“Millions” of sensitive US military emails were reportedly sent to Mali due to a typo
www.theverge.com
Emails have been mistakenly routed to Mali for over a decade.

‘Millions’ of sensitive US military emails were reportedly sent to Mali due to a typo::Millions of emails were misdirected to Mali due to a typo that swapped the US military’s .MIL domain for Mali’s .ML domain, according to a report from the Financial Times.

  • Mic_Check_One_Two@reddthat.comEnglish
    8·
    1 year ago

    That’s what we in the cybersec business call an “oopsie daisy I made a little fucky-wucky”.

    For real though, this isn’t a problem yet. The TL;DR is that Mali has a top-level domain “.ml”. Just like “.co.uk” for the UK. And the military uses the domain “.mil”.

    So lots of emails accidentally get sent to “[Military email]@[Military email server].ml” instead of sending to .mil. So a bad actor could simply set up an e-mail server with .ml domains that mirror the military’s .mil ones, and start collecting all of those mis-addressed emails.

    So why isn’t it an issue yet? Because a Dutch contractor had a contract with Mali to manage their domain. They literally signed administrative rights for the .ml domain over to that Dutch contractor. And that contractor was the one who originally noticed the issue, since he saw lots of emails failing to deliver to sites like army.ml and navy.ml. He set up some quick domains to capture said emails, but it was quickly overwhelmed by the sheer volume; He’s received over a hundred thousand since January. But that contract ends this week, so Mali could 100% start registering their own domains when that contract expires and current domain registrations begin expiring.

    • Mic_Check_One_Two@reddthat.comEnglish
      2·
      1 year ago

      This isn’t Microsoft’s fault though?

      The US military uses the .mil domain, and Mali uses the .ml domain. People in the military/contractors keep typoing email addresses and sending them to the .ml domain instead of .mil.

      The nuclear move would simply be for the military to disallow any emails to the .ml domain, and warn contractors about the issue so they can do the same. It’d block any legitimate emails to a .ml domain, but aside from diplomats there likely isn’t a huge need to email anyone at a .ml domain anyways. Those people who do need to do so could be selectively allowed to email .ml addresses.