4 ms·
"Bitsquatting is a form of cybersquatting which relies on bit-flip errors that occur during the process of making a DNS request. These bit-flips may occur due t
by IncRnd 5y ago
"Bitsquatting is a form of cybersquatting which relies on bit-flip errors that occur during the process of making a DNS request. These bit-flips may occur due to factors such as faulty hardware or cosmic rays. When such an error occurs, the user requesting the domain may be directed to a website registered under a domain name similar to a legitimate domain, except with one bit flipped in their respective binary representations.
"A 2011 Black Hat paper detailed an analysis where eight legitimate domains were targeted with thirty one bitsquat domains. Over the course of one day, 3,434 requests were made to bitsquat domains." [1]
Cisco presented a paper on bitsquatting at defcon, "Examining the Bitsquatting Attack Surface". From the paper, "The conclusion is that the possibility of bitsquat attacks is more widespread than originally thought, but several techniques exist for mitigating the effects of these new attacks." [2]
[1] https://en.wikipedia.org/wiki/Bitsquatting https://en.wikipedia.org/wiki/Bitsquatting
[2] https://media.defcon.org/DEF%20CON%2021/DEF%20CON%2021%20presentations/DEF%20CON%2021%20-%20Schultz-Examining-the-Bitsquatting-Attack-Surface-WP.pdf https://media.defcon.org/DEF%20CON%2021/DEF%20CON%2021%20pre...
- chadwittman 5y agoAmazing comment, this is wild. Thank you for sharing this!
- anonymousiam 5y agoI had the pleasure of working with the author for a brief time, and I attended his presentation. Great stuff. What I found particularly interesting is some later work that characterized the probability of error based upon the device type, and the ambient temperature (based on IP Geo-location).
- pitaj 5y agoIs one mitigation TLS certificate verification?
- xenophonf 5y ago
- rat9988 5y ago> Why not read the linked paper, You answered your own question. The answer is in page 12, which means there is too much information. He is not interested in the whole topic, just about this question. So he asks, maybe someone is charitable enough to answer. Nothing wrong with it.
- tedunangst 5y ago
- xenophonf 5y agoHow could I possibly answer their question better than the experts who wrote the paper?
- rat9988 5y agoMaybe you can't but someone else can. The question is open to anyone who can and wants to answer.
- xenophonf 5y agoBut the answer is right there, section 2, starting on page 12 of the linked paper. We're hackers. Autodidacticism is our creed. Research papers are our bread and butter. Why settle for speculation from the pseudonymous masses when a rich vein of well written analysis by reputable authors is one click away?
- nixpulvis 5y agoSkim until you are in the right section? Literally titled: "Section II - Mitigation of bitsquatting attacks"
- simulate-me 5y agoIt depends on whether or not the client specifically requested, or is expecting, traffic over HTTPS. But yes, if the user's client requests encrypted traffic, the attacker will not be able to produce a valid certificate. This attack isn't that different than a MITM.
- tedunangst 5y agoNothing prevents an attacker from getting a cert for snytimg.com or oslashdot.org.
- legalcorrection 5y agoThat only helps the attacker if the error happened before reaching the DNS-specific path. If the error happens inside the DNS path, then the browser is still expecting to get a certificate for the correct website.
- tedunangst 5y agoIf the error happens inside the DNS path, the name in the answer won't match the name in the query. The browser is still expecting to get an answer for the hostname it sent.
- deleted 5y ago[deleted]
- legalcorrection 5y agoDepends on where in the stack the error happened.
- dahfizz 5y agoHow does a comic bit flip make it past the Ethernet CRC?
- aaaaaaaaaaab 5y agoIt occurs in your machine before hitting the network.
- octoberfranklin 5y agobecause your machine vendor was too cheap to use ECC DRAM.
- bobsmooth 5y agoThank you Mr. Torvalds
- octoberfranklin 5y agoWould you like to hear my opinion of NVidia? Please be sure to remove any young children from the room beforehand.
- sbierwagen 5y agoRaymond Chen said a few years ago that overclocked machines produce a lot of spurious crash reports: https://devblogs.microsoft.com/oldnewthing/20050412-47/?p=35923 https://devblogs.microsoft.com/oldnewthing/20050412-47/?p=35... If those computers are scribbling over memory at random, then that's occasionally going to cause some crashes, but much more commonly result in silent data corruption.
- numlock86 5y ago> "A 2011 Black Hat paper detailed an analysis where eight legitimate domains were targeted with thirty one bitsquat domains. Over the course of one day, 3,434 requests were made to bitsquat domains." [1] So I had a look into the paper, because I was curious how they would differentiate typos from bitflips ... turns out they don't. Bummer. There's only some assumptions made here and there without any further explanation. It could even be the result of bad OCR or whatever weird stuff people do on the internet ... I am not questioning the result and also believe it's most likely bitflips in a lot (most?) cases, but I would have really loved some more insight in that domain ... pun intended.