DEF CON 19 - Artem Dinaburg - Bit-squatting: DNS Hijacking Without Exploitation
DEF CON 19 - Artem Dinaburg - Bit-squatting: DNS Hijacking Without Exploitation on HackerTube: recommended by 2 Hacker News commenters across 2 separate months, 2018–2023.
Artem Dinaburg's DEF CON 19 talk on bit-squatting, where DRAM bit flips cause DNS requests to go to domains one bit off from the intended one. It shows how hardware faults can be exploited for hijacking without any software exploit.
What HN commenters said
5 Hacker News comments link this video. Each one links back to its thread.
hayst4ckSep 2022Strongly recommends
A really fun DefCon talk on bitsquatting. Bitsquatting is the practice of registering domains that are one bit off from a popular one: ▶ this video google.com vs ooogle.com >>> chr(int('0b1100111', 2)) 'g' >>> chr(int('0b1101111', 2)) 'o' If the 4th to last bit of 'g' were to flip before writing to disk, you could get persistent requests to ooogle.com Having done queries against very large datasets at a large company, I can say for certain that this happens much more than you think it might.
in “iPhone app receives notification for another app” · View on HN
btschaeggAug 2018Recommends
Regarding "some hardware errors": This might include operationg conditions you didn't consider; say: The divisor in your code went through a non-ECC DRAM module (maybe in a disk drive) that runs hotter than its specified operating temperature would allow and a random bit-flip changes your `1` into a `0`. On this topic, the talk on Bitsquatting from Artem Dinaburg during Defcon 19 is worth watching. The most interesting part on bit flips starts around 15:05 minutes: ▶ this video
in “1/0 = 0” · View on HN
josephgOct 2023Cites it
Encryption and signing don't protect against memory corruption. For example, I download software from the internet then hash it. The hash matches. Before the bytes are written to disk locally, a bit flips in RAM. The corrupted data is written to disk and used. Likewise, dnssec doesn't protect you against DNS bitsquatting attacks[1] because the domain name can be changed before the DNS request is made. So the DNS response your computer makes for a-azon.com might be totally valid and signed. It can come through DoH or whatever. The problem is that your browser thought it was the response for amazon.com and chrome send a bitsquatter your amazon cookies. (Oops). [1] ▶ this video
in “ECC RAM on AMD Ryzen 7000 Desktop CPUs” · View on HN
jstriebApr 2021Cites it
This reminds me of Bitsquatting, which is like typosquatting but uses domains one bit-flip away instead of one mistyped letter away.[0] In a small experiment, for some popular domains, the author reportedly got a lot of hits. In the associated DEFCON talk, the author notes that even if you use ECC memory, it's unlikely that the DRAM in your hard drives does too.[1] 0: [link] 1: ▶ this video
in “Cosmic rays causing 30k network malfunctions in Japan each year” · View on HN
dfeojm-zlibJun 2019Cites it
The thing about ECC vs. non-ECC. If you don't have ECC, you don't know silent bit corruption is happening, and when it's finally (if it's ever) discovered, there's nothing that can be done. ECC (SECDED) keeps data safer than it would be otherwise. ECC is necessary for anything real or important based on the financial cost of losing data. For everything else, it can be optional. Plus, don't forget the security issues of bitsquatting and other attacks that are the real results of silent bitflips. DEF CON 19 - Artem Dinaburg - Bit-squatting: DNS Hijacking Without Exploitation ▶ this video
in “Battle testing data integrity verification with ZFS and Btrfs” · View on HN