Practical waterholing through DNS typosquatting
blog.0day.rocks
Practical waterholing through DNS typosquatting
1–10 of 15 posts
Re: Practical waterholing through DNS typosquatting
#2Another interesting approach is rely on cosmic background noise bit flips. Do it on Google.com and you can get a few thousand visitors a week
I.e. Register a domain where the ASCII representaton is 1 bit off.
Re: Practical waterholing through DNS typosquatting
#3Another interesting approach is rely on cosmic background noise bit flips. Do it on Google.com and you can get a few thousand visitors a week I.e. Register a domain where the ASCII representaton is 1 bit off.
Bitsquatting
Re: Practical waterholing through DNS typosquatting
#4Another interesting approach is rely on cosmic background noise bit flips. Do it on Google.com and you can get a few thousand visitors a week I.e. Register a domain where the ASCII representaton is 1 bit off.
The original idea has a better name: Bitsquatting[0]
"Experiment To determine whether bit7errors can redirect connections to attacker controlled sites, the bitsquat domains in Table 3 were registered, and all HTTP requests to the domains were logged. The domains, such as li6e.com, mic2osoft.com, and fjcdn.net are very unlikely to be typos or keyboard errors."
[0] https://media.blackhat.com/bh-us-11/Dinaburg/BH_US_11_Dinabu...
Re: Practical waterholing through DNS typosquatting
#5Another interesting approach is rely on cosmic background noise bit flips. Do it on Google.com and you can get a few thousand visitors a week I.e. Register a domain where the ASCII representaton is 1 bit off.
Yep, bitsquatting is also a very cool thing, first research on that topic was in 2011 IIRC :)
Typosquatting = human error
Bitsquatting = machine error (bitflip)
Re: Practical waterholing through DNS typosquatting
#6Another interesting approach is rely on cosmic background noise bit flips. Do it on Google.com and you can get a few thousand visitors a week I.e. Register a domain where the ASCII representaton is 1 bit off.
ISnt it more likely that it is just bots, that know your domain cos they have lists of every domain for that tld?
Re: Practical waterholing through DNS typosquatting
#7Another interesting approach is rely on cosmic background noise bit flips. Do it on Google.com and you can get a few thousand visitors a week I.e. Register a domain where the ASCII representaton is 1 bit off.
ISnt it more likely that it is just bots, that know your domain cos they have lists of every domain for that tld?
Same question I had. Though it wouldn't be hard to control for, just put a random honeypot domain and see how many visits it gets.
Re: Practical waterholing through DNS typosquatting
#8s/Ethipia/Ethiopia
Re: Practical waterholing through DNS typosquatting
#9Another interesting approach is rely on cosmic background noise bit flips. Do it on Google.com and you can get a few thousand visitors a week I.e. Register a domain where the ASCII representaton is 1 bit off.
The original idea has a better name: Bitsquatting[0] "Experiment To determine whether bit7errors can redirect connections to attacker controlled sites, the bitsquat domains in Table 3 were registered, and all HTTP requests to the domains were logged. The domains, such as li6e.com, mic2osoft.com, and fjcdn.net are very unlikely to be typos or keyboard errors." [0] https://media.blackhat.com/bh-us-11/Dinaburg/BH_US_11_…
Thanks! That's brilliant.
Re: Practical waterholing through DNS typosquatting
#10Didn't mention spinning up an SMTP server on the domain. That might catch some interesting info.