{"id":121455,"date":"2025-01-23T15:46:01","date_gmt":"2025-01-23T13:46:03","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/iz-za-opechatki-v-nastrojkah-atakuyushhie-mogli-podmenit-dns-server-mastercard"},"modified":"2026-02-04T17:53:52","modified_gmt":"2026-02-04T15:53:52","slug":"iz-za-opechatki-v-nastrojkah-atakuyushhie-mogli-podmenit-dns-server-mastercard","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/news\/iz-za-opechatki-v-nastrojkah-atakuyushhie-mogli-podmenit-dns-server-mastercard","title":{"rendered":"P\u00e5 grund av ett skrivfel i konfigurationerna kunde angripare ers\u00e4tta DNS-servern f\u00f6r MasterCard.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

En s\u00e4kerhetsforskare fr\u00e5n f\u00f6retaget Seralys har identifierat en m\u00f6jlighet att manipulera DNS-servern f\u00f6r dom\u00e4nen mastercard.com, som anv\u00e4nds i infrastrukturen f\u00f6r betalningssystemet MasterCard. I inst\u00e4llningarna f\u00f6r dom\u00e4nzonen mastercard.com fanns det sedan juni 2020 ett skrivfel \u2014 ist\u00e4llet f\u00f6r v\u00e4rdena f\u00f6r DNS-servern «a22-65.akam.net» (DNS-tj\u00e4nsten Akamai) angavs v\u00e4rdet «a22-65.akam.ne». Den rotzon som «.ne» \u00e4r knuten till tillh\u00f6r Niger och dom\u00e4nen «akam.ne» blev tillg\u00e4nglig f\u00f6r f\u00f6rs\u00e4ljning. <\/p>\n

S\u00e5ledes hade vem som helst under fyra och ett halvt \u00e5r kunnat k\u00f6pa en dom\u00e4n<\/a> «akam.ne», skapa v\u00e4rd «a22-65.akam.ne», implementera en DNS-server p\u00e5 den och etablera en egen version av DNS-zonen mastercard.com samt omdirigera varje underdom\u00e4n av mastercard.com till sin egen server. DNSSEC anv\u00e4ndes inte f\u00f6r mastercard.com. Eftersom skrivfelet gjordes i namnet p\u00e5 en av de fem DNS-servrarna, skulle en lyckad attack ha kunnat ge kontroll \u00f6ver minst 1\/5 av trafiken. T\u00e4ckningen kan \u00f6kas genom att st\u00e4lla in ett stort TTL (Time To Live) f\u00f6r den falska zonen, vilket skulle leda till att posterna h\u00e5lls l\u00e4ngre i cachen hos offentliga resolver, till exempel de som st\u00f6ds av Cloudflare (1.1.1.1) och Google (8.8.8.8).

\"P\u00e5<\/center> <\/p>\n

F\u00f6rutom att f\u00e5nga upp trafiken fr\u00e5n befintliga v\u00e4rdar skulle en mindre m\u00e4rkbar attack kunna genomf\u00f6ras f\u00f6r att anv\u00e4nda en ursprungligen icke-existerande underdom\u00e4n f\u00f6r phishing, till exempel att skapa v\u00e4rden «redemtion.mastercard.com» och anv\u00e4nda den i spam ist\u00e4llet f\u00f6r den legitima ing\u00e5ngspunkten «redemption.mastercard.com». Bland annat, genom att kontrollera en av de DNS-servrar som hanterar dom\u00e4nen mastercard.com, skulle man ha kunnat f\u00e5 tillg\u00e5ng TLS-certifikat<\/a> till tj\u00e4nster som till\u00e5ter dom\u00e4n\u00e4garskapsverifiering via Web eller DNS, s\u00e5som Let's Encrypt. Bland de m\u00f6jliga attacker n\u00e4mns ocks\u00e5 skapandet av en falsk e-postserver f\u00f6r att f\u00e5nga upp korrespondens fr\u00e5n e-postadressen namn@mastercard.com och organisera avlyssning av autentiseringsdata fr\u00e5n anst\u00e4lldas datorer som anv\u00e4nder Windows. <\/p>\n

En forskare som uppt\u00e4ckte problemen k\u00f6pte dom\u00e4nen \"akam.ne\" f\u00f6r $300 och startade en DNS-sniffer f\u00f6r att bed\u00f6ma trafikvolymen. Analysen av de mottagna f\u00f6rfr\u00e5gningarna visade att fallet med MasterCard inte \u00e4r det enda och att det finns andra dom\u00e4ner vars DNS-servrar pekar p\u00e5 v\u00e4rden \"akam.ne\" ist\u00e4llet f\u00f6r \"akam.net\". Dessutom har det konstaterats att dom\u00e4nen \"akam.ne\" var registrerad mellan 2015 och 2018, och troligen anv\u00e4ndes f\u00f6r att utf\u00f6ra attacker. Antagandet om attacker g\u00f6rs eftersom den tidigare \u00e4garen av \"akam.ne\" \u00e4ven registrerade dom\u00e4nen \"awsdns-06.ne\", som \u00e4r stiliserad f\u00f6r att se ut som DNS-servern \"awsdns-06.net\". En icke-fungerande DNS-server med ett stavfel i namnet kan f\u00f6rbli obem\u00e4rkt av administrat\u00f6rerna under en l\u00e5ng tid, eftersom redundans s\u00e4kerst\u00e4lls genom att ange flera DNS-servrar. <\/p>\n

