Windows.com Bitsquatting Hack Can Wreak 'Unknown Havoc' On PCs (arstechnica.com) 61
An anonymous reader quotes a report from Ars Technica: Bitflips are events that cause individual bits stored in an electronic device to flip, turning a 0 to a 1 or vice versa. Cosmic radiation and fluctuations in power or temperature are the most common naturally occurring causes. Research from 2010 estimated that a computer with 4GB of commodity RAM has a 96 percent chance of experiencing a bitflip within three days. An independent researcher recently demonstrated how bitflips can come back to bite Windows users when their PCs reach out to Microsoft's windows.com domain. Windows devices do this regularly to perform actions like making sure the time shown in the computer clock is accurate, connecting to Microsoft's cloud-based services, and recovering from crashes.
Remy, as the researcher asked to be referred to, mapped the 32 valid domain names that were one bitflip away from windows.com. Of the 32 bit-flipped values that were valid domain names, Remy found that 14 of them were still available for purchase. This was surprising because Microsoft and other companies normally buy these types of one-off domains to protect customers against phishing attacks. He bought them for $126 and set out to see what would happen.
Over the course of two weeks, Remy's server received 199,180 connections from 626 unique IP addresses that were trying to contact ntp.windows.com. By default, Windows machines will connect to this domain once per week to check that the time shown on the device clock is correct. What the researcher found next was even more surprising. "The NTP client for windows OS has no inherent verification of authenticity, so there is nothing stopping a malicious person from telling all these computers that it's after 03:14:07 on Tuesday, 19 January 2038 and wreaking unknown havoc as the memory storing the signed 32-bit integer for time overflows," he wrote in a post summarizing his findings. "As it turns out though, for ~30% of these computers doing that would make little to no difference at all to those users because their clock is already broken."
Remy, as the researcher asked to be referred to, mapped the 32 valid domain names that were one bitflip away from windows.com. Of the 32 bit-flipped values that were valid domain names, Remy found that 14 of them were still available for purchase. This was surprising because Microsoft and other companies normally buy these types of one-off domains to protect customers against phishing attacks. He bought them for $126 and set out to see what would happen.
Over the course of two weeks, Remy's server received 199,180 connections from 626 unique IP addresses that were trying to contact ntp.windows.com. By default, Windows machines will connect to this domain once per week to check that the time shown on the device clock is correct. What the researcher found next was even more surprising. "The NTP client for windows OS has no inherent verification of authenticity, so there is nothing stopping a malicious person from telling all these computers that it's after 03:14:07 on Tuesday, 19 January 2038 and wreaking unknown havoc as the memory storing the signed 32-bit integer for time overflows," he wrote in a post summarizing his findings. "As it turns out though, for ~30% of these computers doing that would make little to no difference at all to those users because their clock is already broken."
Re: So he detected random errors via NTP (Score:5, Interesting)
On the contrary - the really interesting part here is that if I would look at this then I'd also look at the frequency of this occurring on computers with and without ECC memory.
Intel only allows ECC memory on server CPUs while AMD also allows it on desktop. Not sure if it's on all AMD desktop CPUs. But it's still relevant.
AMD and ECC (Score:2)
Not sure if it's on all AMD desktop CPUs.
Every single last AMD SKU has the ECC capabilities intact in the memory controller silicon for quite some time. The limitations comes from:
Re: (Score:2)
Every single last AMD SKU has the ECC capabilities intact in the memory controller silicon for quite some time.
Only the pro version of AMD APUs support ECC, and at least since Ryzen, they are only available to OEMs.
Time-travel. (Score:2)
"As it turns out though, for ~30% of these computers doing that would make little to no difference at all to those users because their clock is already broken."
Story was worth it for that alone.
BTW I use GPS.
How does that compare (Score:3)
Re:How does that compare (Score:4, Insightful)
Not sure what you are asking. Basically this guy mapped out the list of possible results of changing one bit in the memory-stored domain name that one Windows process uses to connect to. Most turned to garbage, invalid TLD etc. Apparently there were some that still remained valid domain names, and of those, the 14 he bought were available for purchase. And he gets a lot of connections, so if he wanted to Be Evil it would be relatively easy to do. But should he choose to Be Evil approximately 30% of the victims wouldn't notice because they are having time/clock related issues as it is.
