COMMON ATTACK PATTERN ENUMERATION AND CLASSIFICATIONMITRE canlı kaydı

CAPEC-611

BitSquatting

An adversary registers a domain name one bit different than a trusted domain. A BitSquatting attack leverages random errors in memory to direct Internet traffic to adversary-controlled destinations. BitSquatting requires no exploitation or complicated reverse engineering, and is operating system and architecture agnostic. Experimental observations show that BitSquatting popular websites could redirect non-trivial amounts of Internet traffic to a malicious entity.

Soyutlama

Detailed

Tipik ciddiyet

Medium

Saldırı ihtimali

Low

Saldırıyı anla

Bu saldırı kalıbı nedir?

An adversary registers a domain name one bit different than a trusted domain. A BitSquatting attack leverages random errors in memory to direct Internet traffic to adversary-controlled destinations. BitSquatting requires no exploitation or complicated reverse engineering, and is operating system and architecture agnostic. Experimental observations show that BitSquatting popular websites could redirect non-trivial amounts of Internet traffic to a malicious entity.

Uygulama akışı

Saldırı adım adım nasıl ilerler?

1

Explore

Determine target website

The adversary first determines which website to impersonate, generally one that is trusted and receives a consistent amount of traffic.

Kullanılan teknikler

  • Research popular or high traffic websites.
2

Experiment

Impersonate trusted domain

In order to impersonate the trusted domain, the adversary needs to register the BitSquatted URL.

Kullanılan teknikler

  • Register the BitSquatted domain.
3

Exploit

Wait for a user to visit the domain

Finally, the adversary simply waits for a user to be unintentionally directed to the BitSquatted domain.

Kullanılan teknikler

  • Simply wait for an error in memory to occur, redirecting the user to the malicious domain.

Gereksinimler

Saldırının gerçekleşmesi için ne gerekir?

Ön koşullar

  • An adversary requires knowledge of popular or high traffic domains, that could be used to deceive potential targets.

Gerekli beceri

  • Low: Adversaries must be able to register DNS hostnames/URL’s.

Gerekli kaynak

MITRE kaydında belirtilmemiş.

Etki

Başarılı saldırı neye yol açar?

Other

Etkilenen alanlar: Other

Savunma

Nasıl önlenir ve etkisi azaltılır?

1
Authenticate all servers and perform redundant checks when using DNS hostnames.
2
When possible, use error-correcting (ECC) memory in local devices as non-ECC memory is significantly more vulnerable to faults.
CAPEC-611: BitSquatting — DayBreach Saldırı Sözlüğü · DayBreach