JAESON SCHULTZ: My name is Jaeson.
This talk is on examining the bitsquatting attack surface.
For those of you who are regular DEF CON
attendees, you may remember a talk from a couple of years ago,
there was a talk by the name of or by a man named Artem Dinaburg.
He registered several domains that registered getting traffic and shows that
it works.
So if you know what typosquatting is, you will be able to understand
the concept of bitsquatting.
It's not a whole lot different.
Typosquatting is registering a domain name that
is maybe confusingly similar, that somebody might mistype
on a keyboard, bitsquatting involves actually
registering domain names that are one binary digit different.
If you think about the way that domain names are
represented in the memory of the computer.
Most use ASCII.
I have an example here where Twitter.com can
flip a bit and become twitit2.com.
Really there's nothing fancy.
It involves nothing more than registering domain names
but this was a great talk and I was really impressed by it and hats
off to Artem Dinaburg for bringing it to everyone's attention and be
the first one.
This is a view of the ASCII table, at least a lot
of the characters that are in the ASCII table
and their binary representation.
I'm purposefully not showing things line the ASCII control characters.
Actually, ASCII was a specification that was built
a long time ago back in the late '50s and early '60s when we had printing
teletype machines.
So several character codes that are in the seven bit ASCII table are things
like line feed, control codes and various, you know,
other control codes like delete.
When you had a printing tape and you made an error,
the reason why all ones in seven bit ASCII
is the delete character is because they would print ones
all the way across and that would signify that we
made a mistake and let them move on in terms the printing teletype.
There were people who argued back during the beginning when
they were making the ASCII specification that
they shouldn't include lowercase characters at all.
Other people were arguing that we should have the lowercase
the lowercase letters interweaved with the upper case.
So you might have a little A or a big A and so on.
This ended up being the final ASCII specification
and it got picked up in the early '80s with the advent.
This is what makes bitsquatting possible.
The R in Twitter, I highlighted here.
You can actually see that there's several other characters that are part
of the table, which are different only by one digit, if you were to flip
a zero into a one or a one into a zero, you could get all of these other things.
And so what Artem Dinaburg proved, if you register a bunch of domains
he was able to get traffic, for error memories.
It's passed into whatever application, usually the web browser that's doing
most damage.
Did he talk about some of the causes.
So these are the main causes of bitsquatting errors or bit errors
in memory.
Cosmic rays, you know, they are quite frequently hitting
the earth ten thousand per square meter per second.
Heat, I think the upper range on the iPhone operating temperature
is only 95 degrees.
So if you have been carrying your iPhone out around Vegas,
you have been exceeding those operational parameters.
There's an interesting paper that came out earlier this year
about nuclear explosions and bit requests
to determine when low yield nukes have been exploded.
And then finally defects in manufacturing.
As I started thinking about this, I thought it was a really unique idea.
Typically I'm used to being the one making the mistakes,
and having all the problems boil down to, you know, human errors,
you know, missing a semicolon in your program or whatever.
This is the type of thing where you have done
everything right but because of an error in the memory,
all of a sudden, your traffic is going to some other place that you didn't
even intend for it to go, and so one of the characters that's particularly
fascinating is the letter N, which by a flip of one bit can become the dot.
And while that's not one of the necessary characters
according to the RFC for DNS names, it does separate the various parts
of a DNS name.
So if we have an N inside of a domain name that can be
a dot, you can do some interesting things
like the domain, like Windowsupdate.
You can end up with does update.com.
And so we registered some of these.
And these were some of the queries we were getting
from the Internet, lots of people looking
to download Windows updates but they were going
to our domain, dowsupdate.
And this is a similar example, for the Symantec.
Update.
Because it's bidirectional, you can have dots that flip
into becoming a letter N.
So one of the best examples that we registered was the YTMG.com.
They use this content delivery network in a lot of their domain names or a lot
of their web pages to serve content.
And what we did was replaced the dot that separates the third level
of domain name from the second level and registered
the entire thing.
So we registered.
And the other one is the Nate of New York.
Every state has a state dot something dot US.
