3 ms·
The requesting computer has a bit flip and requests the wrong domain. It even is not stopped by HTTPS depending on where the bit flip happens and how the softwa
by uconnectlol 4y ago
The requesting computer has a bit flip and requests the wrong domain. It even is not stopped by HTTPS depending on where the bit flip happens and how the software is written.
- burnte 4y agoIs there any data to support the hypothesis that this happens often? I've never experienced it without being a human typo. I find it hard to believe in this day and age we have a single service that has high error rates no one notices.
- tgsovlerkhgsel 4y agoThere are plenty of substitutions that are plausible as a bit-flip but much less plausible as a human typo. For a popular service or large company, the percentage of such errors can be very small while still resulting in a high absolute number of misdirected e-mails.
- captainkrtek 4y agohttps://m.youtube.com/watch?v=aT7mnSstKGs https://m.youtube.com/watch?v=aT7mnSstKGs Old defcon talk on this
- uconnectlol 4y agoThe trick was that over a large number of machines it becomes likely to happen.
- bitexploder 4y agoMy own anecdotal experience. The talk. We essentially registered some popular domain bitflips, set up some honeypot style collectors and listened. Saw way more traffic than we expected and decided it was worth offering to customers ad a proof of concept, some stuck with it for some time. Now there is a cottage industry around “domain protection” and really all you have to do register your bitflip and typo domains if you are a big company or service provider where this matters. But it was fin demonstrating the why to them :)