Cybersecurity

The London Process Arrived in Budapest: Another Travel Circus for the Internet Community?

The Budapest Conference on Cyberspace brought together nearly 20 heads of states and ministers plus 700 high level experts from various stakeholder groups from 60 countries. However, after two days of discussion there is less clarity where the so-called "London Process" - established by the British Foreign Minister William Hague in November 2011 in London - will go. The next meeting is scheduled for October 2013 in Seoul. Another flying circus for another Internet Governance talking shop? more

Google Dumps Illicit Pharmacy Advertisements

Garth Bruen writes: Within the next few weeks Google plans to update its pharmacy policy which will restrict pharmacy advertisements. Once in effect, the updated policy will only allow VIPPS and CIPA certified pharmacies to advertise. Additionally these pharmacies can only target ads within their country. more

How Failure To Maintain IPv6 Is Hindering Law Enforcement

Recently, the FBI, DEA and even the Canadian Mounted Police have suggested that the switch to IPv6 is making it more difficult to track criminals online, those who would traffic in things such as drugs or child pornography, in addition to hackers, botnets, kidnappers and terrorists. Under IPv4, it wasn't very difficult to find offenders online via their IP addresses. The American Registry of Internet Numbers (ARIN) would hand out the address and internet providers would log them into the public WHOIS database. more

Lessons Behind the Microsoft 3322.org Takedown

The Microsoft action against 3322.org, a Chinese company, started with the news that computers were infected during the production phase. Stepping away from the controversy surrounding the approach, there are important lessons that cyber security officials and upper management, deciding on the level of and budget for cyber security in organisations should learn and take into account. I'm writing this contribution from a premise: China uses the fact that most IT devices are built in China to its advantage. Allow me to start with an account from personal memory to set the stage. more

Report On National Online Cybercrime and Online Threats Reporting Centres

Today I released a report on 'National cyber crime and online threats reporting centres. A study into national and international cooperation'. Mitigating online threats and the subsequent enforcing of violations of laws often involves many different organisations and countries. Many countries are presently engaged in erecting national centres aimed at reporting cyber crime, spam or botnet mitigation. more

Is It Time for a Breakthrough in Securing Cyberspace?

This year in July gen. Keith Alexander, director of the National Security Agency and head of the US Cyber Command participated at DefCon, the hackers conference in Las Vegas. In his address, gen. Alexander said, among other things, "This is the world's best cybersecurity community. In this room right here is the talent our nation needs to secure cyberspace."... As someone, who is regularly meeting the top Russian cyber folks, I already know (unofficially, of course) how the words of gen. Alexander were met in Moscow. more

De Facto Rules a Boon to Rogue Players

In Ian Flemming's Thunderball M sends 007 to the Bahamas on a hunch that SPECTRE is hiding something there. Well, it's been our hunch for a while that the Bahamas "office" for the Registrar Internet.BS does not exist. Now we have confirmation of such. It has been documented in an explosive undercover expose by LegitScript that Internet.BS address as stated could not be verified, could not accept mail, and that the business itself could not actually be found in the Bahamas. more

Do Agencies Already Have the Authority to Issue Critical Infrastructure Protection Regulations?

The President and Congress are deliberating how best to ensure appropriate cybersecurity protection for private sector critical infrastructure. Legislative action and Executive Order are both under consideration. It is possible, however, that the White House Office of Management and Budget (OMB) already has sufficient statutory authority to enact new cybersecurity regulations through the normal notice-and-comment rulemaking process. more

Cyber Criminals Infiltrate Even Small Businesses

I read an interesting article in the Wall Street Journal today entitled Cyber Criminals Sniff out Vulnerable Firms. It's a story of a small business owner in New York whose company was broken into by cyber criminals and stole $1.2 million from its bank accounts, although the owner was able to later recover about $800,000 of that. The moral of the story is that small businesses feel like they are not a major target for online thefts like these. more

Is IPv6 a Boon to Criminals and Foe to the FBI?

Declan McCullagh recently opined that the "FBI [and the] DEA warn [that] IPv6 could shield criminals from police." His post was picked-up relatively widely in the past few days, with the headlines adding more hyperbole along the way. So just how real is this threat? Let's take a look. more

Accountability, Transparency, and… Consistency?

ICANN Compliance now has two conflicting answers on record concerning the enforceability of RAA 378 on WHOIS inaccuracy. This is a topic of extreme importance and one we are trying to get to the bottom of. ...inconsistency needs to be resolved as it directly impacts the current RAA negotiations and certainly before new gTLDs are deployed. more

Fixing Holes

According to press reports, DHS is going to require federal computer contractors to scan for holes and start patching them within 72 hours. Is this feasible? It's certainly a useful goal. It's also extremely likely that it will take some important sites or applications off the air on occasion - patches are sometimes buggy (this is just the latest instance I've noticed), or they break a (typically non-guaranteeed or even accidental) feature that some critical software depends on. more

Interoperability Testing Event for DMARC Email Anti-Spoofing Specification

At the end of January, the DMARC (Domain-based Message Authentication, Reporting & Conformance) specification was publicly announced and resulted in widespread media coverage, blog posts and discussion. Since that time various individuals and organizations have been working on writing code for DMARC validators and report parsers. The dmarc-discuss list has been fairly active as various questions and issues have been raised and clarified. Now it is time to see how well the various implementations play together in live testing. more

The Business Parallels Between IPv6 and DNSSEC

For two things that would seem to be completely unrelated there is an interesting parallel between IPv6 and DNSSEC. In both cases there is a misalignment of interests between content providers and service?providers. Content providers aren't highly motivated to deploy IPv6 because only a small proportion of users have v6 connectivity and even fewer only have v6. Service providers aren't anxious to deploy IPv6? because there isn't a lot of content on v6, and virtually none exclusively on v6 - so they don't expand the universe of interesting stuff on the web by deploying IPv6. Basically the same things could be said about DNSSEC. more

Password Leaks

The technical press is full of reports about the leak of a hashed password file from LinkedIn. Worse yet, we hear, the hashes weren't salted. The situation is probably both better and worse than it would appear; in any event, it's more complicated. more