Security News > 2021 > March > Hijacking traffic to Microsoft’s windows.com with bitflipping

The exploitation of bitsquatted domains tends to be automatic when a DNS request is being made from a computer impacted by a hardware error, solar flare, or cosmic rays, thereby flipping one of the bits of the legitimate domain names.

Researacher sees real windows.com traffic coming to his domains!

In a 2011 Black Hat paper, titled "Bit-squatting DNS Hijacking without Exploitation," researcher Artem Dinaburg saw when he had squatted 31 bitsquatted variations of eight legitimate domains of multiple organizations, on an average 3,434 daily DNS requests came his way, that should otherwise have gone to the DNS servers for the legitimate domains.

As soon as Remy squatted the aforementioned domains and setup sinkholes to record any traffic, the researcher noticed an uptick in legitimate traffic coming his way.

Although some of these queries were clearcut cases of bitsquatting traffic, the researcher was surprised to see some traffic coming from domains misspelled by the end-users.

"Valid domain names that were bitflips of time.apple.com were researched alongside time.windows.com, but I found that all of the domains were already reserved," Remy told BleepingComputer.

News URL

https://www.bleepingcomputer.com/news/security/hijacking-traffic-to-microsoft-s-windowscom-with-bitflipping/