Re: (Score:2)
The question is about the control sample. These names selected for being close to "windows.com" got X hits in Y time. We know that there are bots constantly scanning for vulnerabilities, and a new domain registration might get you on the list; what is the expected number of hits in Y time for a typical domain?
Re: (Score:2)
This is not a vulnerability. This is a time server. It is not scanned for by bots, because there aren't that many of them around, and they are not in script kiddie toolkits because they're at present not vulnerable to anything.
And when something connects (because he was looking at connections, not just scans) it identifies and says "gimme the time". That is what he looked at. Again, nothing a script kiddie tool does.
Any scans are not relevant. They do not connect to this port and ask for the time.
Re: (Score:2)
I think the point is that an NTP server runs on a different port than, say, HTTP, FTP, remote access, etc. If he's counting connections to his NTP server, he'll only ever see attempts to connect to a time server - something vulnerability scanners are unlikely to look at because
1) time servers are rare - there's rarely any reason to run a time server unless you've got an atomic clock that's providing accurate time for people around the world.
2) time servers are old, mature technology that get no value from
Re: (Score:1)
Re: (Score:1)
RU Sure?
Feb 13 22:38:15 fruit kernel: [538778.273992] bad udp: IN=eth0 OUT=eth1 SRC=180.214.238.243 DST=x.x.x.x LEN=220 TOS=0x00 PREC=0x00 TTL=244 ID=54321 PROTO=UDP SPT=55469 DPT=123 LEN=200
Feb 13 22:51:19 fruit kernel: [539562.100372] bad udp: IN=eth0 OUT=eth1 SRC=103.125.190.232 DST=x.x.x.x LEN=220 TOS=0x00 PREC=0x00 TTL=243 ID=54321 PROTO=UDP SPT=54204 DPT=123 LEN=200
Feb 13 22:54:41 fruit kernel: [539763.865268] bad udp: IN=eth0 OUT=eth1 SRC=180.214.
Re: (Score:2)
Re: (Score:1)
Re: (Score:2)
Trying to exploit a NTP server vulnerability.
Re: (Score:3)
If you open a port on the Internet, people are going to try and hack you.
Re: (Score:2)
No they aren't. I have quite a few servers running getting literally countless of bot attempts (mostly from Chinese and Russian IP ranges, but it varies a bit) and bots and scanners are incredibly targeted to very specific services running on a system.
I can say I've never seen one attempt to open a connection on port 123. On the flip side my logs are full of requests on port 22, 80, 143, 139, it's quite entertaining to watch in the logs.
You really have to have *specific* ports open on the internet for peopl
Re: (Score:3)
Trying to exploit a NTP server vulnerability.
Why. No seriously think about it for a moment. NTP is an incredible simple protocol. The server does not have hooks in a system, never runs privileged, doesn't access databases, filesystems, nothing.
The idea of exploiting an NTP server doesn't pass the pub test (assuming the pub is full of geeks who actually know what we're talking about).
Re: (Score:1)
Re: (Score:2)
Sorry but that is complete nonsense. NTP servers work for all manner purposes relating to synchronisation unrelated to security, and the systems which have NTP for security reasons normally do so because they on their own network and NTP to an external server is blocked at the firewall.
Just seeing if NTP is running or doesn't tell you much. Hell it may even tell you that someone just installed a Linux server distro and ticked a few boxes. Better still that IP hosting the NTP server usually doesn't have anyt
The other domains (Score:3)
"Remy, as the researcher asked to be referred to, mapped the 32 valid domain names that were one bitflip away from windows.com. Of the 32 bit-flipped values that were valid domain names, Remy found that 14 of them were still available for purchase."
14 out of 32 available for purchase. I wonder who owned the other 18.
More importantly, did he sell his 14 domains on?
What about the stats? (Score:2)
Error detecting/correcting memory (Score:4, Informative)
Should be standard everywhere. At least detection, so you know when it happens.
But somehow those extra few bits quadruple the cost of memory, boards etc. because now you are "server grade".
Most bit flips are indeed harmless. But you do not know how many are happening on a given machine. It is probably zero, but it could be 100s per hour, it will vary a lot depending on the actual machine and its chips. It is really annoying chasing down software bugs that turn out to actually be caused by hardware.
