044f 2020 \u0433\u043e\u0434\u0430 \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u043e\u0432\u0430\u043b\u0430 \u043e\u043f\u0435\u0447\u0430\u0442\u043a\u0430 — \u0432 \u0441\u043f\u0438\u0441\u043a\u0435 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u044e\u0449\u0438\u0445 \u0437\u043e\u043d\u0443 DNS-\u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u0432\u043c\u0435\u0441\u0442\u043e \u0445\u043e\u0441\u0442\u0430 «a22-65.akam.net» (DNS-\u0441\u043b\u0443\u0436\u0431\u0430 Akamai) \u0431\u044b\u043b \u0443\u043a\u0430\u0437\u0430\u043d \u0445\u043e\u0441\u0442 «a22-65.akam.ne». \u041a\u043e\u0440\u043d\u0435\u0432\u0430\u044f \u0437\u043e\u043d\u0430 «.ne» \u0437\u0430\u043a\u0440\u0435\u043f\u043b\u0435\u043d\u0430 \u0437\u0430 \u0420\u0435\u0441\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0439 \u041d\u0438\u0433\u0435\u0440 \u0438 \u0434\u043e\u043c\u0435\u043d «akam.ne» \u043e\u043a\u0430\u0437\u0430\u043b\u0441\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":121456,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-121455","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Devido a um erro de digita\u00e7\u00e3o nas configura\u00e7\u00f5es, os atacantes puderam substituir o servidor DNS da MasterCard | ProHoster","description":"Um pesquisador de seguran\u00e7a da empresa Seralys identificou a possibilidade de substituir o servidor DNS para o dom\u00ednio mastercard.com, utilizado na infraestrutura do sistema de pagamentos MasterCard.","canonical_url":"https:\/\/prohoster.info\/pt\/blog\/news\/iz-za-opechatki-v-nastrojkah-atakuyushhie-mogli-podmenit-dns-server-mastercard","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pt_PT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0418\u0437-\u0437\u0430 \u043e\u043f\u0435\u0447\u0430\u0442\u043a\u0438 \u0432 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430\u0445 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435 \u043c\u043e\u0433\u043b\u0438 \u043f\u043e\u0434\u043c\u0435\u043d\u0438\u0442\u044c DNS-\u0441\u0435\u0440\u0432\u0435\u0440 MasterCard | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Seralys \u0432\u044b\u044f\u0432\u0438\u043b \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043f\u043e\u0434\u043c\u0435\u043d\u044b DNS-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043b\u044f \u0434\u043e\u043c\u0435\u043d\u0430 mastercard.com, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0433\u043e \u0432 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0435 \u043f\u043b\u0430\u0442\u0451\u0436\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b MasterCard.","og:url":"https:\/\/prohoster.info\/pt\/blog\/news\/iz-za-opechatki-v-nastrojkah-atakuyushhie-mogli-podmenit-dns-server-mastercard","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-01-23T13:46:03+00:00","article:modified_time":"2026-02-04T15:53:52+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"121455","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-08 21:04:47","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 09:56:19","updated":"2026-02-08 21:04:47","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/121455","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/comments?post=121455"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/121455\/revisions"}],"predecessor-version":[{"id":158134,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/121455\/revisions\/158134"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media\/121456"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media?parent=121455"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/categories?post=121455"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/tags?post=121455"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}