MasterCard DNS Error Went Unnoticed for Years

px_eliezer_

The payment card giant MasterCard just fixed a glaring error in its domain name server settings that could have allowed anyone to intercept or divert Internet traffic for the company by registering an unused domain name. The misconfiguration persisted for nearly five years until a security researcher spent $300 to register the domain and prevent it from being grabbed by cybercriminals.

From June 30, 2020 until January 14, 2025, one of the core Internet servers that MasterCard uses to direct traffic for portions of the mastercard.com network was misnamed. MasterCard.com relies on five shared Domain Name System (DNS) servers at the Internet infrastructure provider Akamai [DNS acts as a kind of Internet phone book, by translating website names to numeric Internet addresses that are easier for computers to manage].

All of the Akamai DNS server names that MasterCard uses are supposed to end in “akam.net” but one of them was misconfigured to rely on the domain “akam.ne.”

More detail here:
https://krebsonsecurity.com/2025/01/mastercard-dns-error-went-unnoticed-for-years/

It makes one think if there is other confusion between [dot net] and [dot ne] with "NE" being the top-level domain for the country of Niger. (Not to be confused with Nigeria whose top=level domain is [NG].

Likewise [dot com] with a simple typo becomes [dot co] which originally was for Colombia but now is in broader use.

[deleted]

px_eliezer_ interesting it went unnoticed so long

px_eliezer_

[deleted]

It's one of those things that get a retroactive facepalm.

Sort of similar on a smaller scale:

For a few years, I was never getting certain e-mails from a person who was supposed to be sending them to me. Finally figured out that on that person's address book, they had changed my address from [dot net] to [dot ne] and the bounce backs were never noticed.

broknsymetry

He should sell the domain to the highest bidder. 💰️

DrStrange

px_eliezer_ .ne is Niger...

cypherstream

Its always DNS.

RayGeode

This cavalier statement is astounding in it’s tone deafness. Never do business with them again.

“MasterCard acknowledged the mistake, but said there was never any real threat to the security of its operations.”