The most appropriate group to review this material is the Federal Office for Information Security (BSI) Senior Policy & Infrastructure Audit Team, specifically those specializing in Governmental Shared Services and DNS Security Architecture.
Expert Persona: Senior Lead Auditor, Cybersecurity Infrastructure Division.
Abstract:
This audit report details critical vulnerabilities in German federal IT infrastructure resulting from systemic failures in domain lifecycle management and the use of insecure test data in production environments. The researcher, Tim Philipp Schäfers, demonstrated that official documentation for government applications (e.g., BAMF’s "Free" procedure) contained non-reserved test domains (testträger.de). By registering this domain, the researcher gained administrative access to user management systems via password reset functions, exposing hundreds of accounts and internal organizational structures. Furthermore, the acquisition of expired legacy domains (bfl.de) and typosquatted/bitsquatted domains (bund.ee) allowed for the interception of extensive internal DNS traffic from federal networks (BMI, ITZBund). This traffic revealed internal hostnames, software distribution points, and mail server configurations. The findings highlight the urgent need for a unified .gov Top-Level Domain (TLD) in Germany and more rigorous decommissioning protocols for legacy digital assets.
Audit Findings and Key Takeaways:
0:34 Diverse Agency IT Landscapes: Large agencies like the BAMF (Federal Office for Migration and Refugees) utilize complex, interconnected systems (e.g., ITF, Free, and integration environments) that manage sensitive personal data, including identity documents and health status.
3:08 Information Leakage in Documentation: Official manuals for government applications used "testträger.de" as a placeholder. The researcher purchased this domain for €5.97, established a catch-all email server, and utilized "forgot password" features to hijack the administrative account of "Max Mustermann."
4:21 Administrative Access and MFA Absence: Hijacking the test domain granted administrative rights over a user management portal. The audit found a total lack of multi-factor authentication (MFA) and identified hundreds of active user accounts, including those belonging to municipal employees and internal staff.
9:15 Risk Escalation via Legacy Domains: Government agencies frequently change names (e.g., Barfil to BAMF), leading to the abandonment of legacy domains. The researcher acquired bfl.de (expired in 2013) for €70 on a secondary market.
14:36 Domain Squatting and Trust Exploitation: Expired government domains are systematically purchased by third parties to host SEO-optimized content, casino advertisements, or AI-generated misinformation, leveraging the inherent "trust factor" of the old governmental URL.
16:44 Internal DNS Traffic Interception: By operating a nameserver for bfl.de, the researcher received persistent DNS queries originating from internal federal networks (e.g., 77.87.224.0/24). This revealed internal infrastructure details, including ADSP records and requests for "localhost" and internal software distribution servers (SRV NUR SWVT).
20:41 External Gateway Visibility: Log analysis indicated that internal requests were likely routed through Genua Gateways (Firewalls). The presence of requests for registration interfaces (EIS) suggests that sensitive application data could be redirected via manipulated DNS responses.
30:14 Typosquatting and Bitsquatting Vulnerabilities: The registration of bund.ee (a typosquat/bitsquat of bund.de) revealed that federal resolvers regularly leak internal queries to high-level domains due to bit-flips (hardware errors) or user typos.
26:11 Structural Deficit – Lack of .gov TLD: Unlike most nations (including North Korea), Germany lacks a mandatory .gov TLD. This results in a fragmented domain landscape (e.g., .de, .com, .org), making it impossible for citizens to verify the authenticity of official sites.
34:31 Transparency and Information Freedom: Due to government refusal to disclose active domains on security grounds, the "Frag den Staat" platform has released a database of 2,500+ government domains to help the public identify official digital touchpoints.
38:43 Recommendations for Mitigation: Audit suggests the adoption of Error Correcting Codes (ECC) to prevent bitsquatting, stricter domain decommissioning grace periods, and migrating all federal services to a centralized, protected naming scheme like bund.de or a future gov.de.