Flipping Bits: Your Credentials Are Certainly Mine
summary
Registers cheap bitflip domains, runs a custom stack called Certainly that combines Wildcard DNS matching with an ACME-driven on-the-fly SSL workflow, logs everything and injects payloads across HTTP/HTTPS/SMTP. Over ~4 months the deployment collects ~62 million DNS queries, ~2.8 million distinct valid HTTPS certificate requests, ~15,000 incoming emails and millions of usable OAuth/JWT tokens, proves automated certificate issuance and credential harvesting work at scale, and surfaces mobile clients as the highest-risk population.
AI-written summary · about
chapters (12)
- 0:00Bit flips and credentials theft
- 1:58Bit squatting and DNS errors
- 4:25Bit flips leak HTTPS credentials
- 9:20Certainly: tool to exploit bit flips
- 22:17Certainly’s DNS and TLS interception
- 31:01Finding bit-flip domains efficiently
- 36:41Flipping TLDs and vanity TLDs
- 40:13Testing bit flips with radiation and data
- 44:024 months of bit-flip monitoring results
- 47:14Mitigation against bit-flip theft
- 51:50Why bit flips happen and future research
- 53:36Open-sourcing Certainly and closing
related talks
47mDNS On Fire
35mDomain Borrowing: Catch My C2 Traffic if You Can
44mFlying a False Flag: Advanced C2, Trust Conflicts, and Domain Takeover
32mSomething’s Phishy: See the Hook Before the Bait
16mhijacking.gov.uk - Identifying and Communicating Risks to the Digital State
26mMisuse of DNS, the Second Most Used Protocol
25mSSL All The Things
30mTales of Red Teaming