Re: (Score:2)
Re: (Score:2)
>Also definitely not saying that OEMs don't charge hellish markup on this sort of stuff.
I'd certainly never rule that out - but volume no doubt plays a factor as well - if you're only producing 1% as much ECC RAM as non-ECC, then the per-chip overhead costs are going to be 100x higher.
Re: (Score:2)
But somehow those extra few bits quadruple the cost of memory, boards etc. because now you are "server grade".
No they increase the cost because of incredibly low volume sales and poor performance.
It is really annoying chasing down software bugs that turn out to actually be caused by hardware.
It shouldn't be annoying. If it only happens once it could be a bitflip. If it happens more than once you either have problems with your hardware or your software and you should be thankful you found the issue.
Re: (Score:2)
>if it happens more than once you either have problems with your hardware or your software
That's the point isn't it? As a programmer you tend to assume any problems are with your software and can spend ages trying to track down a difficult-to-replicate software problem that doesn't actually exist.. If it's a hardware problem surely it would have shown up elsewhere as well, right? (Wrong. How is it possible that my software is the only one getting obviously hit by this hardware problem? I must have an
Re: (Score:3)
Are they suggesting Microsoft take over all those numeric IP addresses too?
Re: (Score:1)
> .... because this is some valid concern... yeah
Say you're browsing AshleyMadison looking for women. All of a sudden the search for WOMEN enumerator flips to search for MEN.
A single bit flip could turn you from straight to gay in a nanosecond. The government needs to mandate ECC memory in order to save the population.
Re:What about the stats? (Score:4, Interesting)
Ask Toyota, or more precisely, the people harmed by their sudden acceleration bug. Bitflips are real, and when you have millions of devices out on the market with life or death control systems, they must be accounted for in fault recovery systems.
With systems being on longer and longer, RAM loaded data will be more likely to suffer from this. How often do we restart PCs now? Tablets? Once a week/once a month for me. What about all those embedded systems we now have to interact with?
Re: (Score:2)
Absolutely! The odds of the bit flip being within the say 100 bytes containing the server address is negligible. Indeed, the flipped bit it almost certain to be in a sea of unreferenced zeros, given that the way C allocates heap memory leaves swathes of blocks where less than 50% is in actual use.
We can thank Intel for this one (Score:5, Informative)
Thanks to Intel, ECC RAM is rare on desktops. So buy AMD instead, especially if you're going to venture into things like overclocking.
And with RAM, overclocking is more complicated than it might seem. For instance, XMP timings count as overclocking. And motherboards support different timings depending on what you put in the RAM slots. Eg, for my Asrock X570 Taichi:
If you populate all 4 slots, your limit is either 2933 MHz if you only use single rank DIMMs, and 2667 if you use any dual rank ones. You can only go up to 3200 MHz if you only populate two slots.
So don't know how many ranks your RAM has? Haven't read the specs for the board and only looked at what it advertises on the front? You might well be running your RAM out of the board's spec, and without ECC the corruption might well eat your data before you figure it out.
Re:We can thank Intel for this one (Score:5, Interesting)
Don't worry though, the story is horseshit.
The connections he is getting are likely from people who manually mistyped the domain name. Windows copes just fine with dates beyond 2038.
Most importantly Windows Update hard codes the IP address and requires cryptographic signatures before trusting the server it finds. Otherwise every hijacked DNS server would be pumping out malware via Windows Update, but that isn't happening.
Re:We can thank Intel for this one (Score:5, Insightful)
Typos are possible, but unlikely. You can distinguish typos from 1 bit errors by the fact that it's unlikely anybody is going to type "wifdows" instead of "windows" -- the keys aren't particularly close.
Plus, they're checking for the NTP server. Few people ever change that at all, and very few are ever going to type the domain name because the settings screen has a preset list of domains to choose from.
Re:We can thank Intel for this one (Score:4, Informative)
He only got hits from 600-odd unique IP addresses. And from them he got ~200,000 connections, which suggest persistent configuration issues, rather than one-off bitflip errors. I can easily believe there are 600 misconfigured windows NTP clients out there. You'd have to look at DNS requests for non-writeable characters (which almost *must* be from bit errors) to identify bit-flip errors vs typos.
