Embed Size (px)
Citation preview
Evidence of Bitsquatting inCOM/NET Queries"
Duane Wessels"February, 2012"
2"
Motivation!
• Artem Dinaburg wrote about “bitsquatting” mid-2011 [1] • Bit-level errors in domain names result in misdirected
traffic.
• MICROSOFT.COM -> MICROSMFT.COM • GOOGLE.COM -> GOOG|E.COM • MSFT.NET -> M3FT.NET • FACEBOOK.COM -> FAKEBOOK.COM
• Bit-level errors might occur in RAM, on Disk, or during transmission
[1] http://www.hakim.ws/BHUS2011/materials/Dinaburg/BH_US_11_Dinaburg_Bitsquatting_WP.pdf"
3"
SOHO router"ISP resolver"
Client"Network Circuits"
DNS Path"
Authoritative"Name Servers"
www.NANOG.org?"www.LANOG.org?"
CDN" Web Server"
Content Path"
Client"
<P>... <a href=“www.LANOG.org”> <P>...
<P>... <a href=“www.NANOG.org”> <P>...
Cache"
Network Circuits"
Bitsquatting!
4"
Dinaburgʼs Numbers!
• 52,317 bitsquat requests for 31 domains over 221 days • 7.6 per domain per day
• 96% of bit errors happened prior to DNS resolution. • HTTP Host header matches DNS query name
• Up to 4% happened during resolution • 0.3 per domain per day
5"
Questions!
• What evidence does Verisign see of bitsquatting errors? • If bitsquatting errors are happening, shouldn’t they
happen to all bits with equal probability? • Can we tell the difference between bitsquatting and
typos? • Should domain owners be concerned about bitsquatting?
6"
Data!
• Queries to com/net name servers over a period of 6 days • Jan 10-12, 17-19
• From 4 Verisign sites • SFO, IAD, NYC, AMS
• Isolate queries for high-profile brands • Microsoft • Google • Facebook • Akamai • Amazon
• Analyzed on small Hadoop cluster • Queries with bad checksums are omitted
7"
Results!
8"
Mean Queries per day for BitsquatVariants of amazon.com
Jan 10,11,12,17,18,19, 2012(Domain registration date left of bar)
amazon.comamaron.comamizon.com
amaxon.comamezon.com
aiazon.comemazon.comamqzon.comamazkn.comamazoo.comamajon.comamazoj.com
qmazon.comalazon.com
amaznn.comcmazon.comimazon.comamazol.com
amazmn.comaoazon.coma azon.comamczon.comamazof.comaeazon.comamazgn.comama{on.comamazo~.comama~on.com
a}azon.comamaz/n.comam!zon.com‘mazon.comam‘zon.com
Queries per Day1 10 100 10 4 10 5 10 6 10 7 10 8
1 10 100 10 4 10 5 10 6 10 7 10 8
01 nov 199419 feb 1993
19 jul 199720 jul 1998
28 jul 199719 jan 2011
01 mar 200814 apr 200206 jun 2002
16 nov 200723 jul 2001
27 sep 200303 jun 200206 jun 200206 jul 200304 feb 2001
01 apr 200226 dec 200228 feb 2006
26 sep 200523 sep 2010
06 mar 200613 apr 2007
23 sep 201023 sep 2010
9"
Mean Queries per day for BitsquatVariants of akamai.com
Jan 10,11,12,17,18,19, 2012(Domain registration date left of bar)
akamai.comekamai.comikamai.comakaiai.com
acamai.comakemai.comakimai.com
akamay.comakamak.comaiamai.comakamei.com
akalai.comajamai.comckamai.comakamii.com
akamaa.comakamam.comaoamai.comakamqi.com
