Typo sends millions of US military emails to Russian ally Mali
Typo sends millions of US military emails to Russian ally Mali
Some of the emails reportedly contain sensitive information such as passwords and medical records.
Millions of US military emails have been mistakenly sent to Mali, a Russian ally, because of a minor typing error.
Emails intended for the US military's ".mil" domain have, for years, been sent to the west African country which ends with the ".ml" suffix.
Some of the emails reportedly contained sensitive information such as passwords, medical records and the itineraries of top officers.
You're viewing a single thread.
That’s what we in the cybersec business call an “oopsie daisy I made a little fucky-wucky”.
For real though, this isn’t a problem yet. The TL;DR is that Mali has a top-level domain “.ml”. Just like “.co.uk” for the UK. And the military uses the domain “.mil”. So lots of emails accidentally get sent to “[Military email]@[Military email server].ml” instead of sending to .mil.
So a bad actor could simply set up an e-mail server with .ml domains that mirror the military’s .mil ones, and start collecting all of those mis-addressed emails.
So why isn’t it an issue yet? Because we had a contract with Mali to manage their domain. They literally signed administrative rights for the .ml domain over. So the US was able to basically set up their own .ml mirrored sites, to capture all of those mis-addressed emails. They have captured thousands throughout the years, because military members keep misaddressing their emails. Supposedly containing all kinds of sensitive data. Everything from medical records to troop movements and equipment inspection reports.
But that contract ends this week, so Mali could 100% start registering their own domains when that contract expires and domain registrations begin expiring.
One solution to this would be to set the .mil mail servers to either correct or bounce all .ml addressed mail, no? It makes emailing legitimate .ml addresses more difficult, but requiring a second, dedicated gateway or mailserver for .ml would be at most inconvenient.
Permanently Deleted
which I would hope is trivial for them to do without requiring the job to be bid on…
As someone with moderate experience working for the federal government, I wish I had your hopes
Permanently Deleted
Glad you can agree you're a delusional piece of shit
Hey now, don't be a dick.