Bitflips are events that cause individual bits stored in an electronic
device to flip, turning a 0 to a 1 or vice versa. Cosmic radiation and
fluctuations in power or temperature are the most common naturally
occurring causes. Research from 2010 estimated that a computer with
4GB of commodity RAM has a 96 percent chance of experiencing a bitflip
within three days. An independent researcher recently demonstrated how
bitflips can come back to bite Windows users when their PCs reach out
to Microsoft's windows.com
domain. Windows devices do this regularly
to perform actions like making sure the time shown in the computer
clock is accurate, connecting to Microsoft's cloud-based services, and
recovering from crashes.
Remy, as the researcher asked to be referred to, mapped the 32 valid
domain names that were one bitflip away from windows.com
. Of the 32
bit-flipped values that were valid domain names, Remy found that 14 of
them were still available for purchase. This was surprising because
Microsoft and other companies normally buy these types of one-off
domains to protect customers against phishing attacks. He bought them
for $126 and set out to see what would happen.
Over the course of two weeks, Remy's server received 199,180
connections from 626 unique IP addresses that were trying to contact
. By default, Windows machines will connect to this
domain once per week to check that the time shown on the device clock
is correct. What the researcher found next was even more surprising.
"The NTP client for windows OS has no inherent verification of
authenticity, so there is nothing stopping a malicious person from
telling all these computers that it's after 03:14:07 on Tuesday, 19
January 2038 and wreaking unknown havoc as the memory storing the
signed 32-bit integer for time overflows," he wrote in a post
summarizing his findings. "As it turns out though, for ~30% of these
computers doing that would make little to no difference at all to
those users because their clock is already broken."'
-- source: https://tech.slashdot.org/story/21/03/04/2152239
I wonder whether anyone has tested apt-get in regards to this...
Dept. of Computer Science
University of Waikato, NZ
+64 (7) 577-5304