Re: (Score:2)
Depends which bit was flipped. If it was a bit that was then stored as part of an ntp domain name on disk, then that error would be persistent.
Re: (Score:2)
Typewise keyboard (Score:2)
F and N are next to each other on the Typewise keyboard, fwiw.
https://thereaderwiki.com/en/T... [thereaderwiki.com]
Re: (Score:2)
Thanks to Intel, ECC RAM is rare on desktops. So buy AMD instead, especially if you're going to venture into things like overclocking.
Your story is non-sequitur especially the bit about overclocking. If you actually cared remotely about overclocking you wouldn't touch ECC. If you bought AMD then your CPU is also influenced by memory clock speed and again you wouldn't touch ECC. There are very serious performance penalties to ECC that limit both timing as well as maximum overall clock speed of ECC RAM.
You might well be running your RAM out of the board's spec, and without ECC the corruption might well eat your data before you figure it out.
Not really. There's no major variance in signaling performance. It doesn't depend on humidity or who is president. You either are having pro
Now THIS is News for Nerds! (Score:2)
All kinds of greatness here to savor, including the notion that in just three days you have a 96% chance of a bit flip... Programmers always knew computers were inherently non-deterministic, proof at last!
Tuns out Einstein was partly right; God does not play dice with the universe, but the universe does play dice with you...
time travel hacks (Score:1)
Very handy for feeding bad certificates to a computer. Or breaking a computer that is hardened to reject time travel hacks, then following up with a little social engineering. People are more receptive to the "this is Microsoft here to remove viruses from your computer" phone calls if their PC just started acting up.
Simple Explanation (Score:2)
Re: (Score:2)
Re: (Score:2)
It can be edited in the registry. Alternative: maybe the bit flip happened when the value was written to the registry. That would explain why it would be persistent.
A stopped clock is right twice a day... (Score:3, Interesting)
Broken clocks? I would love to know how he determined that. And what exactly constitutes a "broken" clock anyway? If your motherboard battery dies, your built-in clock will revert to a default date/time when you power it off, but that is far from being "broken." Other than that, I struggle to imagine what else a clock could do -- since it's software -- to be considered "broken."
I read in a prior post the claim of setting the date/time to something in 2038 causing mass system failure is not true. I haven't tried it on mine but this does seem to be far fetched on any modern OS.
Even taking all of the above into account, domain-joined PC's query a domain controller for time during login by default. If they don't and their clock skews too far, they are unable to access domain resources, a clear red flag I've come across many times in my career.
What research? (Score:1)
Re: (Score:2)
Seems unlikely (Score:2)
I don't buy this for multiple reasons.
There's a chance of 1 bit being flipped out of 32 billion bits within a 3 day period. What are the odds that bitflip will affect the 14 bytes in which the domain name is stored?
If the RAM in question is paged to disc then that vastly decreases the odds of it being corrupted by a bit flip.
Is the actual domain name stored plaintext 8 bit characters in memory, and not as the mapped IP address? If the software stays resident in memory, and is always running, then it's lik
Re: (Score:2)
And there are BILLIONS of other corruptions happening, leading to many crashes and other issues. Thus the standard first response when a machine acts weird is "reboot and see if it helps".
And no, the underlying Win32 API, which does the net call, uses ASCII.
Windows.com Bitsquatting Hack Can Wreak 'Unknown (Score:1)
Misleading dates (Score:5, Funny)
Actually, the research was last year, but their clocks were wrong.
The Windows VCR (Score:2)
"...~30% of these computers doing that would make little to no difference at all to those users because their clock is already broken."
This is like looking at someones desktop and finding the clock down in the systray flashing 12:00.
How you know, humanity is devolving; The Windows VCR comes with NTP, and lusers still can't get it right.
Wrong, but the attack vector is still interesting (Score:3)
This statement is both right and wrong.
The author is correct that NTP does not have authentication enabled by default, but he's wrong about the impact that can have.
Non-domain joined clients have a MaxNegPhaseCorrection and MaxPosPhaseCorrection setting documented here [microsoft.com] that limits the time skew a non-domain joined client will accept to +/- 15 hours of the current system clock. Beyond that the clock has to be manually adjusted.
Domain joined machines use SNTP to sync time from their domain controllers, and are not impacted.
(This is one of the few topics where I'm an honest-to-betsy expert. :) )