juxhindb

We're sharing recent research we wrote about a fun new set of typosquatting domains that bypass Chromium's latest safeguards.

We originally wanted to point to one one of the domains; HN's filters didn't play along, so we are sharing a few examples below (try with a Chrome-based browser):

- "apple.com" https://xn--80a6aa68c8d.com/ - "spacex.com" https://xn--80a5aeq0fr0c.com/

Hope you find it interesting!

Full technical writeup: https://haveibeensquatted.com/blog/turning-idn-edge-cases-in...

One fun assignment at Oxford's Comp. Sci. department was solving Mastermind in Haskell using minmax. Knuth has a particularly fun paper on it in fact - https://www.cs.uni.edu/~wallingf/teaching/cs3530/resources/k...

Honestly using something like haveibeensquatted would catch _so_ many of these, including ability to submit takedowns.

> Really, think about it. How often do you see somebody inexperienced use ifs instead of a switch? This pattern is common enough for most compilers to recognize, and more importantly, optimize it.

This made me chuckle. Playing dumb so that gcc optimizes you away is both hilarious and genius

Likely creating child tables for the various chunks that kick in periodically (e.g., depending on your hypertable chunking policy). Used to hit these all the time, quite annoying.

Definitely looks cool! I look forward to trying it on Linux down the road with Berkeley Mono font.

Oh god we can’t unsee it now. Was meant to be someone “squatting”. This comment is getting framed

Thank you!

> so you'd permutate the input domain and then query DNS?

Correct, we're running on resource-constrained lambdas right now and hoping to have some breathing room to expand on this soon. We want this to be the most accurate, point-in-time analysis of your domain so we want to push for this to run and scale rather than trying to tap into [expensive] data feeds.

> any caching mechanism in place? IMHO it'd be good to add some intro/info on the homepage.

Definitely, we had this prior with Cloudfront. As we're running on HTTP/2 stream, we simply cached the response and replayed it at the edge. We recently added signup/signin which complicated this so we've disabled it for the time. We're going to re-include it using Lambda@Edge shortly.

> Feedback, Make signing more visbile, currently you'd have to click login -> click on sign up

Noted!

> Feedback, I am expecting a paid premium after login but non, WIP?

Right now we're just giving access to more results after signin. We'll include CSV exports, some detailed results for free to help analysts. We're exploring premium features where you pay for recurring alerts about your domain with report history. Happy to hear what you feel are features you'd be happy to have included (and perhaps pay for?).

Hi HN, I invite all of you to try out Have I Been Squatted. Around a year ago we shared an alpha project called Have I Been Squatted, a small free tool for users to generate and understand their domain’s security posture with regards to typosquatting. The original version hug-to-death’ed[1][2] so we decided to rethink the UI and internals to (hopefully) mitigate this.

Happy to get any valuable feedback, stories or questions. You're also all welcome to our Discord[3] if you want to talk about your use-cases or what you found using our tool!

If you're curious about building your own version, you can try out our open-source permutation library, `twistrs`[4].

[1]: https://news.ycombinator.com/item?id=32985139

[2]: https://lobste.rs/s/k719vs/have_i_been_sqautted_free_dns#c_f...

[3]: https://discord.gg/rJeacCbVhy

[4]: https://github.com/haveibeensquatted/twistrs

Agreed. We had solved it at PhishDeck back in the day through the use of multiple projects, i.e., Platform Production, Platform Staging, Tooling Production, Tooling Staging etc.

Still not ideal, but it minimised security risk and kept things organised.

Yes it does, you can take a peak into the internals over here - https://github.com/JuxhinDB/twistrs/blob/3b20ed48c0c567a72d8...

Not yet but adding it to the list of ideas to implement as we add more heuristics to the tool, thank you!

Hey folks, I'm the co-author of the project. I wasn't aware that this was posted on Hackernews which in fact explains the absolute explosion of traffic that has been coming through! Here's a re-post from my original Reddit post. Long story short, we got hugged to death, which is a far larger reaction that we anticipated. :-)

HIBS is a small side project in [Rust](https://github.com/JuxhinDB/twistrs) & React that allows users to search whether domains have been typosquatted (an increasing security risk). It's meant to be a platform to eventually enable users to continuously and freely monitor their domains similar to ;--have i been pwned?.

The current version is very much in an alpha state but we released it in order to gauge community interest and receive your feedback on what can be added and improved. Hope you have fun with it and feel free to ask any questions!

An extension to this infact is the following - https://github.com/llvm-mirror/llvm/blob/f36485f7ac2a8d72ad0...

So the original user's comment might infact get detected by this and get optimised down to using popcnt. Will need to try it out. :-)

In fact that is one of the follow-ups I want to have out of this. Have architecture-specific optimisations (popcnt on x86) either manually through something like the `asm` crate, or by having a simpler algorithm that the compiler can optimise away.

Thanks for sharing that, love the simplicity behind it which is more intuitive than the example I had gone with.

I think the reason why I chose that particular one was to show how thinking about a problem from an entirely different angle can yield great (and rewarding) results.