akamah.comakqmai.comqkamai.comakaeai.comakaoai.com
Queries per Day1 10 100 10 4 10 5 10 6 10 7 10 8
1 10 100 10 4 10 5 10 6 10 7 10 8
17 aug 199831 mar 2004
22 jan 201214 aug 2010
22 may 199926 jan 2006
21 may 199928 apr 2004
01 jan 200719 feb 2011
10"
Mean Queries per day for BitsquatVariants of akam.net
Jan 10,11,12,17,18,19, 2012(Domain registration date left of bar)
akam.netakim.netaiam.netakem.netajam.netakai.net
akao.netakae.netckam.netqkam.netakcm.netekam.netikam.net
akqm.netaoam.netacam.net
akal.netaka .neta{am.net
Queries per Day1 10 100 10 4 10 5 10 6 10 7 10 8
1 10 100 10 4 10 5 10 6 10 7 10 8
15 mar 1999
09 dec 1998
18 jan 2002
25 jan 2003
29 jun 2005
24 jan 2001
20 may 2001
29 apr 2011
14 jan 2003
30 aug 2011
12 jan 2000
21 feb 2008
26 sep 2010
14 dec 2000
07 jan 2000
11"
Mean Queries per day for BitsquatVariants of facebook.com
Jan 10,11,12,17,18,19, 2012(Domain registration date left of bar)
facebook.comfacebooc.comfasebook.comgacebook.comfecebook.comfacabook.comfacebokk.com
dacebook.comfacebooj.comfakebook.comfacecook.comfacdbook.com
bacebook.comfabebook.comfacefook.com
facebooo.comfacebooi.comfqcebook.comfacebomk.comfaaebook.comfacebonk.comficebook.com
facebnok.comfagebook.comvacebook.comfacubook.comfccebook.comfacerook.comfacgbook.comfacebmok.comfacebkok.comfacebgok.com
nacebook.comfacejook.comfacebogk.com
facmbook.comf!cebook.com
faceboo+.comfacebo/k.com
&acebook.comf‘cebook.com
fa#ebook.comfac%book.comface‘ook.comfaceb/ok.com
Queries per Day1 10 100 10 4 10 5 10 6 10 7 10 8
1 10 100 10 4 10 5 10 6 10 7 10 8
29 mar 199724 oct 2005
20 jan 200512 aug 2006
21 jul 200619 sep 2005
23 jun 200524 may 200523 jun 200530 jul 1996
13 sep 200523 jun 2005
14 jan 200903 oct 2005
26 sep 200530 aug 200519 sep 2005
21 oct 200528 jan 2009
21 dec 200803 may 2007
11 may 200621 may 200713 oct 2008
16 feb 200609 jul 2010
18 feb 200712 aug 2009
25 may 201120 nov 200923 jun 2005
15 oct 200931 jan 2008
04 jun 200720 nov 2010
18 dec 2011
12"
Mean Queries per day for BitsquatVariants of fbcdn.net
Jan 10,11,12,17,18,19, 2012(Domain registration date left of bar)
fbcdn.netffcdn.netfbctn.netfbcdl.net
dbcdn.netnbcdn.netfbsdn.netfbbdn.netbbcdn.net
fbcln.netfbcdf.net
fbkdn.netgbcdn.netfbadn.netfbcdj.netfccdn.net
vbcdn.netfbcfn.netfrcdn.netfbcdo.netfbgdn.netfb#dn.netfjcdn.net
fbcen.net&bcdn.net
fbc‘n.netf‘cdn.net
fbcd~.net
Queries per Day1 10 100 10 4 10 5 10 6 10 7 10 8
1 10 100 10 4 10 5 10 6 10 7 10 8
03 may 200719 may 2010
18 nov 200209 aug 2011
28 dec 201109 aug 201127 jul 2011
20 aug 201109 sep 201108 aug 2011
27 jul 201114 sep 201127 jul 2010
10 oct 201127 jul 201129 jul 2011
29 jul 2011
13"
Mean Queries per day for BitsquatVariants of google.com
Jan 10,11,12,17,18,19, 2012(Domain registration date left of bar)
google.comgoggle.comggogle.comgoocle.comgoofle.com
