Hacker News Reader

HNHacker News

Top New Best Ask Show Jobs

Comment by spullara | Hacker News Reader

Full thread

spullara·

I reproduced this by bit-squatting cloudfront.net after reading about it. So many memory errors!

http://dinaburg.org/bitsquatting.html

Loved the variety as well. Sometimes though requests came to me the Host header was correct!

View on HN

Wait so when someone typoes cnn.com as con.com, that is ipso facto a memory error? I guess I could see that if the characters are radically far apart on the keyboard? But doesn't a simpler explanation like "one person out of billions with Internet access typed the wrong thing" seem a lot more likely?

Domains that are only used as CDNs, like cloudfront.com, are almost never typed into an address bar. Errors in the domain name are more frequently the result of a bit-flip error.

This seems like a pretty weak argument. OTOH, 3% of the HTTP requests made to a bitsquatted domain in the linked articles had the original domain in the Host: header; those sound like actual memory errors.

Also, these typos are typically not easy ones since flipping a bit changes the letter in ways that are unlikely typos. With cloudfront.net an negligible number of people would be typing them at all. Close to 100% of the errors that I saw were loading either images, css or javascript files that some other page depended on.

This Defcon 21 presentation from Robert Stucke did something similar with google's domains, plus other stuff. A great watch if you've got a spare 40 minutes!

https://www.youtube.com/watch?v=yQqWzHKDnTI

Some macs do use ECC memory (specifically some of the most popular varieties, like the Mac Pro) which is probably why you saw lower numbers on bit squatted domains.

Fascinating article. Did you ever find a reason for the different ios results?

Based on source IPs I would say that cheaper RAM = more error prone RAM.

Reply on news.ycombinator.com