0x10: joohoi & STÖK - Flipping Bits: Your Credentials Are Certainly Mine

Bit Flips and Typos

joohoi and STÖK open SEC-T comparing keyboard typos to single-bit memory errors that turn “Google” into “Coogle” or “WordPress” into “GordPress.” One flipped bit in a DNS query can redirect OAuth flows to attacker-controlled domains.

Bit Squatting History

They reference Artem Dinaburg’s DEF CON research on registering one-bit-off domains to catch DNS requests corrupted by hardware faults or cosmic rays. Dinaburg’s coogleapis.com registration reportedly collected API tokens and JavaScript fetch traffic.

Infrastructure to Catch Flips

Reproducing the technique requires catch-all DNS, BIND, nginx, Flask logging, and careful TLS certificate planning—wildcard certs only cover one DNS label, making deep subdomains like auth.dev.api expensive to impersonate under HTTPS.

Operational Reality

joohoi parked the project for two years until a full disk alert revealed massive logs of accidental traffic. STÖK adds self-hosted email catch-all experiences receiving misdirected banking messages, showing real-world bit-flip or typo traffic is not purely theoretical.