gooole.comgoogla.comgooele.comcoogle.comgoogld.comfoogle.com
gongle.comwoogle.comgooglm.comgooglg.com
googme.comooogle.com
googhe.comgooglu.comgokgle.comeoogle.comgomgle.comgnogle.com
googne.comgoogde.comgmogle.comgoog|e.comgoowle.comgkogle.comgoog,e.comg/ogle.comgo/gle.com
googl%.com
Queries per Day1 10 100 10 4 10 5 10 6 10 7 10 8
1 10 100 10 4 10 5 10 6 10 7 10 8
15 sep 199714 feb 1998
12 aug 199921 aug 2005
30 jul 199930 mar 2001
12 nov 200008 apr 200201 feb 2000
10 oct 200227 jun 1999
21 aug 200514 apr 200217 dec 2003
09 apr 200108 aug 2002
30 may 200308 aug 2002
13 jul 200321 jul 2002
27 sep 200218 may 2005
06 sep 200516 jun 2004
27 oct 200401 aug 2006
06 dec 200921 jul 2002
14"
Mean Queries per day for BitsquatVariants of microsoft.comJan 10,11,12,17,18,19, 2012
(Domain registration date left of bar)
microsoft.commacrosoft.commikrosoft.commicrocoft.commisrosoft.commicrosodt.commigrosoft.commicrosogt.commicsosoft.commycrosoft.commicrosobt.commicrosnft.commicrosovt.commicroqoft.commicrosofd.commicrowoft.commicrosofu.commicposoft.commicvosoft.commiarosoft.commicro3oft.commibrosoft.commicroskft.commicrmsoft.commicroroft.commmcrosoft.comlicrosoft.commicrosofp.commicbosoft.commicrgsoft.commic2osoft.commicrnsoft.comiicrosoft.commicrosgft.commicrosmft.commkcrosoft.comeicrosoft.commhcrosoft.commicrosofv.comoicrosoft.commicrksoft.commicrosof4.commiczosoft.commicrosont.commi#rosoft.comicrosoft.commicrosof|.commicroso&t.com}icrosoft.commicros/ft.commicr/soft.com
Queries per Day1 10 100 10 4 10 5 10 6 10 7 10 8
1 10 100 10 4 10 5 10 6 10 7 10 8
02 may 199119 jan 1995
30 jul 200413 nov 2011
18 aug 200720 aug 2003
10 dec 200103 nov 199814 dec 2009
28 oct 200711 nov 2008
03 nov 199824 jan 200313 may 201103 nov 1998
03 aug 201115 jun 2011
05 aug 201121 sep 201031 dec 2005
03 nov 199804 aug 201104 aug 201103 aug 201114 jun 201104 aug 2011
21 sep 201003 aug 201105 aug 201103 nov 199821 sep 2010
05 aug 201104 aug 201118 jan 201003 aug 201103 aug 2011
03 aug 2011
15"
Mean Queries per day for BitsquatVariants of msft.net
Jan 10,11,12,17,18,19, 2012(Domain registration date left of bar)
msft.netmsbt.netmcft.net
isft.netosft.net
msnt.netmqft.netmsfu.netmsfd.netesft.net
msgt.netmsvt.net
lsft.netmsfp.netmsdt.netmrft.net
msfv.netmwft.netm3ft.net
Queries per Day1 10 100 10 4 10 5 10 6 10 7 10 8
1 10 100 10 4 10 5 10 6 10 7 10 8
12 mar 1997
05 feb 2005
30 may 2010
17 oct 2003
06 feb 2001
17 nov 2002
18 oct 2011
31 jan 2006
25 mar 2011
23 may 2003
23 jan 2011
09 jul 2010
26 aug 2003
09 mar 2011
04 mar 2011
18 oct 2011
24 jan 2011
16"
Number of Queries with Bad ChecksumsAll Variants
Jan 10,11,12,17,18,19, 2012
google.commicrosoft.comfacebook.comamazon.com
msft.netakam.netfbcdn.net
akamai.comiicrosoft.comgoogld.com
msvt.netmicrosodt.com
gooele.comgoggle.comeoogle.com
licrosoft.comgoogla.comgomgle.com
