New DNS hijacking technique exploits RAM errors • Hacker News Board

Re: New DNS hijacking technique exploits RAM errors

#11

Post by strmpnk » Thu, Aug 04, 2011, 6:54 PM UTC

msbarnett wrote: post #4

strmpnk wrote: post #3

This seems pretty unlikely with ECC modules. Worst reported error rate for regular RAM was 1 bit per hour per GB (via wikipedia) while other reports claim it'd take a century for that same amount of error. Regardless, this is ever more reason to use something like TLS to initiate a trusted identity with another party. Even in the null cipher case, it's useful to exchange a certificate.

Even with regular non-ECC modules, it seems like the odds of this affecting you are very very low. But the sheer number of operational computers probably means that the likelihood that at any given moment this is impacting someone's DNS query is probably fairly high.

True but vulnerabilities are only as viable as they are economical to execute. The effort isn't very high but the yield is proportionately low as well.

Re: New DNS hijacking technique exploits RAM errors

#12

Post by dholowiski » Thu, Aug 04, 2011, 7:00 PM UTC

andfarm wrote: post #10

dholowiski wrote: post #8

Earlier quoted context omitted.

How about Google.com or Facebook.COM?

As far as I can tell, most or all of the one-bit errors on those are already registered by typosquatters.

I hadn't thought of that... I tried flipping the first 7 bits of google and got woogle, ooogle, coogle, eoogle - which are all registered. I don't think it would be that hard to write a bit-flip miner though. It wouldn't surprise me if sites other than the biggest (maybe ycombinator.com, techcrunch.com, makezine.com) have bit flipped versions avilable. I guess it would be more likely with longer domain names too.

Re: New DNS hijacking technique exploits RAM errors

#13

Post by fla » Thu, Aug 04, 2011, 7:24 PM UTC

nbpoole wrote: post #6

peterpeters wrote: post #2

I wonder how likely these errors are

> Normally a couple hundred IPs a day will visit popular bitsquatted destinations. #blackhat https://twitter.com/#!/dakami/status/98910873044791297

Someone posted a gist wich looks like DNS hits for facebook content delivery network (fbcdn.net) https://gist.github.com/1125307 plus another one about top domains https://gist.github.com/1125203 . It seems the odds are around 1 over 1 billion, or even less. Edit : Can it be something else? maybe IP/UDP checksum collision over corrupted packets ?

Re: New DNS hijacking technique exploits RAM errors

#14

Post by mef » Thu, Aug 04, 2011, 7:53 PM UTC

Would this not be compensated in the end-to-end TCP checksumming? And couldn't the traffic to bit-squatting domains be accounted for by the myriad bots that constantly scan the web on port 80?

Re: New DNS hijacking technique exploits RAM errors

#15

Post by jrockway » Thu, Aug 04, 2011, 7:56 PM UTC

mef wrote: post #14

Would this not be compensated in the end-to-end TCP checksumming? And couldn't the traffic to bit-squatting domains be accounted for by the myriad bots that constantly scan the web on port 80?

DNS is not a TCP protocol.

Re: New DNS hijacking technique exploits RAM errors

#16

Post by bysin » Thu, Aug 04, 2011, 8:07 PM UTC

jrockway wrote: post #15

mef wrote: post #14

Would this not be compensated in the end-to-end TCP checksumming? And couldn't the traffic to bit-squatting domains be accounted for by the myriad bots that constantly scan the web on port 80?

DNS is not a TCP protocol.

It can be either TCP or UDP. Regardless, UDP has a checksum as well.

The likelihood of a bit-flip is very uncommon. Even taking into account the volume of computers out there, the likelihood of a bit-flip at the exact spot (in the domain name) and moment of a DNS lookup (before the checksum is calculated) is astronomically uncommon. This article is garbage.

Re: New DNS hijacking technique exploits RAM errors

#17

Post by Florin_Andrei » Thu, Aug 04, 2011, 8:12 PM UTC

bysin wrote: post #16

jrockway wrote: post #15

Earlier quoted context omitted.

DNS is not a TCP protocol.

It can be either TCP or UDP. Regardless, UDP has a checksum as well. The likelihood of a bit-flip is very uncommon. Even taking into account the volume of computers out there, the likelihood of a bit-flip at the exact spot (in the domain name) and moment of a DNS lookup (before the checksum is calculated) is astronomically uncommon. This article is garbage.

I wonder if there are more sources of error than just RAM bit-flipping. The bit could be flipped anywhere it's stored or passing through. If that is the case, the error rate would be orders of magnitude higher.

Re: New DNS hijacking technique exploits RAM errors

#18

Post by trotsky » Thu, Aug 04, 2011, 8:12 PM UTC

One bit in one gigabyte of RAM is 1 in 8,589,934,592. Wolfram Alpha estimates there are "over one billion computers" in the world.

Let's be charitable and say that every single one of those is connected to the internet 24x7 and they love microsoft so much that they visit the url every hour, so 24 times a day. To get even more accommodating, let's imagine every single computer in the world has a single bit error occur every hour as well, right before they head to microsoft.com.

In that case you'd expect about 3 hits a day.

I'm sure it can happen, but I'd be surprised if most of the traffic wasn't caused by other things. I can't be the only one who noticed in mic2osoft.com the number 2 is only two keys away from r. It may not be the most common typo in the world, but I bet the odds are a lot higher than 1 in 8.5 billion.

I almost think it's an inside joke, Kaminsky sounded just a wee bit too blown away while he was raving about the presentation last night. Or maybe that was just the booze tallking.

Re: New DNS hijacking technique exploits RAM errors

#19

Post by tjoff » Thu, Aug 04, 2011, 8:32 PM UTC

trotsky wrote: post #18

One bit in one gigabyte of RAM is 1 in 8,589,934,592. Wolfram Alpha estimates there are "over one billion computers" in the world. Let's be charitable and say that every single one of those is connected to the internet 24x7 and they love microsoft so much that they visit the url every hour, so 24 times a day. To get even more accommodating, let's imagine every single computer in the world has a single bit error occur…

Thanks for doing the math. This is just ludicrous. I don't know much about domain registrations but is there no way to get a hold of a list of taken domains? (maybe there are lists just for some registrars where search/spam-bots can get a hold of it?)

Re: New DNS hijacking technique exploits RAM errors

#20

Post by justincormack » Thu, Aug 04, 2011, 8:36 PM UTC

gtank wrote: post #9

strmpnk wrote: post #3

This seems pretty unlikely with ECC modules. Worst reported error rate for regular RAM was 1 bit per hour per GB (via wikipedia) while other reports claim it'd take a century for that same amount of error. Regardless, this is ever more reason to use something like TLS to initiate a trusted identity with another party. Even in the null cipher case, it's useful to exchange a certificate.

Sections 7 and 8 of this paper [1] discuss inducing memory faults and potential countermeasures. Specifically they indicate that many desktop PCs shipped without ECC hardware at the time of writing (2003). I'm not sure to what extent that's still true, but I imagine it could be a problem for the masses of cheap/old hardware in use around the world. edit: I found some more recent numbers via [2]. Relevant quote: "Our…

Desktop machines still do not ship with ECC, other than a few high end ones that use server hardware.