Latest news of the domain name industry

Recent Posts

Bit-squatting – the latest risk to domain name owners

Kevin Murphy, July 26, 2011, 11:18:24 (UTC), Domain Tech

Forget phishing, forget cybersquatting, forget typosquatting, high-value domain name owners may have a whole new threat to worry about – “bit-squatting”.
This appears to be the conclusion of fascinating new research to be presented by Artem Dinaburg at the Black Hat and DEF CON hacker conferences in Las Vegas next week.
Defective internet hardware, it turns out, may be enabling a whole new category of typosquatting that could prove worrying for companies already prone to domain name abuse.
According to a summary of Dinaburg’s research, RAM chips can sometimes malfunction due to heat or radiation, resulting in “flipped bits”, where a 1 turns into a 0 or vice-versa.
Because the DNS uses ASCII encoding, a query containing a single flipped bit could actually send the user to a completely different domain name to the one they intended to visit.
To test the theory, Dinaburg appears to have registered the typo domain name mic2osoft.com. While it’s not visually confusing or a likely typo, in binary it is only one bit different to microsoft.com.
The ASCII binary code for the digit 2 is 00110010, which is only one bit different to the lower-case letter r, 01110010.
The binary for the string “microsoft” is:

011011010110100101100011011100100110111101110011011011110110011001110100

and the binary encoding for “mic2osoft” is (with the single changed bit highlighted):

011011010110100101100011001100100110111101110011011011110110011001110100

Therefore, if that one bit were to be accidentally flipped by a dodgy chip, the user could find themselves sending data to the bit-squatter’s domain rather than Microsoft’s official home.
I would assume that this is statistically only a concern for very high-traffic domains, and only if the bit-flipping malfunction is quite widespread.
But Dinaburg, who works for the defense contractor Raytheon, seems to think that it’s serious enough to pay attention to. He wrote:

To verify the seriousness of the issue, I bit-squatted several popular domains, and logged all HTTP and DNS traffic. The results were shocking and surprising, ranging from misdirected DNS queries to requests for Windows updates.
…
I hope to convince the audience that bit-squatting and other attacks enabled by bit-flip errors are practical, serious, and should be addressed by software and hardware vendors.

His conference presentations will also discuss possible hardware and software solutions.
For large companies particularly at risk of typosquatting, the research may also present a good reason to conduct a review of their trademark enforcement strategies.
I’m not going to be in Vegas this year, but I’m looking forward to reading more about Dinaburg’s findings.
The annual Black Hat and DEF CON conferences are frequently the venues where some of the most beautifully creative DNS hacks are first revealed, usually by Dan Kaminsky.
Kaminsky is not discussing DNS this year, judging by the agendas.
The conferences were founded by Jeff Moss, aka The Dark Tangent, who joined ICANN as its chief security officer earlier this year.

Tagged: , , , , , , , , ,

Comments (15)

  1. Nic says:
    July 26, 2011 at 11:57 am

    What a wonderfully original, relevant, and highly interesting piece, Kevin.

    Reply
  2. Tom says:
    July 26, 2011 at 4:41 pm

    Never heard of but-squatting before this article…thanks for shedding light on the subject.

    Reply
  3. Louise says:
    July 26, 2011 at 5:18 pm

    That is really interesting – thanx!

    Reply
  4. Acro says:
    July 26, 2011 at 9:16 pm

    For those that don’t understand binary, it sounds feasible. Fortunately (or unfortunately) there is no such danger from this new buzzword of pseudo-security concern. Computer bits don’t flip at random, there are parity mechanisms in place to correct such errors or else we’d find ourselves land in the wrong side of the world every few clicks of the browser. The “concept” would have worked nicely in the early days of tube computers though 😀

    Reply
    • Kevin Murphy says:
      July 27, 2011 at 9:14 am

      You sound awfully confident about that, Acro.
      This guy says he has 6 months worth of data showing that flipped bits have sent his squats traffic.

      Reply
    • xilun says:
      August 4, 2011 at 11:00 pm

      You are fucking damn wrong. Most desktop computers don’t have ECC memory (IMO not having ECC almost everywhere is one of the most stupid and almost criminally dangerous decision the computer industry did) and google (and prolly others) shown that even machines that seems to work well sometimes exhibit random flip behavior (in the very long run).
      So in a gigantic pool of computer like Internet is, it’s obvious that this will sometimes happen.

      Reply
  5. Trico says:
    July 26, 2011 at 9:59 pm

    “Fortunately…there is no such danger from this new buzzword of pseudo-security concern. Computer bits don’t flip at random, there are parity mechanisms in place to correct such errors…”
    Acro,
    So are you saying my registering BitSquatting.com and Bit-Squatting.com was a waste?
    🙂

    Reply
  6. Arnaud Diederen says:
    August 4, 2011 at 3:50 pm

    Trico,
    you should have registered BitS1uatting.com, too.
    A.

    Reply
  7. Anonymous Coward says:
    August 4, 2011 at 9:16 pm

    ECC corrects single bit errors and detects double bit errors. No one who knows what they are doing would use desktop memory for a server application.

    Reply
  8. Anonymous Coward says:
    August 5, 2011 at 2:02 am

    Valid point — so basically this is a low probability request redirection that possibly malicious. SSL layer should still protect sensitive information but this vulnerability combined with a browser exploit could be very dangerous.

    Reply
  9. Alexander Samantsov says:
    August 6, 2011 at 9:24 am

    It’s intresting, but when we could see statistic of such faults. It sound very unrealistic to have a huge probability to happen.

    Reply
  10. Vladimir Rusinov says:
    August 7, 2011 at 5:15 pm

    So… where’s the numbers? How much requests there actually was? Having 1 windows update request going to different location in a year is not very big deal.

    Reply

Add Your Comment