Alexander Dinaburg

I reproduced this by bit-squatting cloudfront.net after reading about it. So many memory errors! http://dinaburg.org/bitsquatting.html Loved the variety as well. Sometimes though requests came to me the Host header was correct!

I don't know of a debunking, but more numbers can be found in the associated blog post[1]. [1]: http://dinaburg.org/bitsquatting.html

This reminds me of Bitsquatting, which is like typosquatting but uses domains one bit-flip away instead of one mistyped letter away.[0] In a small experiment, for some popular domains, the author reportedly got a lot of hits. In the associated DEFCON talk, the author notes that even if you use ECC memory, it's unlikely that the DRAM in your hard drives does too.[1] 0: http://dinaburg.org/bitsquatting.html 1: https://www.youtube.com/watch?v=9WcHsT97suU

It depends where the failure happens. Sometimes you really lose the “failure in the wrong place” lottery. For example, in a domain name: http://dinaburg.org/bitsquatting.html

Another one to add: if N is big enough, even statistically improbable events like single bit flips in memory become likely or even nigh-certain. For example, if you set up a bunch of fake domains that differ from real domains in a single bit, you might get upwards of a dozen hits per day from clients clearly trying to reach the real service - this is called Bitsquatting: http://dinaburg.org/bitsquatting.html For example, setting up the server "mic2osoft.com" (a one-bit-flip error from microsoft.com) yielded this request: msgr.dlservice.mic2osoft.com 213.178.224.xxx "GET /download/A/6/1/A616CCD4-B0CA-4A3D-B975-3EDB38081B38/ar/wlsetup-cvr.exe HTTP/1.1" 404 268 "Microsoft BITS/6.6" This is a machine trying to download some kind of update package from the wrong server because somewhere in its memory the "r" from "microsoft.com" got flipped to a 2 (0x72 -> 0x32).

> Bitsquatting it very similar [to typosquatting], but it involves registering do- mains with an ASCII encoding one bit different from the target to capitalize on random bitflips during the resolution process. Wow, kind of mind boggling that one can profitably (?) capitalize on random bit flips. More details here: http://dinaburg.org/bitsquatting.html

Reminded me of "bitsquatting": http://dinaburg.org/bitsquatting.html I wonder if anyone is doing this regularly. I didn't hear much about it after the initial fanfare.

Sorry, I consider this to be a very poor defence. You might trust the site you go to; but that's not all the javascript that gets loaded, there are includes that a lot of web developers will use for convenience, there are ad networks and there are bugs that could allow some unintended javascript to get loaded (like with bit-squatting[0]). It's not a given that you're safe running javascript if you only visit sites you trust. Even if you are INCREDIBLY sanitary, which I would argue is unrealistic (just check your history and you'll see that you probably visit many sites off of a google search). [0]: http://www.youtube.com/watch?v=lZ8s1JwtNas / http://dinaburg.org/bitsquatting.html

There's an interesting phenomenon connected to this: http://dinaburg.org/bitsquatting.html

If you think bit flipping is rare, check out this write-up: http://dinaburg.org/bitsquatting.html Bitsquatting: DNS Hijacking without exploitation When bit-errors occur they can change memory content. Computer memory content has semantic meaning. Sometimes, that meaning will be a domain name. And applications utilizing that memory will use the wrong domain name.

Bit flipping is low-probability, but coupled to massive amount of events it comes out, Fermi-style, to "quite common, actually": http://dinaburg.org/bitsquatting.html

Bitsquatting refers to registering a domain name one bit different from the target domain name. The intent is that a memory error will cause someone to get the bitsquatted site instead of the legitimate one. "During the logging period there were a total of 52,317 bitsquat requests from 12,949 unique IP addresses. When not counting 3 events that caused extraordinary amounts of traffic, an average of 59 unique IPs per day made HTTP requests to my 32 bitsquat domains." http://dinaburg.org/bitsquatting.html Overheating can be a cause of bit errors, and heat is a concern in mobile devices and laptops.

People don't realize how frequent it could be because most of the time you don't see any of the consequences. Here's a "funny" consequence of bit flips: bit squatting. It's about exploiting a bit flip before a DNS query: you register the proper DNS domain and you wait for machines to wrongly contact you because they got the name wrong. http://dinaburg.org/bitsquatting.html http://dinaburg.org/data/DC19_Dinaburg_Presentation.pdf http://www.youtube.com/watch?v=lZ8s1JwtNas Just saw this was already posted below...

Yep. Artem's web page has more information as well: http://dinaburg.org/bitsquatting.html

That kind of thing is often exploited in a security context. See: http://dinaburg.org/bitsquatting.html

Bit errors have been used to hijack communications. Just register a bunch of domains that differ from popular ones by a single bit and watch the requests come in.[1] Typically, users don't recognize single bit errors. Something breaks and they think, "Stupid buggy software." With modern RAM capacities, you're pretty likely to get some bits flipped every few months. 1. http://dinaburg.org/bitsquatting.html

Try multiple times a second. This guy made a hobby of taking advantage of cosmic radiation bit flips to cause dns lookup problems and capturing data. http://dinaburg.org/bitsquatting.html

Slightly related thing is RAM random bit errors. There was an interesting article published few years ago where some guy registered domains that differed by one bit from some popular domains and recorded the traffic that hit them. Kinda scary to think what else is wrong in your RAM then... Too bad that ECC is still restricted to servers and serious workstations. http://dinaburg.org/bitsquatting.html