4 ms·

bitflips are also single char typos in ascii. I'm guessing that is what you saw

by amichal 8y ago

Kenji 8y ago
Read the article before commenting, please. He addressed that.
detaro 8y ago
I think the article gives good reasons to believe they are not typos, why do you think otherwise?
- amichal 8y ago
  While i like the sibling comment's network errors answer better then mine I didn't see any reasoning other then a unfounded statement[1] in the article or on a quick skim for "typo" in the referenced whitepaper: [1] "These requests were not typos or other manually entered URLs"
  - bgirard 8y ago
    Here's a better quote: "There are many frequently resolved domains that few people type or know." There's a lot more details in the article.
  - eli 8y ago
    "All of these requests used only four domains in the HTTP Host header, as shown in Table 4. Three out of four domains contain more than one bit error, ruling out a simple mistype of fbbdn.net for fbcdn.net. "
    - seandougall 8y ago
      Not to mention, the number of people typing "fbcdn.net" into a browser has to be vanishingly small to begin with.
nestorD 8y ago
An interesting control would have been to flip a single bit but also flip a single char so that it flips several bits and compare the results. edit: Reading the linked article, they describe one of their validation method: > The Host header contains the domain the HTTP client resolved to connect to the bitsquat server. If the Host header matches the original domain, the corruption occurred on the red path (DNS path). If the Host header matches a bitsquat domain, the corruption occurred on the blue path (content path).
deleted 8y ago
[deleted]
asveikau 8y ago
Is that why some Microsoft download URL with a GUID in it made it to his server? Typo in Windows Update? I don't think that sounds right.
3pt14159 8y ago
This is easily testable because: 1. Not all single char typos are bitflips and when you test it statistically you get more traffic for bitflips than typos. It's a bit more complicated, some typos are really common because they're close to the key. 2. You can look at the raw traffic that comes in and tell what is a simple get request with a fat finger (GET https://en.7ikipedia.org/ https://en.7ikipedia.org/ vs GET https://en.wikipedia.org/w/index.php?search=america&title=Special%3ASearch&go=Go https://en.wikipedia.org/w/index.php?search=america&title=Sp...). Source: I have some domains that are bitsquats of some high traffic domains. I get access token headers when I do a raw dump of the traffic. (I turned off the servers after satisfying my curiosity.) Want to stop randos from getting some tiny portion of your traffic's access tokens? Use client side keys and send signed / encrypted access tokens or even full requests. Yeah I know. It's so far down the list it doesn't matter. But every combination of github.com, microsoft.com, etc is bitsquatted, so this attack can be considered ongoing. This is doubly true if you're on a domain like .co.uk which is a stupid subdomain of .uk and now that .uk addresses are available someone can buy ko.uk and bitsquat the entire fucking country.
spullara 8y ago
None of them were typed in. I was bitsquatting a CDN that no one would type into the browser bar. Everything was some resource referenced from a page. If you checked the original page, the correct URL was present in that page.

bitflips are also single char typos in ascii. I'm guessing that is what you saw

Kenji 8y ago

Read the article before commenting, please. He addressed that.

detaro 8y ago

I think the article gives good reasons to believe they are not typos, why do you think otherwise?

amichal 8y ago
While i like the sibling comment's network errors answer better then mine I didn't see any reasoning other then a unfounded statement[1] in the article or on a quick skim for "typo" in the referenced whitepaper: [1] "These requests were not typos or other manually entered URLs"
- bgirard 8y ago
  Here's a better quote: "There are many frequently resolved domains that few people type or know." There's a lot more details in the article.
- eli 8y ago
  "All of these requests used only four domains in the HTTP Host header, as shown in Table 4. Three out of four domains contain more than one bit error, ruling out a simple mistype of fbbdn.net for fbcdn.net. "
  - seandougall 8y ago
    Not to mention, the number of people typing "fbcdn.net" into a browser has to be vanishingly small to begin with.

nestorD 8y ago

An interesting control would have been to flip a single bit but also flip a single char so that it flips several bits and compare the results. edit: Reading the linked article, they describe one of their validation method: > The Host header contains the domain the HTTP client resolved to connect to the bitsquat server. If the Host header matches the original domain, the corruption occurred on the red path (DNS path). If the Host header matches a bitsquat domain, the corruption occurred on the blue path (content path).

deleted 8y ago

[deleted]

asveikau 8y ago

Is that why some Microsoft download URL with a GUID in it made it to his server? Typo in Windows Update? I don't think that sounds right.

3pt14159 8y ago

This is easily testable because: 1. Not all single char typos are bitflips and when you test it statistically you get more traffic for bitflips than typos. It's a bit more complicated, some typos are really common because they're close to the key. 2. You can look at the raw traffic that comes in and tell what is a simple get request with a fat finger (GET https://en.7ikipedia.org/ https://en.7ikipedia.org/ vs GET https://en.wikipedia.org/w/index.php?search=america&title=Special%3ASearch&go=Go https://en.wikipedia.org/w/index.php?search=america&title=Sp...). Source: I have some domains that are bitsquats of some high traffic domains. I get access token headers when I do a raw dump of the traffic. (I turned off the servers after satisfying my curiosity.) Want to stop randos from getting some tiny portion of your traffic's access tokens? Use client side keys and send signed / encrypted access tokens or even full requests. Yeah I know. It's so far down the list it doesn't matter. But every combination of github.com, microsoft.com, etc is bitsquatted, so this attack can be considered ongoing. This is doubly true if you're on a domain like .co.uk which is a stupid subdomain of .uk and now that .uk addresses are available someone can buy ko.uk and bitsquat the entire fucking country.

spullara 8y ago

None of them were typed in. I was bitsquatting a CDN that no one would type into the browser bar. Everything was some resource referenced from a page. If you checked the original page, the correct URL was present in that page.