Comment by IncRnd | Hacker News Reader

Comment by IncRnd | Hacker News Reader

"Bitsquatting is a form of cybersquatting which relies on bit-flip errors that occur during the process of making a DNS request. These bit-flips may occur due to factors such as faulty hardware or cosmic rays. When such an error occurs, the user requesting the domain may be directed to a website registered under a domain name similar to a legitimate domain, except with one bit flipped in their respective binary representations.

"A 2011 Black Hat paper detailed an analysis where eight legitimate domains were targeted with thirty one bitsquat domains. Over the course of one day, 3,434 requests were made to bitsquat domains." [1]

Cisco presented a paper on bitsquatting at defcon, "Examining the Bitsquatting Attack Surface". From the paper, "The conclusion is that the possibility of bitsquat attacks is more widespread than originally thought, but several techniques exist for mitigating the effects of these new attacks." [2]

[1] https://en.wikipedia.org/wiki/Bitsquatting

[2] https://media.defcon.org/DEF%20CON%2021/DEF%20CON%2021%20pre...

I had the pleasure of working with the author for a brief time, and I attended his presentation. Great stuff. What I found particularly interesting is some later work that characterized the probability of error based upon the device type, and the ambient temperature (based on IP Geo-location).

> "A 2011 Black Hat paper detailed an analysis where eight legitimate domains were targeted with thirty one bitsquat domains. Over the course of one day, 3,434 requests were made to bitsquat domains." [1]

So I had a look into the paper, because I was curious how they would differentiate typos from bitflips ... turns out they don't. Bummer. There's only some assumptions made here and there without any further explanation. It could even be the result of bad OCR or whatever weird stuff people do on the internet ...

I am not questioning the result and also believe it's most likely bitflips in a lot (most?) cases, but I would have really loved some more insight in that domain ... pun intended.

How does a comic bit flip make it past the Ethernet CRC?

It occurs in your machine before hitting the network.

because your machine vendor was too cheap to use ECC DRAM.

Thank you Mr. Torvalds

Would you like to hear my opinion of NVidia?

Please be sure to remove any young children from the room beforehand.

Raymond Chen said a few years ago that overclocked machines produce a lot of spurious crash reports: https://devblogs.microsoft.com/oldnewthing/20050412-47/?p=35...

If those computers are scribbling over memory at random, then that's occasionally going to cause some crashes, but much more commonly result in silent data corruption.

Amazing comment, this is wild. Thank you for sharing this!

Is one mitigation TLS certificate verification?

It depends on whether or not the client specifically requested, or is expecting, traffic over HTTPS. But yes, if the user's client requests encrypted traffic, the attacker will not be able to produce a valid certificate. This attack isn't that different than a MITM.

Nothing prevents an attacker from getting a cert for snytimg.com or oslashdot.org.

That only helps the attacker if the error happened before reaching the DNS-specific path. If the error happens inside the DNS path, then the browser is still expecting to get a certificate for the correct website.

If the error happens inside the DNS path, the name in the answer won't match the name in the query. The browser is still expecting to get an answer for the hostname it sent.

Depends on where in the stack the error happened.

Reply on news.ycombinator.com