cve.bz

CAPEC-611

BitSquatting

Medium severityLow likelihoodDetailed pattern

An adversary registers a domain name one bit different than a trusted domain. A BitSquatting attack leverages random errors in memory to direct Internet traffic to adversary-controlled destinations. BitSquatting requires no exploitation or complicated reverse engineering, and is operating system and architecture agnostic. Experimental observations show that BitSquatting popular websites could redirect non-trivial amounts of Internet traffic to a malicious entity.

On this page

Ask an AI about this attack pattern

ChatGPTClaudeGoogle AI Mode

Show the promptExplain the attack pattern CAPEC-611: BitSquatting: how it unfolds, what it needs and how to prevent and detect it in my systems. Use https://capec.mitre.org/data/definitions/611.html and https://cve.bz/cve/capec/611?via=ask-ai-copy, which lists recent CVEs with the weaknesses it exploits. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this attack pattern's id and public links.

How the attack unfolds

  1. Explore

    The attacker looks for a way in.

    1. [Determine target website] The adversary first determines which website to impersonate, generally one that is trusted and receives a consistent amount of traffic.

      1 technique
      • Research popular or high traffic websites.

  2. Experiment

    They probe what they found.

    1. [Impersonate trusted domain] In order to impersonate the trusted domain, the adversary needs to register the BitSquatted URL.

      1 technique
      • Register the BitSquatted domain.

  3. Exploit

    They carry out the attack.

    1. [Wait for a user to visit the domain] Finally, the adversary simply waits for a user to be unintentionally directed to the BitSquatted domain.

      1 technique
      • Simply wait for an error in memory to occur, redirecting the user to the malicious domain.

Prerequisites

  • An adversary requires knowledge of popular or high traffic domains, that could be used to deceive potential targets.

Skills required

  • Low skill

    Adversaries must be able to register DNS hostnames/URL’s.

Consequences

What a successful attack can lead to
ImpactAffectsNote
OtherOtherDepending on the intention of the adversary, a successful BitSquatting attack can be leveraged to execute more complex attacks such as cross-site scripting or stealing account credentials.

Mitigations

  • Authenticate all servers and perform redundant checks when using DNS hostnames.

  • When possible, use error-correcting (ECC) memory in local devices as non-ECC memory is significantly more vulnerable to faults.

Part of
Can lead to

MITRE's words, unchanged: CAPEC-611 at MITRE. CAPEC is Copyright © 2007–2026, The MITRE Corporation, used under the CAPEC terms of use: “The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use Common Attack Pattern Enumeration and Classification (CAPEC™) for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy.” CAPEC and the CAPEC logo are trademarks of The MITRE Corporation. Credits. All attack patterns.