Take Quiz

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1

What was the specific DNS misconfiguration error in Mastercard's DNS servers that persisted for nearly five years?

A nameserver IP address was listed as IPv4 instead of IPv6 causing resolution failures. One of Mastercard's DNS servers was running insecure DNS over UDP instead of DNS over TLS. A nameserver domain was incorrectly listed as "akam.ne" missing the final 't' in ".net". Mastercard's DNS servers had expired certificates causing TLS handshake failures.

Question 2

Why do DNS over TLS (DoT) servers tend to drop connections quickly after establishment?

Because clients typically switch quickly to DNS over HTTPS (DoH), making DoT connections obsolete. Due to incompatibility between IPv4 and IPv6 connections causing handshake failures. Because UDP packets carrying DNS queries are more efficient, so TLS is avoided. Because TLS connections require significant server resources to maintain state, which are costly for busy servers.

Question 3

How does the typical web browser's DNS query behavior make the performance cost of DNS over TLS feasible?

Browsers switch to unencrypted DNS for performance-critical queries to avoid overhead. DNS queries occur in bursts, allowing amortization of expensive connection setup over many queries. DNS queries use a multicast broadcast that is faster despite TLS overhead. Browsers cache all DNS queries for months, reducing the need for frequent resolutions.

Question 4

What key limitation did the attacker pose by registering the misnamed "akam.ne" domain for Mastercard's DNS?

The attacker prevented Mastercard employees from accessing internal DNS servers by blocking "akam.net" domains. The attacker could intercept about one-fifth of Mastercard's DNS queries and could leverage TTL to affect much more traffic. The attacker gained full administrative control over Mastercard's banking systems remotely. The attacker was able to remotely execute malware on Mastercard's servers via the DNS misconfiguration.

Question 5

What was the unexpected discovery made when benchmarking DNS over TLS compared to traditional DNS over UDP?

Encrypted DNS servers allow unlimited idle connection time to clients as they have abundant resources. DNS over TLS eliminates all DNS query latency compared to traditional DNS over UDP by using optimized cryptography. Encrypted DNS requires TCP connections with significant handshake overhead and state that cause server impatience with idle connections. DNS over TLS delivers queries and responses in single UDP packets just like traditional DNS.

Cancel

Episode #1010 Quiz

Question 1

Question 2

Question 3

Question 4

Question 5