Mastercard’s multi-year DNS cut-and-paste nightmare – Source: www.csoonline.com

Due to a Domain Name System (DNS) setting error, which the security researcher who discovered it said was almost certainly a cut-and-paste problem, Mastercard had a DNS record with a missing character for almost five years. That error would have allowed attackers to potentially take over the subdomain, create a bogus site that mimics the legitimate Mastercard site, and then trick customers into revealing sensitive details and credentials. 

Mastercard confirmed the DNS glitch in a statement to KrebsOnSecurity. “We have looked into the matter and there was not a risk to our systems,” the MasterCard spokesperson wrote. “This typo has now been corrected.”

But the security researcher who discovered the error said the nature of the glitch looks much more like a cut-and-paste error than a typo.

Philippe Caturegli, who calls himself the chief hacking officer at security firm Seralys, said the issue was that a DNS record was pointing to an address ending in “.ne” when it was supposed to end in “.net”.

Because of the nature and length of DNS strings, Caturegli said it is likely the technician used cut-and-paste to transfer the data. If the person moving the data is not very careful, cut-and-paste can often lose one character, either at the end or the beginning of the string. That is what apparently happened, he said.

This mess gets even messier, thanks to a combination of factors that are known to cause many cybersecurity issues: third party risk, and subdomains that were not primarily Mastercard’s. The problem misnamed one of five shared DNS servers at internet service provider Akamai, which directs traffic for portions of Mastercard’s network, sending requests to the incorrect address.

The keystrokes being cut and pasted, according to Caturegli, were being handled by yet another third party, a company called CSC that, ironically, bills itself as “managing and mitigating cybersecurity risk” related to “cyber threats such as domain name and DNS hijacking.” 

Another security executive, CIP CEO Andy Jenkinson, reviewed the Mastercard problem and labeled it “appalling.”

“I am unsure what the security team at Mastercard does, but it’s certainly not basic security,” Jenkinson said. “For five years, this was not picked up, so quality control was not checking. I put this down to human error and oversight. Somebody didn’t even think about checking.”

CSO reached out to Mastercard for comment, but the company did not reply by deadline.

Caturegli announced his findings publicly in a LinkedIn post where he asked CISOs and IT leaders to “please double-check your DNS records (because) a single typo can open the door to man-in-the-middle attacks, phishing, data interception, and more. If you don’t control the domain your NameServers are pointing to, attackers might.”

Caturegli told CSO that, due to the nature of the Mastercard DNS setup, a site visitor would have only gone to the bogus address once out of every five times. But given the massive volume of traffic that Mastercard attracts, that 20% still amounted to a lot of potential victims.

“To be fair, it was only a subdomain. From what I have seen, there was no mail server on that subdomain, which was used for Azure services,” Caturegli said. “[But] as an end user, you have no idea of where you are going. You are simply trusting the DNS.”

The problem is that this kind of cut-and-paste error is very easy to make, and the nature of the character strings makes it difficult to detect the error. Even worse, if the error is not detected right away, it could remain in place for an extended period, as Mastercard has learned. 

“You need to continually check your configurations for any obvious mistakes. But with DNS, once it is configured, it is not going to generate an error,” Caturegli said. “Unless you check your configuration, you are not going to know about this issue. You can’t rely on tools. They wouldn’t even have any logs (showing the error). They won’t see it on any of their logs.”