Security News > 2021 > March > Researcher bitsquats Microsoft's windows.com to steal traffic
The exploitation of bitsquatted domains tends to be automatic when a DNS request is being made from a computer impacted by a hardware error, solar flare, or cosmic rays, thereby flipping one of the bits of the legitimate domain names.
Researacher sees real windows.com traffic coming to his domains!
In a 2011 Black Hat paper, titled "Bit-squatting DNS Hijacking without Exploitation," researcher Artem Dinaburg saw when he had squatted 31 bitsquatted variations of eight legitimate domains of multiple organizations, on an average 3,434 daily DNS requests came his way, that should otherwise have gone to the DNS servers for the legitimate domains.
As soon as Remy squatted the aforementioned domains and setup sinkholes to record any traffic, the researcher noticed an uptick in legitimate traffic coming his way.
Although some of these queries were clearcut cases of bitsquatting traffic, the researcher was surprised to see some traffic coming from domains misspelled by the end-users.
"Valid domain names that were bitflips of time.apple.com were researched alongside time.windows.com, but I found that all of the domains were already reserved," Remy told BleepingComputer.
News URL
Related news
- Microsoft: Windows 11 22H2 reaches end of support in 60 days (source)
- Microsoft is killing the Windows Paint 3D app after 8 years (source)
- Windows Server August updates fix Microsoft 365 Defender issue (source)
- Microsoft retires Windows updates causing 0x80070643 errors (source)
- Microsoft removes FAT32 partition size limit in Windows 11 (source)
- Microsoft to rollout Windows Recall to Insiders in October (source)
- Microsoft to roll out Windows Recall to Insiders in October (source)
- Microsoft: August updates cause Windows Server boot issues, freezes (source)
- Microsoft Delays Recall Launch for Windows Insider Members Until October (source)
- Microsoft is trying to reduce Windows 11's desktop spotlight clutter (source)