Bitsquatting An introduction Nigel Roberts Chief Xenobehaviourist - PowerPoint PPT Presentation

Bitsquatting – An introduction Nigel Roberts Chief Xenobehaviourist CHANNELISLES.NET nigel@roberts.co.uk @nigelrbrts http://nigel.je http://roberts.gg

What is bitsquatting ● “Typosquatting is a subset of cybersquatting: bitsquatting is a subset of typosquatting.” - Arends ● In bitsquatting: – a squatted identifier ● differs from the intended victim ● by one bit

Why do we care? ● It turns out – That, in in some circumstances – traffic addressed for a victim ● can be intercepted by a attacker ● by utilising an address identifier ● that differs – by one bit – from the victim's principal address

Bitsquatting ● First described in 2011 ● by Artem Dinaburg of Raytheon. – Bitsquatting: DNS Hijacking without exploitation http://gg.gg/bs-dinaburg

What is the science? ● Working Hypothesis – Hardware not humans – Devices make single bit errors – which ● In the case of certain identifiers ● to which there is a very large quantity of traffic ● are statistically significant e.g www.facebook.com

What's the cause? ● Speculation – Heat – Poor quality memory – Background radiation (e.g. radon) and/or nuclear explosions – Cosmic rays – Aliens playing Halo 2 with live ammunition.

Empirical evidence ● Is there any evidence for bitsquatting? – Yes ● described by Duane Wessels of Raytheon – Evidence of Bitsquatting In COM/NET Queries http://gg.gg/bs-wessels

Implications ● What are the implications? ● Investigated by Jaeson Schulz of Cisco – Examination of the bitsquatting attack surface http://gg.gg/bs-schulz

Detection of enemy activity ● The qualified question. ● Is it being used in the wild by hostile forces? ● If so, how do we detect it?

The contention: ● “Domain registries and registrars have unique tools available to them to investigate and detect whether bit-squatting is being actively pursued by bad guys” - Roberts ● Corollary: There are other good guys able to do this too, perhaps with different tools. – Google – Who else?

How? ● Easy to make a list of all bitsquatting collisions of all registered domains. ● SMOP ● But there's a lot of them – Mostly either legitimate, or “ordinary typosquatting” ● Need to reduce them further – Various possible tools to do this ● DNS data, registry data (WHOIS), IP registry data (RIPE/ARIN etc), MD5 hash of spidered data – Are there any characteristics of domain names and registration that give us extra information?

Conclusion ● “You have more work to do” – Houston, Floyd, Carnicero, Tennant (Spy the Lie)

Bitsquatting An introduction Nigel Roberts Chief Xenobehaviourist - PowerPoint PPT Presentation

Bitsquatting An introduction Nigel Roberts Chief Xenobehaviourist CHANNELISLES.NET nigel@roberts.co.uk @nigelrbrts http://nigel.je http://roberts.gg What is bitsquatting Typosquatting is a subset of cybersquatting: bitsquatting is

INTRODUCTION INTRODUCTION INTRODUCTION INTRODUCTION INTRODUCTION INTRODUCTION INTRODUCTION

INTRODUCTION Introduction 2/42 INTRODUCTION Alternations I am giving bread to the

Introduction Introduction Introduction Introduction Outline Motivation Failures

Introduction Introduction Introduction Nationwide Cause for Concern 1

DAQ introduction Purpose of this talk : (1) Introduction for those who have not been in every

INTRODUCTION cf. Schneider, Chapter 1 INTRODUCTION THEY ARE OUT TO GET YOU INTRODUCTION WHAT

Overview Introduction to SMIL Introduction to W3C and XML Introduction to SMIL

14 Introduction Introduction Bad guys can put malware into Example: hosts

Previous Lecture Introduction to SMIL 2 Introduction to W3C and XML Introduction to SMIL

Lecture 1 Andreas Habegger Introduction Zynq Introduction Zynq Introduction Zynq PS vs. PL

2018.06 01 SMILE5 Introduction S E 5 02 Alpha Cloud M I L 03 Company Introduction 04

Introduction to CICS Course introduction Course introduction What is CICS? What is an

Network Visualization Introduction Presented by Shahed Introduction Introduction Basic

Introduction Introduction (1) Main argument of the paper: universities are not only

JABLOTRON JA-100 introduction November 2011 Introduction Todays goals First introduction of

Introduction Introduction to storage and to storage and filesystems filesystems Introduction

Beautiful Concurrency with Erlang Kevin Scaldeferri OSCON 23 July 2008 6 years at Yahoo,

Sysco 3Q16 Earnings Results May 2, 2016 Forward-Looking Statements Statements made in this

The New Oil A Perfect Hedge? J u n e 2019 T S X V : P L U | OTC Q B : P L U U F

Sarama Resources Investment Highlights Two project areas geologically and strategically well

2012-13 Executive Budget Tom Corbett Tom Corbett Governor Charles B. Zogby Secretary of the

Waterfowl Hunting Zones and Splits for the 2021 2025 Seasons LWF Commission August 6, 2020

Theme 6: local TNUoS charges and the Generation / Demand split August 2011 TNUoS Charging Post

Avon Grove High School Roof Assessment Avon Grove High School Photo Report for Roof Evaluation