Security News > 2021 > March > Fintech Giant Fiserv Used Unclaimed Domain

If you sell Web-based software for a living and ship code that references an unregistered domain name, you are asking for trouble.

A quick search of WHOIS registration records showed the domain was unregistered.

"It appears that the domain is provided as a default, and customer bank IT departments are either assuming they don't need to change it, or are not aware that they could/should," Vegh said, noting that a malicious person who stumbled on his discovery earlier could have had a powerful, trusted domain from which to launch email phishing attacks.

New York-based Union Bank also sent customer information to the researcher's domain.

"We have identified 5 clients for which auto-generated emails to their customers included the domain name"defaultinstitution.com" in the "reply-to" address," Fiserv said in a written statement.

"This placeholder URL was inadvertently left unchanged during implementation of these solutions. Upon being made aware of the situation we immediately conducted an analysis to locate and replace instances of the placeholder domain name. We have also notified the clients whose customers received these emails."

News URL

https://krebsonsecurity.com/2021/03/fintech-giant-fiserv-used-unclaimed-domain/