You can basically replace the second dot from the right
with a letter N and see some traffic.
So here's an example from YouTube.
It has a refer from YouTube.
This was going to our SNyntube.
And this domain is a real subdomain at the state of New York.
It is the office of mental health.
But we were getting lots of different requests from them.
So outside of the characters that are within a domain name itself,
there's other ways that we found and part of the inspiration
for this idea came from this slide, which was originally published
by Artem Dinaburg, and you see what he registered
all were associated with web applications.
I started thinking about that a little bit more.
And, you know, here's the general structure for any URL
and HTTP URL and you will notice that there's a scheme,
host name, path and so on, but there's a couple of maces, I
will highlight them here in red, where we have forward slashes.
And so if you think about bit squats and the context which
they most likely appear, it's going to be inside of web links
and there's a relationship between the letter O and
the forward slash where by the flip of one digit, one becomes the other.
And so how can we use this?
Well, if you have got a domain with a letter O in it, in the right place,
you can actually attack domains which weren't possible before.
So you see, I've got some examples here
in the dot mill the top level domains and this is EDU.
This is where I would not be able to register a domain ordinarily,
but flipping to a slash in the O, it cuts off the URL early and
the traffic goes to some international or country code level domain
and so we have several examples here.
Here's an example of an EDU.
This was this first example ecampus.Phoenix.EDU
and so we registered ecampus.ph and here was actually a request.
Somebody has a smartphone and they have got an icon
on their home screen, and whenever they click
the home screen, one of the byproducts is refetching
the Apple Touch icons and that's actually what you are seeing
here represented in this request, was the request
for the Apple touch icons.
We got similar stuff from other domains.
Those examples are in the white paper.
As the continuing in the bidirectional nature,
not only can you have an O turn into a slash
but you can have slashes turn into the letter O.
And why is this important?
Well, the browser actually allows or kind of silently fixes errors that
might occur as a result of this.
So if you can imagine, you've got a domain like slash dot here,
but imagine that the second slash from the left turns into a letter O
by virtue of a bit error.
The browser sees http:/ and they think, oh, it must be an error.
I need you to take you to O/.
and here's an example of that, again, someone fetching their Apple touch
icons, they have a slash dot web link stored
on the home screen of their phone.
I'm seeing a lot of traffic from mobile devices, honestly.
Let's see, am I going the right way?
So we've got additional URL delimiters that are possible.
The letter C has a relationship with the pound character.
And people that work in URLs will be familiar
with the pound character.
It basically shows you where you've got an anchor tag.
So if you can imagine a full host name with a letter C in it,
at the right place, when that C turns into an anchor tag,
it actually cuts short the domain and a couple
of really interesting examples here, PKI in the nrc.gov, that's
the nuclear regulatory commission.
I actually bought that domain.
And this is Naru.
You have to register some of these domains by faxing a paper in.
So some of these country code registries are
a little bit less organized than others, let's say.
But some others here, we've got a CDC.gov, it happens
to have a bit squat.
And there's some interesting examples there.
This is an example here, basically showing that the browser
will happily, and if you see in the location tab, it's going
to a.US domain name.
That's what the browser is hopefully correcting for us
and sending us to the wrong place.
Let's see, this here is, yes, another example.
This is an interesting one, in that the the C, if it even if it has a dot
before it, will still work, and if you look at the location bar here,
you will see the real location that you would be
going to, if, in fact, the C in dot CN was to flip into an anchor tag.
So these will still work even with errors in the browser.
So these were representing URLs and the domain delimiters
but we also took a level we took a look at the top level domains.
So most of the top level domains don't have bit squats.
There's some like.co.
They have an 0 based slash, but the ccTLDs have several depending
on where you are at.
So there's some domains that only have have no bitsquats
in the country code space and some that have several.
The Ivory Coast have ten different valid country code bitsquats what is sort
of possible with this?
Well, we registered a domain name based
on the Kremlin.ru domain but instead of .ru, we registered .re,
which is reunion island and we got this request for a news page, basically,
and so I pulled up the corresponding page
inside of the Kremlin.ru page, just to show that, yes, this was
a real news page that someone was requesting but they were coming
to Kremlin.re, instead, which we were not going to be able
to serve that content.