F\u00f6retaget MasterCard ignorerade f\u00f6rst meddelandet om problemet, men efter att journalisten Brian Krebs kontaktade dem erk\u00e4nde de och \u00e5tg\u00e4rdade felet, och p\u00e5stod att felet inte utgjorde n\u00e5gon risk f\u00f6r infrastrukturen. D\u00e4refter skickades en beg\u00e4ran fr\u00e5n MasterCard till forskaren via tj\u00e4nsten Bugcrowd, som m\u00f6jligg\u00f6r att f\u00e5 ers\u00e4ttning f\u00f6r uppt\u00e4ckta s\u00e5rbarheter, om att ta bort den publicerade notisen om incidenten. <\/p>\n

I sitt svar uppgav forskaren att \u00e4ven om han har ett konto p\u00e5 tj\u00e4nsten Bugcrowd, har han inte skickat in n\u00e5gra bel\u00f6ningsans\u00f6kningar utan ist\u00e4llet direkt informerat f\u00f6retaget MasterCard om problemet. Anteckningen publicerades f\u00f6r att dra uppm\u00e4rksamhet till problemet efter att f\u00f6retaget MasterCard inte l\u00e4ngre var hotat och dom\u00e4nen \"akam.ne\" tillh\u00f6rde forskaren. I slut\u00e4ndan kom f\u00f6retaget MasterCard inte bara inte att kompensera de $300 som spenderades p\u00e5 dom\u00e4nen, utan tackade heller inte forskaren ens med ord. <\/p>\n

N\u00e4r det g\u00e4ller p\u00e5st\u00e5endet att felet inte skapade n\u00e5gra ytterligare risker, presenterade forskaren statistik \u00f6ver de erh\u00e5llna DNS-f\u00f6rfr\u00e5gningarna, d\u00e4r dom\u00e4ner som *.az.mastercard.com f\u00f6rekom, vilket pekar p\u00e5 fungerande komponenter i MasterCards infrastruktur som \u00e4r placerade i Microsoft Azures molntj\u00e4nst. Kompromettering av s\u00e5dana komponenter utgjorde uppenbarligen ett kritiskt hot mot s\u00e4kerheten.

\"P\u00e5<\/center>
\n
K\u00e4lla: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Seralys \u0432\u044b\u044f\u0432\u0438\u043b \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043f\u043e\u0434\u043c\u0435\u043d\u044b DNS-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043b\u044f \u0434\u043e\u043c\u0435\u043d\u0430 mastercard.com, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0433\u043e \u0432 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0435 \u043f\u043b\u0430\u0442\u0451\u0436\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b MasterCard. \u0412 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430\u0445 \u0434\u043e\u043c\u0435\u043d\u043d\u043e\u0439 \u0437\u043e\u043d\u044b mastercard.com \u0441 \u0438\u044e\u043d\u044f 2020 \u0433\u043e\u0434\u0430 \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u043e\u0432\u0430\u043b\u0430 \u043e\u043f\u0435\u0447\u0430\u0442\u043a\u0430 — \u0432 \u0441\u043f\u0438\u0441\u043a\u0435 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u044e\u0449\u0438\u0445 \u0437\u043e\u043d\u0443 DNS-\u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u0432\u043c\u0435\u0441\u0442\u043e \u0445\u043e\u0441\u0442\u0430 «a22-65.akam.net» (DNS-\u0441\u043b\u0443\u0436\u0431\u0430 Akamai) \u0431\u044b\u043b \u0443\u043a\u0430\u0437\u0430\u043d \u0445\u043e\u0441\u0442 «a22-65.akam.ne». \u041a\u043e\u0440\u043d\u0435\u0432\u0430\u044f \u0437\u043e\u043d\u0430 «.ne» \u0437\u0430\u043a\u0440\u0435\u043f\u043b\u0435\u043d\u0430 \u0437\u0430 \u0420\u0435\u0441\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0439 \u041d\u0438\u0433\u0435\u0440 \u0438 \u0434\u043e\u043c\u0435\u043d «akam.ne» \u043e\u043a\u0430\u0437\u0430\u043b\u0441\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":121456,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-121455","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47P\u00e5 grund av ett skrivfel i inst\u00e4llningarna kunde angripare byta ut DNS-servern f\u00f6r MasterCard | ProHoster","description":"S\u00e4kerhetsforskaren fr\u00e5n f\u00f6retaget Seralys identifierade m\u00f6jligheten att byta DNS-server f\u00f6r dom\u00e4nen mastercard.com, som anv\u00e4nds i infrastrukturen f\u00f6r betalningssystemet MasterCard.","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/news\/iz-za-opechatki-v-nastrojkah-atakuyushhie-mogli-podmenit-dns-server-mastercard","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0418\u0437-\u0437\u0430 \u043e\u043f\u0435\u0447\u0430\u0442\u043a\u0438 \u0432 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430\u0445 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435 \u043c\u043e\u0433\u043b\u0438 \u043f\u043e\u0434\u043c\u0435\u043d\u0438\u0442\u044c DNS-\u0441\u0435\u0440\u0432\u0435\u0440 MasterCard | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Seralys \u0432\u044b\u044f\u0432\u0438\u043b \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043f\u043e\u0434\u043c\u0435\u043d\u044b DNS-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043b\u044f \u0434\u043e\u043c\u0435\u043d\u0430 mastercard.com, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0433\u043e \u0432 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0435 \u043f\u043b\u0430\u0442\u0451\u0436\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b MasterCard.","og:url":"https:\/\/prohoster.info\/sv\/blog\/news\/iz-za-opechatki-v-nastrojkah-atakuyushhie-mogli-podmenit-dns-server-mastercard","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-01-23T13:46:03+00:00","article:modified_time":"2026-02-04T15:53:52+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"121455","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-08 21:04:47","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 09:56:19","updated":"2026-02-08 21:04:47","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/121455","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=121455"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/121455\/revisions"}],"predecessor-version":[{"id":158134,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/121455\/revisions\/158134"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media\/121456"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=121455"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=121455"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=121455"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}