Featured Blogs

Protecting Brands from Phishers No Easy Task

Just in case you've been out of the country for the last 12 months, a new scourge is hitting the Internet and the world of email and it's called phishing. The Anti-Phishing Working Group defines phishing as identity theft "attacks using 'spoofed' e-mails and fraudulent Websites designed to fool recipients into divulging personal financial data such as credit card numbers, account usernames and passwords..." According to various experts, the incidents of phishing are rising at an alarming rate: there were 13,000 unique phishing attacks in January alone - that's a 42 percent surge over the previous month. The real problem is that phishing works. more

IDN Parody on verisign.com

Guilllaume Rischard setup a parody on verisign.com using the IDN spoofing trick. He managed to get one registrar to register verisign.com with a cyrillic S (U+0405) (ie xn--veriign-mog.com :-) This actually started in #joiito a couple of weeks ago after the Eric published the spoofing attack paper. A joke was made that it would be funny if someone did it to verisign.com and so he did. I suppose I could rant why VeriSign should adopt the JET Guideline (or ICANN Guidelines) but this parody would send a louder message. more

Protecting the Internet: Certified Attachments and Reverse Firewalls?

In many respects the internet is going to hell in a hand basket. Spam, phishing, DNS poisoning, DDoS attacks, viruses, worms, and the like make the net a sick place. It is bad enough that bad folks are doing this. But it is worse that just about every user computer on the net offers a nice fertile place for such ill behavior to be secretly planted and operated as a zombie under the control of a distant and unknown zombie farmer. ...Some of us are coming to the converse point of view that the net is being endangered by the masses of ill-protected machines operated by users. more

What is ‘Pharming’ and Should You Be Worried?

The sky is falling! The sky is falling! ...or is it? What is this thing called "pharming"? Put simply, it's redirection of web traffic, so that the server you think you're talking to actually belongs to a criminal. For example: you think you're talking to www.examplebank.com because it says so in the browser's address bar, but actually you're connected to www.mafia-R-us.ru. This can happen in three main ways: 1. DNS Hijack: a social engineering attack on the Internet infrastructure... more

The Net-Net on Dot Net

ICANN has posted its suggested .net agreement [PDF]. The new draft puts the ICANN Board and the Names Council firmly in control of the registry's future, and represents a substantial change to the existing registry contracts. No one gave ICANN the power to do this, and it is strange that no approval by anyone -- including the US Dept of Commerce -- is being sought to make this happen. ICANN is taking the occasion of the .net rebid to restructure its entire relationship to the world. more

Innovation in DNS Business

One thing that amazed me about the ICANN community is the creativeness in finding new business models. I am not even talking about new technology like Internationalized Domain Names (IDN), the number of business models created from the vanilla DNS (actually just .com) are just mind boggling. ICANN was formed in 1999 and introduced the concept of registries and registrars model to the DNS business. With that, we witness the rise of register.com, an IPO darling in the dotcom days, in the early 2000s and subsequently overtaken by the ultra-cheap high-volume reseller model of GoDaddy. We also see new registries like .info and .biz and several others that didn't do so well. There are also after-market (aka ebay) for domain names like afternic and registry outsourcing, DNS hosting, Dynamic DNS etc. That's about what most outsiders know of DNS business models, mostly revolved around the registry-registrar-reseller model. But there are really more and I shall discuss two not-so-well-known but interesting models below. more

URLs: Ontologically Speaking

I was reading David Weinberger's reports on how the New York Times is planning on tackling its "link rot" problem where articles slip behind the pay-wall. Part of their solution appears to be to replace articles with their summaries. As usual, this got me thinking about telephony. Why don't phone calls and callers have URIs or URLs? ...Let's take addressing the endpoints first. Obviously, ENUM is one way of "Internetising" the phone number address space. more

Domain Owners Lose Privacy

As facts unfold, and the NTIA's decision to take away our privacy comes to light, it is interesting to see the NTIA struggling to explain its decision. Keep in mind that an "as yet to be identified" bureaucrat made this decision to take away your privacy, did it without notice, and without holding hearings. Those affected were not given an opportunity to explain how the loss of privacy would negatively affect them. Quite simply, this is NOT how our government is supposed to work. We should be outraged... more

Does CAN-SPAM Really Matter?

As a daily and enthusiastic reader of The New York Times, I was disappointed to read their February 1 article on CAN-SPAM entitled, "Law Barring Junk E-Mail Allows a Flood Instead" (subscription required). The theme of the article was, as the title suggests, that enacting CAN-SPAM was worse than having no laws at all. The article really missed the point on several fronts. more

Internet Governance: Analogue Solutions to Digital Problems

This is an overview of the booklet, "Internet Governance: Issues, Actors and Divides," recently published by DiploFoundation and the Global Knowledge Partnership. "Internet Governance is not a simple subject. Although it deals with a major symbol of the DIGITAL world, it cannot be handled with a digital - binary logic of true/false and good/bad. Instead, the subject's many subtleties and shades of meaning and perception require an ANALOGUE approach, covering a continuum of options and compromises." Update: This article was reposted with additional information and a new title. more

History of SMTP

The following excerpt is from the Free Software Magazine, March 2005 Issue, written by Kirk Strauser. To read the entire article, you may download the magazine here [PDF]. Also thanks to Yakov Shafranovich for making us aware of this publication. "Spam has existed since at least 1978, when an eager DEC sales representative sent an announcement of a product demonstration to a couple hundred recipients. The resulting outcry was sufficient to dissuade most users from repeating the experiment. This changed in the late 1990s: millions of individuals discovered the internet and signed up for inexpensive personal accounts and advertisers found a large and willing audience in this new medium." more

CENTR Statement on IDN Homograph Attacks

Recently a proof of concept attack was announced on the Internet that demonstrated how a web address could be constructed that looked in some web browsers identical to that of a well known website. This technique could be used to trick a user into going to a website that they did not plan on visiting, and possibly provide sensitive information to a third party. As a result of this demonstration, there has been a number of voices calling for web browsers to disable or remove support for IDNs by default. ...CENTR, a group of many of the world's domain registries - representing over 98% of domain registrations worldwide - believes such strong reactions are heavily detrimental... more

Whither WGIG?

Now, I don't like the word "whither" any more than you do. But this Reuters article was circulating yesterday and it seemed to call for a "whither." It's a short story, so let's do a close reading. "A U.N.-sponsored panel aims to settle a long-running tug of war for control of the Internet by July and propose solutions to problems such as cyber crime and email spam, panel leaders said on Monday." We're going to decide what "internet governance" is by July?  more

Domain Name Dispute Cases Increased by 6.6% in 2004

In its February 18, 2005 press release, WIPO has reported filing an average of 3.4 UDRP and UDRP-based cases per calendar day in 2004, bringing the total number of cases received in 2004 to 1,179 -- an increase of 79 cases (or 6.6%) as compared to 2003. Also mentioned in the report is a 37 percent increase in ccTLDs cases over the previous year. Listed below are a number of additional facts and figures reported... more

Spam Volume Redux

Several anti-spam companies talk about spam volumes in terms of a percentage of all inbound mail. Outsourced anti-spam services such as BlackSpider and Postini are currently quoting spam volumes in the 70%-85% range, having steadily grown over the last two+ years. That's nice, but it's actually hard to grasp what that means in absolute terms. more