Practical waterholing through DNS typosquatting

Re:Practical waterholing through DNS typosquatting by HappyTypist on Friday June 23, 2017 @06:30AM (#14618159)

Another interesting approach is rely on cosmic background noise bit flips. Do it on Google.com and you can get a few thousand visitors a week

I.e. Register a domain where the ASCII representaton is 1 bit off.

[ Parent | on HN ]

Re:Practical waterholing through DNS typosquatting by YouKnowBetter on Friday June 23, 2017 @06:52AM (#14618223)

The original idea has a better name: Bitsquatting[0]

"Experiment To determine whether bit7errors can redirect connections to attacker controlled sites, the bitsquat domains in Table 3 were registered, and all HTTP requests to the domains were logged. The domains, such as li6e.com, mic2osoft.com, and fjcdn.net are very unlikely to be typos or keyboard errors."

[0] https://media.blackhat.com/bh-us-11/Dinaburg/BH_US_11_Dinabu...

[ Parent | on HN ]

Re:Practical waterholing through DNS typosquatting by eru on Friday June 23, 2017 @10:05AM (#14619215)

Thanks! That's brilliant.

[ Parent | on HN ]

Re:Practical waterholing through DNS typosquatting by brak1 on Friday June 23, 2017 @07:08AM (#14618293)

ISnt it more likely that it is just bots, that know your domain cos they have lists of every domain for that tld?

[ Parent | on HN ]

Re:Practical waterholing through DNS typosquatting by wfunction on Friday June 23, 2017 @07:16AM (#14618332)

Same question I had. Though it wouldn't be hard to control for, just put a random honeypot domain and see how many visits it gets.

[ Parent | on HN ]

Re:Practical waterholing through DNS typosquatting by oxplot on Tuesday June 27, 2017 @12:33AM (#14642597)

I didn't read the paper, but you'd know it'd bit squatting if the domain a-azon.com is hit with a HTTP Host header of amazon.com.

[ Parent | on HN ]

Re:Practical waterholing through DNS typosquatting by x0rz on Friday June 23, 2017 @07:02AM (#14618267)

Yep, bitsquatting is also a very cool thing, first research on that topic was in 2011 IIRC :)

Typosquatting = human error

Bitsquatting = machine error (bitflip)

[ Parent | on HN ]

Re:Practical waterholing through DNS typosquatting by gruez on Friday June 23, 2017 @06:49AM (#14618213)

Bitsquatting

[ Parent | on HN ]