DNS

DNS Reflection/Amplification Attack: Proved

Last year there was a "threat" by anonymous group to black out Internet by using DNS Reflection/Amplification attack against the Internet DNS Root servers. I even wrote a little article about it: "End of the world/Internet". In the article I was questioning if this was even possible and what was needed as general interest and curiosity. Well, looking at the "stophaus" attack last week, we are getting some answers. more

Verisign Doesn’t Think the Net Is Ready for a Thousand New TLDs

Yesterday Verisign sent ICANN a most interesting white paper called New gTLD Security and Stability Considerations. They also filed a copy with the SEC as an 8-K, a document that their stockholders should know about, It's worth reading the whole thing, but in short, their well-supported opinion is that the net isn't ready for all the new TLDs, and even if they were, ICANN's processes or lack thereof will cause other huge problems. more

The Spamhaus Distributed Denial of Service - How Big a Deal Was It?

If you haven't been reading the news of late, venerable anti-spam service Spamhaus has been the target of a sustained, record-setting Distributed Denial-of-Service (DDoS) attack over the past couple of weeks... Of course, bad guys are always mad at Spamhaus, and so they had a pretty robust set-up to begin with, but whoever was behind this attack was able to muster some huge resources, heretofore never seen in intensity, and it had some impact, on the Spamhaus website, and to a limited degree, on the behind-the-scenes services that Spamhaus uses to distribute their data to their customers. more

End of the World/Internet on 31-March-2012?

Well... Maybe not the world, but the Internet it seems. According to a Pastebin letter, Anonymous announced they will black-out Internet on 31st of March. They even explained how to do it by attacking the DNS Root Servers on Internet using a reflected amplification attack. If this is successful, the root DNS servers will become unresponsive and cannot handle any other requests... more

Reducing the Risks of BYOD with DNS-Based Security Intelligence; Part 1: Understanding the Risks

Ah, BYOD. How I love thee. BYOD, or "Bring Your Own Device", gives me choices. I can use a device at work I actually like and am most effective with. (How did I ever get by without my iPad?) But BYOD comes with challenges. Personal devices can be infected with malware. Once they're connected to an enterprise's network, they can be controlled by a bot master to hijack enterprise resources and wreak havoc as part of a botnet. more

Follow a Phishing Case in Real Time: postfinances.com / Swiss Post

It is just another phishing case. Why should I care? I happened to receive my own copy of the phishing email message. Most Internet users will just smile bitterly before deleting it. I checked it to see why it had gone through the spam filters. It had no URL in the text but a reply-to address. So it needed a valid domain name, and had one: postfinances.com. PostFinance (without trailing "s") is the payment system of the Swiss Post. It has millions of users. more

ICANN’s Noah: Chehade’s 40-Day Report Card

Forty days. That's how long Fadi Chehade has had to get a handle on the most complex, diverse and important non-profit corporation the world has ever known. The last guy to face such an unforgiving timeline was measuring timber in cubits. So if Cheade is Noah, I guess that makes ICANN Chairman Steve Crocker God, telling Fadi to wrangle all these diverse (and often diverging) constituencies and march them two-by-two into the boat, ahead of the coming storm. more

De Facto Rules a Boon to Rogue Players

In Ian Flemming's Thunderball M sends 007 to the Bahamas on a hunch that SPECTRE is hiding something there. Well, it's been our hunch for a while that the Bahamas "office" for the Registrar Internet.BS does not exist. Now we have confirmation of such. It has been documented in an explosive undercover expose by LegitScript that Internet.BS address as stated could not be verified, could not accept mail, and that the business itself could not actually be found in the Bahamas. more

NTIA Awards IANA Functions Contract to ICANN

The U.S. Commerce Department's National Telecommunications and Information Administration (NTIA) announced today that it has awarded the Internet Assigned Numbers Authority (IANA) functions contract to the Internet Corporation for Assigned Names and Numbers (ICANN). The IANA functions are key technical services critical to the continued operations of the Internet's underlying address book, the Domain Name System (DNS). more

Proposed New IETF Standard Would Create a Nationally Partitioned “Internet”

For those worried about the threat of a state-based takeover of the Internet, there is no need to obsess over the International Telecommunication Regulations (ITRs) exclusively. Three Chinese engineers are proposing a way to alter Internet standards to partition the Internet into autonomously administered national networks, using the domain name system (DNS). The idea was not proposed in the ITU; no, it was sent to a multi-stakeholder institution, the granddaddy of the Internet itself, the Internet Engineering Task Force (IETF). more

WHOIS Review and Beyond 3.7.8

We have posted our support of the WHOIS Policy Review Team Report with two important comments. First, on page 79 of the report it is confirmed that the RAA is unenforceable on WHOIS inaccuracy (we wrote about this while at the last ICANN meeting) because the language of RAA 3.7.8 has no enforcement provision. It is now time for ICANN to confirm this problem officially.  more

The Business Parallels Between IPv6 and DNSSEC

For two things that would seem to be completely unrelated there is an interesting parallel between IPv6 and DNSSEC. In both cases there is a misalignment of interests between content providers and service?providers. Content providers aren't highly motivated to deploy IPv6 because only a small proportion of users have v6 connectivity and even fewer only have v6. Service providers aren't anxious to deploy IPv6? because there isn't a lot of content on v6, and virtually none exclusively on v6 - so they don't expand the universe of interesting stuff on the web by deploying IPv6. Basically the same things could be said about DNSSEC. more

ICANN’s Contract Not Enforceable on WHOIS Accuracy

This may or may not come as a shock to some of you, but ICANN's contract with the Domain Name Registrars, in terms of WHOIS inaccuracy is not enforceable. Bear with me. The ability of ICANN to enforce against a Registrar who fails to correct or delete a domain with false WHOIS does not exist. more

If You Build It, They Will Come.

Only two years after signing the DNS root zone, the powerful lure of a secure global infrastructure for data distribution is starting to reveal itself. It is illustrated clearly by two proposed technical standardizations that seek to leverage secure DNS. To some degree these developments highlight the strength of DNS institutions and how they might fill gaps elsewhere in the Internet's governance. But an increasing reliance upon and concentration of power in the DNS also makes getting its global governance correct even more important. more

Spam from Mobile Networks? Who Woulda Thought…

Mobile networks aren't usually thought of as sources of spam, but a quick look at some of the resources that track spam reveals they actually are. This is counter intuitive at first glance because when most people think of mobile they think of smartphones, and those aren't known to be sources of spam (at least not yet). What's really going on is PCs connected to mobile networks with air cards, or tethered with a smartphone where it's permissible, are the culprits more