- May 8, 2012
- 4,217
- 3,728
since not many people show any interesting tricks lately, i though i could show you a 0day blackhat trick to get traffic.
its not really an unknown issue, but i still called it 0day as there is no fix available for this issue and not many in the SEO scene know about it.
the issue is kinda similar to typosquatting and there is no fix for it, so it will stay 0day.
for the record this is for educational purposes only and i'm not saying you should all do this now. use this information at own risk, i take no responsibility for your actions!
so that being said, lets get started!
what you'll learn today is called bitsquatting, its a technic thats abusing a problem within computers, smartphones, tablets and any other hardware that has memory chips.
no memory chip is fail proof, there are always bit-errors that occur once in a while. this happens due to various reasons like heat, radiation and belive it or not even because of cosmic rays hitting your hardware.
so what happens is that a single bit -> 0 becomes 1 or the other way around.
well say this so called bit-flip occurs in the first byte of a url i.e. blackhatworld.com, that means if you have:
"b" = 01100010 and an bit error changes the value to say: 01100011, you get "c" instead of "b".
imagine this happens in a DNS lookup request! you request blackhatworld.com, the above bit-flip happens and what your computer will send out is a request to resolve the domain clackhatworld.com
this would usually fail as this domain doesn't exist at the time of writing. now what if someone registers that domain and answers the request?
we could DNS hijack if we send a valid A record back, but we have to send 2 answers, first for clackhatworld.com with our IP say 1.3.3.7 and then also for blackhatworld.com with 1.3.3.7 else it wouldn't work as the "c" was an error.
(you would have to write some code in say C or python to answer the DNS requests, but its not that hard.)
sometimes these entries end up in a DNS-cache and will be hijacking traffic for a while. also sometimes you get proxies which in turn send additional traffic..
another (easier) thing would be, we could just setup a HTTP server and check what files are being requested and serve them whatever we like.
so basically what bitsquatting is, its the method of registering domains with a char 1 bit off from the original.
also its not like real DNS hijacking where you would exploit a DNS server and redirect traffic which is illegal, but these requests are simply sent to your legit domain in error, you can chose to answer them anyway you want (*cough* ads).
like i've mentioned, its kinda like typosquatting that many of you have used before (miss spelled domains), but this time you have to make sure its 1 bit different instead of random chars.
lets take blackhatworld.com as example, changing the first character (of course all characters within the domain name would work) :
01100010 blackhatworld.com (original)
01100011 clackhatworld.com
01100110 flackhatworld.com
01101010 jlackhatworld.com
...
of course the smaller the domain name the better it works, as chances are higher that exactly the character you use is flipped. the longer the domain, the rarer it happens.
btw this trick has been successfully used to hijack various major advertising networks to inject own ads in the past decade (fbcdn is a popular target lol)
registering multiple domains with flipped bits is of course more effective than just trying it with a single domain.
if you want more technical details and statistics, you can check a paper about bitsquatting that was presented at the blackhat conference: media.blackhat.com/bh-us-11/Dinaburg/BH_US_11_Dinaburg_Bitsquatting_WP.pdf
hope this helps you to see how "thinking outside the box" works and that blackhats are always a step ahead
its not really an unknown issue, but i still called it 0day as there is no fix available for this issue and not many in the SEO scene know about it.
the issue is kinda similar to typosquatting and there is no fix for it, so it will stay 0day.
for the record this is for educational purposes only and i'm not saying you should all do this now. use this information at own risk, i take no responsibility for your actions!
so that being said, lets get started!
what you'll learn today is called bitsquatting, its a technic thats abusing a problem within computers, smartphones, tablets and any other hardware that has memory chips.
no memory chip is fail proof, there are always bit-errors that occur once in a while. this happens due to various reasons like heat, radiation and belive it or not even because of cosmic rays hitting your hardware.
so what happens is that a single bit -> 0 becomes 1 or the other way around.
well say this so called bit-flip occurs in the first byte of a url i.e. blackhatworld.com, that means if you have:
"b" = 01100010 and an bit error changes the value to say: 01100011, you get "c" instead of "b".
imagine this happens in a DNS lookup request! you request blackhatworld.com, the above bit-flip happens and what your computer will send out is a request to resolve the domain clackhatworld.com
this would usually fail as this domain doesn't exist at the time of writing. now what if someone registers that domain and answers the request?
we could DNS hijack if we send a valid A record back, but we have to send 2 answers, first for clackhatworld.com with our IP say 1.3.3.7 and then also for blackhatworld.com with 1.3.3.7 else it wouldn't work as the "c" was an error.
(you would have to write some code in say C or python to answer the DNS requests, but its not that hard.)
sometimes these entries end up in a DNS-cache and will be hijacking traffic for a while. also sometimes you get proxies which in turn send additional traffic..
another (easier) thing would be, we could just setup a HTTP server and check what files are being requested and serve them whatever we like.
so basically what bitsquatting is, its the method of registering domains with a char 1 bit off from the original.
also its not like real DNS hijacking where you would exploit a DNS server and redirect traffic which is illegal, but these requests are simply sent to your legit domain in error, you can chose to answer them anyway you want (*cough* ads).
like i've mentioned, its kinda like typosquatting that many of you have used before (miss spelled domains), but this time you have to make sure its 1 bit different instead of random chars.
lets take blackhatworld.com as example, changing the first character (of course all characters within the domain name would work) :
01100010 blackhatworld.com (original)
01100011 clackhatworld.com
01100110 flackhatworld.com
01101010 jlackhatworld.com
...
of course the smaller the domain name the better it works, as chances are higher that exactly the character you use is flipped. the longer the domain, the rarer it happens.
btw this trick has been successfully used to hijack various major advertising networks to inject own ads in the past decade (fbcdn is a popular target lol)
registering multiple domains with flipped bits is of course more effective than just trying it with a single domain.
if you want more technical details and statistics, you can check a paper about bitsquatting that was presented at the blackhat conference: media.blackhat.com/bh-us-11/Dinaburg/BH_US_11_Dinaburg_Bitsquatting_WP.pdf
hope this helps you to see how "thinking outside the box" works and that blackhats are always a step ahead