mycrosoft.commicrosnft.commicro3oft.com
gooole.comgooghe.com
facecook.comface‘ook.com
a{am.netamazol.com
amaznn.comam‘zon.com‘mazon.com
Number of Queries1 10 100 10 4 10 5
1 10 100 10 4 10 5
17"
Number of Queries by Date of Registration
1991 1992 1993 1994 1995 1996 1997 1997 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 2011 2012
Que
ries
per D
ay
1
10
100
10 4
10 5
10 6
10 7
10 8microsoft.com
amaron.com
amazon.com
macrosoft.com
fakebook.com
amezon.com
amizon.com
facebook.comgoogle.commsft.net
akamai.com
akim.netamaxon.com
goggle.com
microskft.com
microsogt.commicrosovt.commicrowoft.com
mkcrosoft.comacamai.com
akam.net
akimai.com
foogle.com
ggogle.com
goofle.com
acam.netakal.net
coogle.com
ekam.net
googla.com
akai.netakao.netamajon.com
cmazon.com
googlg.com
gooole.com
migrosoft.com
osft.netaiam.net
alazon.comamazkn.com
amazol.com
amqzon.comeoogle.com
fbctn.netgkogle.com
gokgle.com
gooele.com
googhe.com
googld.com
googme.com
imazon.com
msnt.net
qmazon.com
woogle.com
akem.net
amaznn.comamazoj.comckam.netesft.net
googlm.com
googlu.com
isft.net
lsft.netmicroqoft.com
microsodt.comooogle.com
akamay.com
ekamai.comgoogde.comgoogne.com
mikrosoft.com
ajam.net
aoazon.com
dacebook.comfabebook.com
facabook.com
facdbook.com
facebkok.com
facebokk.com
facebooc.com
facebooi.com
facebooj.comfacebooo.comfacecook.comfacefook.com
fasebook.com
fqcebook.com
gnogle.comgomgle.com
gongle.com
goocle.com
mibrosoft.com
msbt.net
akemai.comamazmn.com
amczon.com
fecebook.com
ficebook.com
gacebook.com
gmogle.commsfu.netvacebook.com
aiamai.comamazof.com
amazoo.com
facebnok.comfacebonk.com
facejook.com
fbcdn.net
fccebook.commisrosoft.com
mycrosoft.comemazon.com
faaebook.comfagebook.com
ikam.netmicrosobt.comnacebook.com
bacebook.com
facebgok.comfacebmok.com
facebomk.com
facerook.comgoowle.commicsosoft.com
a azon.comaeazon.com
akaiai.com
amazgn.com
aoam.net
eicrosoft.com
facebogk.com
facubook.com
fccdn.net
ffcdn.net
mcft.net
mic2osoft.commicrksoft.com
micro3oft.com
msvt.net
aiazon.com
akae.net
akamei.com
dbcdn.net
facgbook.com
facmbook.comfbadn.netfbcdf.netfbcdj.net
fbcdl.net
fbcdo.netfbcen.netfbcfn.net
fbcln.netfbkdn.netfbsdn.netfrcdn.net
m3ft.net
micbosoft.commicposoft.commicrmsoft.commicrnsoft.com
microcoft.com
microroft.commicrosgft.commicrosof4.com
microsofd.commicrosofp.commicrosofu.com
microsofv.commicrosont.com
micvosoft.com
miczosoft.commmcrosoft.com
mqft.net
msdt.netmsfd.netmsfp.net
msgt.net
mwft.netnbcdn.net
oicrosoft.com
qkam.net
18"
Conclusions!
• For some of the most popular domains, bit-level errors during DNS resolution appear to occur very infrequently • about once every 107 – 108 queries • Much less often than typos
• Bit-level errors separate from DNS (i.e., in distribution and storage of content) is the more serious problem. • Perhaps its time for an HTTP checksum?
