3 ms·

I remember reading how someone registered some google domains with a single bit flipped, and saw actual requests coming to them.

andrewstuart2 6y ago
If you or anybody can remember the source article, that sounds like an interesting read! Edit: found one with a quick search. https://nakedsecurity.sophos.com/2011/08/10/bh-2011-bit-squatting-dns-hijacking-without-exploitation/ https://nakedsecurity.sophos.com/2011/08/10/bh-2011-bit-squa... And https://www.researchgate.net/publication/262273269_Bitsquatting_Exploiting_bit-flips_for_fun_or_profit https://www.researchgate.net/publication/262273269_Bitsquatt...
- garaetjjte 6y ago
  Here's original paper: http://media.blackhat.com/bh-us-11/Dinaburg/BH_US_11_Dinaburg_Bitsquatting_WP.pdf http://media.blackhat.com/bh-us-11/Dinaburg/BH_US_11_Dinabur... But I'm not entirely convinced that most of these requests weren't just typos. Though those requests with mismatched Host header surely were true bitflips.
  - tyoma 6y ago
    There was some follow up work as well: http://blog.dinaburg.org/2013/09/bitsquatting-at-defcon21-and-more.html http://blog.dinaburg.org/2013/09/bitsquatting-at-defcon21-an... And I am beyond certain they were not typos; the requests were for long URLs that no one would be typing by hand. A few were for services that humans never enter urls into (like the Windows crash reporter).
- fart32 6y ago
  Also here: https://www.youtube.com/watch?v=gXY3jm34RFU https://www.youtube.com/watch?v=gXY3jm34RFU I can't find it right now, but I also saw someone doing this with some version of Google Now (or what it was back then) and serving different assets into it.
NickNameNick 6y ago
That works for any domain that's busy enough. Random bit flips happen on client machines and on routers. If there are enough requests for a domain name, some of those requests will be subject to one one of those bit-flips.
saagarjha 6y ago
That might just be typos in some cases?
Faaak 6y ago
A long time ago I did that with "CDN" domains. I bought ~10 of them (variations of fbcdn, akamai, and ytimg). I _did_ see some traffic (some hits per hour if I remember well), and many of them were from cheap handheld phones (from the user-agent).

andrewstuart2 6y ago

If you or anybody can remember the source article, that sounds like an interesting read! Edit: found one with a quick search. https://nakedsecurity.sophos.com/2011/08/10/bh-2011-bit-squatting-dns-hijacking-without-exploitation/ https://nakedsecurity.sophos.com/2011/08/10/bh-2011-bit-squa... And https://www.researchgate.net/publication/262273269_Bitsquatting_Exploiting_bit-flips_for_fun_or_profit https://www.researchgate.net/publication/262273269_Bitsquatt...

garaetjjte 6y ago
Here's original paper: http://media.blackhat.com/bh-us-11/Dinaburg/BH_US_11_Dinaburg_Bitsquatting_WP.pdf http://media.blackhat.com/bh-us-11/Dinaburg/BH_US_11_Dinabur... But I'm not entirely convinced that most of these requests weren't just typos. Though those requests with mismatched Host header surely were true bitflips.
- tyoma 6y ago
  There was some follow up work as well: http://blog.dinaburg.org/2013/09/bitsquatting-at-defcon21-and-more.html http://blog.dinaburg.org/2013/09/bitsquatting-at-defcon21-an... And I am beyond certain they were not typos; the requests were for long URLs that no one would be typing by hand. A few were for services that humans never enter urls into (like the Windows crash reporter).
fart32 6y ago
Also here: https://www.youtube.com/watch?v=gXY3jm34RFU https://www.youtube.com/watch?v=gXY3jm34RFU I can't find it right now, but I also saw someone doing this with some version of Google Now (or what it was back then) and serving different assets into it.

NickNameNick 6y ago

That works for any domain that's busy enough. Random bit flips happen on client machines and on routers. If there are enough requests for a domain name, some of those requests will be subject to one one of those bit-flips.

saagarjha 6y ago

That might just be typos in some cases?

Faaak 6y ago

A long time ago I did that with "CDN" domains. I bought ~10 of them (variations of fbcdn, akamai, and ytimg). I _did_ see some traffic (some hits per hour if I remember well), and many of them were from cheap handheld phones (from the user-agent).