Top all-time · #2790
Artem Dinaburg
Personal blog · dinaburg.orgsecurity
Artem Dinaburg's personal blog at dinaburg.org covers security. Since 2012, 27 different Hacker News readers have linked it 30 times, most often “Bitsquatting: DNS Hijacking without exploitation”. The last post was in 2015, but the archive is still widely read.
Computer Security and Various Thoughts
Most-linked posts?
- Bitsquatting: DNS Hijacking without exploitation25 people · 27 mentions · first linked 2012-11-18
What Hacker News says?
It depends where the failure happens. Sometimes you really lose the “failure in the wrong place” lottery. For example, in a domain name: http://dinaburg.org/bitsquatting.html
Comment linking /bitsquatting.html
on “ECC matters”Submitted Bitsquatting: DNS Hijacking without exploitation as a story · 107 points
HN discussionThat kind of thing is often exploited in a security context. See: http://dinaburg.org/bitsquatting.html
Comment linking /bitsquatting.html
on “What is a coder's worst nightmare? (2014)”Submitted Bitsquatting: DNS Hijacking without exploitation (2011) as a story · 38 points
HN discussionAnother one to add: if N is big enough, even statistically improbable events like single bit flips in memory become likely or even nigh-certain. For example, if you set up a bunch of fake domains that differ from real domains in a single bit, you might get upwards of a dozen hits per day from clients clearly trying to reach the real service - this is called Bitsquatting: http://dinaburg.org/bitsquatting.html For exa…
Comment linking /bitsquatting.html
on “Some Useful Probability Facts for Systems Programming”Submitted Bitsquatting: DNS Hijacking without exploitation as a story · 15 points
HN discussionSorry, I consider this to be a very poor defence. You might trust the site you go to; but that's not all the javascript that gets loaded, there are includes that a lot of web developers will use for convenience, there are ad networks and there are bugs that could allow some unintended javascript to get loaded (like with bit-squatting[0]). It's not a given that you're safe running javascript if you only visit sites y…
Comment linking /bitsquatting.html
on “How to make Linux run fast again on Intel CPUs”Submitted Bitsquatting: DNS Hijacking without exploitation as a story · 6 points
HN discussionIf you don't believe in bit flips, try this! http://dinaburg.org/bitsquatting.html I did that for a bit on cloudfront.net and got dozens of them in a short amount of time.
Comment linking /bitsquatting.html
on “For a brief period, the Windows kernel tried to deal with gamma rays”Submitted Bitsquatting: DNS Hijacking without exploitation as a story · 4 points
HN discussionI reproduced this by bit-squatting cloudfront.net after reading about it. So many memory errors! http://dinaburg.org/bitsquatting.html Loved the variety as well. Sometimes though requests came to me the Host header was correct!
Comment linking /bitsquatting.html
on “Should I buy ECC memory? (2015)”Submitted Bitsquatting as a story · 3 points
HN discussionBitsquatting refers to registering a domain name one bit different from the target domain name. The intent is that a memory error will cause someone to get the bitsquatted site instead of the legitimate one. "During the logging period there were a total of 52,317 bitsquat requests from 12,949 unique IP addresses. When not counting 3 events that caused extraordinary amounts of traffic, an average of 59 unique IPs per…
Comment linking /bitsquatting.html
on “Best CPUs for Workstations: 2017”Submitted Bitsquatting: DNS Hijacking Without Exploitation as a story · 2 points
HN discussionPeople don't realize how frequent it could be because most of the time you don't see any of the consequences. Here's a "funny" consequence of bit flips: bit squatting. It's about exploiting a bit flip before a DNS query: you register the proper DNS domain and you wait for machines to wrongly contact you because they got the name wrong. http://dinaburg.org/bitsquatting.html http://dinaburg.org/data/DC19_Dinaburg_Pres…
Comment linking /data/DC19_Dinaburg_Presentation.pdf
on “Intel Announces Skylake-X: Bringing 18-Core HCC Silicon to Consumers”Submitted Bitsquatting: DNS Hijacking without exploitation as a story · 2 points
HN discussionIf you think bit flipping is rare, check out this write-up: http://dinaburg.org/bitsquatting.html Bitsquatting: DNS Hijacking without exploitation When bit-errors occur they can change memory content. Computer memory content has semantic meaning. Sometimes, that meaning will be a domain name. And applications utilizing that memory will use the wrong domain name.
