4 ms·
I think it heavily depends on what az.mastercard.com actually is or does. Receiving email directed to x@mastercard.com doesn't sound right, since this is only
by silisili 2y ago
I think it heavily depends on what az.mastercard.com actually is or does.
Receiving email directed to x@mastercard.com doesn't sound right, since this is only a subdomain of unknown(to me) use. TLS? Probably, but again, the risk depends on what it is, and wouldn't affect users visiting 'mastercard.com.'
- diggan 2y agoI think the idea was that because this typod domain was being used behind the CDN, you could trick mastercard.com (that uses the CDN) somehow to serve from the hijacked domain that was misconfigured at the CDN. At least that's my guess, but it's not super clear what attacks would be possible here.
- cowsandmilk 2y agoIf JavaScript is served from those domains, there may be something interesting. Or if data is submitted to the domains.
- sfjailbird 2y agoWithout saying too much, I can tell you that this is no obscure subdomain. That traffic he showed represents the gateways for almost all web traffic into Mastercard solutions that run on Azure. Also, if you knew the culture in there, you would appreciate the extreme irony of them making a mistake like this.
- baobun 2y agoSpill the beans already!
- deleted 2y ago[deleted]