I have here another domain that we registered for this test, Europa.eu
is the European parliament.
And so we registered Europa.mu, and you can see we're getting
a bunch of MX requests for Europa.mu.
These are all valid subdomains at Europa.eu by the way.
Here is sip DNS request from the German federal government.
So we registered a couple of different domains there, bun.ee,
which also happens to be a typosquat as well as a bitsquat.
I think I might have another example.
Yeah, here's some MX requests.
If you were to look up the IP addresses on some of these,
you will note that some of these requests were coming
from inside of the government of Germany itself.
So what about all the new generic top level domains what could be
possible there.
Using some of these techniques, you could register
a bit squat that would allow you to bit squat the entire top level domain.
I think one of the most interesting out of this list is dot exchange which
is supposed to be used for financial exchanges.
So if you were able to register this xj.ge in Georgia,
you could potentially receive bitsquats for any domain
registered under.exchange.
There's some other bitsquats that are possible
in the new generic top level domains.
This is based on the letter O.
This is .boo, .bio and the corresponding country code where
those bitsquats exist, as well as those on the letter C.
So something more about the ccTLD bitsquats.
You would think in UK, where they only allow the protected it's
a fairly protected registrar.
You can only register third level domains at .UK.
So it turns out that the .UK has a one bit error and you become .TK,
and so I started looking at what was available
at .TK and there's several of these, probably the most interesting
out of this list is the MOD, which is the ministry of defense in the UK.
So I could I didn't register this.
I think they have registered it now.
So it's not available now.
But MOD.TK was available for a while and could you have
potentially been eavesdropping on the ministry of defense,
but there's several others and they all match
the corresponding second level registration at dot UK.
So you could potentially get quite a lot of traffic there.
So just kind of closing up here, you know, this is obviously,
there's a lot of domains out there that are possible
to bitsquat and even in protected registries like.gov
and so on.
So far the current mitigations were to use ECC memory or buy
up all the domains so no one could register it.
I think there's some better ways around that.
So one of the ways that we actually saw used in practice and I don't know that
they were necessarily doing this on purpose was Amazon uses kind
of a roving domain sort of defense here.
And if you look at the source code from some Amazon pages,
you notice that they have this domain cloudfront.net
and normally the o in cloud front would make these perfect
bitsquat domains based on the O flipping to a slash and
the country code .CL.
But what they do, if you look at the third level host name.
It changes every time they recompile the code there.
It changes about every month and so if you were to go out and register one
of these domain names, you probably wouldn't get much traffic
in the month before it changes.
So I thought that was an interesting defense.
I also noticed that a lot of these bitsquatting problems happen
as a result of URLs in web applications and so limiting
the amount of times that the URL actually appears can help you.
So instead of using absolute links, if you use relative links,
then you are not going to be putting the domain name in the link
and web pages are stored in memory, basically the exact same way that
they were written originally.
So that can help you, and also using capital letters,
there's less these are some other the capital letters don't have
the same equivalent bitsquats as lowercases.
And so using capital levels can help you avoid certain bitsquats.
The probably the best defense is the response zone.
I have an example here of PayPal if you had an RPZ, you might look
at a request coming for from RayPal and think that's
probably a one bit error and I will silently return
from my DNS revolver, no such domain.
You have to be careful of false positive like this raypal.com
is a real site.
So to that end, you definitely have to monitor for false positives when you
are using it technique.
But configuring this at the DNS, it takes it out from the ability
to register the doe plains in the first part.
If you have a list of fully qualified domain names you
want to turn into an RPZ and deploy on your revolver,
we are releasing a PERL script to do that.
It will be available on the Cisco blog page.
I have a blog page coming out in about ten minutes
and you can download the code from there as well.
So I hope that you found some of these new bitsquatting attacks
interesting and I really hope that people are going to go out and try
to do something as far as fixing up the revolvers and making this
problem go away because if more people did that,
then bitsquatting wouldn't really be an issue at all.
So thank you.