Comment linking /bitsquatting.html
on “Intel Announces 9th Gen Core CPUs”Submitted Bitsquatting: DNS Hijacking without exploitation (2011) as a story · 1 points
HN discussionThis reminds me of Bitsquatting, which is like typosquatting but uses domains one bit-flip away instead of one mistyped letter away.[0] In a small experiment, for some popular domains, the author reportedly got a lot of hits. In the associated DEFCON talk, the author notes that even if you use ECC memory, it's unlikely that the DRAM in your hard drives does too.[1] 0: http://dinaburg.org/bitsquatting.html 1: https:/…
Comment linking /bitsquatting.html
on “Cosmic rays causing 30k network malfunctions in Japan each year”- jf · 2016-06-02
Submitted Bitsquatting: DNS Hijacking without exploitation as a story · 1 points
HN discussion Try multiple times a second. This guy made a hobby of taking advantage of cosmic radiation bit flips to cause dns lookup problems and capturing data. http://dinaburg.org/bitsquatting.html
Comment linking /bitsquatting.html
on “Ask HN: Why don't transistors in microchips fail?”Slightly related thing is RAM random bit errors. There was an interesting article published few years ago where some guy registered domains that differed by one bit from some popular domains and recorded the traffic that hit them. Kinda scary to think what else is wrong in your RAM then... Too bad that ECC is still restricted to servers and serious workstations. http://dinaburg.org/bitsquatting.html
Comment linking /bitsquatting.html
on “Ask HN: Why don't transistors in microchips fail?”Bit flipping is low-probability, but coupled to massive amount of events it comes out, Fermi-style, to "quite common, actually": http://dinaburg.org/bitsquatting.html
Comment linking /bitsquatting.html
on “Age of Invisible Disasters (2017)”There's an interesting phenomenon connected to this: http://dinaburg.org/bitsquatting.html
Comment linking /bitsquatting.html
on “Wind provided 37 per cent of Ireland’s electricity in Q1 2019”Bit errors have been used to hijack communications. Just register a bunch of domains that differ from popular ones by a single bit and watch the requests come in.[1] Typically, users don't recognize single bit errors. Something breaks and they think, "Stupid buggy software." With modern RAM capacities, you're pretty likely to get some bits flipped every few months. 1. http://dinaburg.org/bitsquatting.html
Comment linking /bitsquatting.html
on “Bringing Intel Xeon to notebook PCs”Reminded me of "bitsquatting": http://dinaburg.org/bitsquatting.html I wonder if anyone is doing this regularly. I didn't hear much about it after the initial fanfare.
Comment linking /bitsquatting.html
on “Attackers Used Look-Alike Domains to Steal $1M from a Chinese VC”Yep. Artem's web page has more information as well: http://dinaburg.org/bitsquatting.html
Comment linking /bitsquatting.html
on “Flip Feng Shui: A new cross-VM exploitation vector”> Bitsquatting it very similar [to typosquatting], but it involves registering do- mains with an ASCII encoding one bit different from the target to capitalize on random bitflips during the resolution process. Wow, kind of mind boggling that one can profitably (?) capitalize on random bit flips. More details here: http://dinaburg.org/bitsquatting.html
Comment linking /bitsquatting.html
on “A Large-Scale Analysis of Early Domain Deletions”I don't know of a debunking, but more numbers can be found in the associated blog post[1]. [1]: http://dinaburg.org/bitsquatting.html
Comment linking /bitsquatting.html
on “Imaging a Hard Drive with Non-ECC Memory – What Could Go Wrong?”
