Monster.com Response to Security Breach Unacceptable

As some of us are continuing to learn this week the Monster.com service has again been successfully hacked. According to a security bulletin posted on Monster.com on January 23rd, 2009, the intruder gained access to the user database, while no resumes were apparently compromised... As a user of Monster.com what I find incredibly upsetting about this situation is that I had to find out about this through a security blog. more

Tech Continuity in President Trump’s First 100 Days

Tech developments saw less drama than trade and environmental shifts during Trump's first 100 days. Continuity, not abrupt change, defined his approach to AI and digital regulation. Only 9 of 139 executive orders (EOs) focused on tech. Trump's tech policy emphasised reviews and incremental shifts. Public consultations on AI, cybersecurity, and cryptocurrencies signal steady evolution over upheaval. more

Another Thanksgiving and Another 131 Domain Names Seized by Homeland Security

Last year I wrote a post right after Thanksgiving entitled: "While You Were Eating You're Turkey Homeland Security Was Seizing 9 Domains". Well I could have repeated the headline today except the number would be 131 domains rather than just 9. Looks like Homeland Security is going to make domain seizures on Thanksgiving as common in the US as Turkey and Stuffing. more

The Root Is Not a TLD

It's a simple, straightforward fact that the root is not a TLD. However, the current policy around new gTLDs treats the root like a TLD registry and as anyone who runs a TLD registry knows, they have certain inescapable characteristics that may not be the best for the root. In almost every TLD, once a domain name has been registered, the registrant can use it commercially with few restrictions... more

DNS, Domain Names, and Certificates: The Missing Links in Most Cybersecurity Risk Postures

In 2019, we've seen a surge in domain name system (DNS) hijacking attempts and have relayed warnings from the U.S. Cybersecurity and Infrastructure Agency, U.K.'s Cybersecurity Centre, ICANN, and other notable security experts. Although the topic has gained popularity amongst CIOs and CISOs, most companies are still overlooking important security blind spots when it comes to securing their digital assets outside the enterprise firewalls -- domains, DNS, digital certificates. more

Evolution of the Dot Brand Domains in 5 Years

ICANN's last new gTLD application closed in 2012 with more than 600 brands applying for their dot brand. Dot brand domains associate a keyword or keyphrase and a brand name in a complete domain name... To understand better how the evolution of the dotBrand has been throughout these years, number of websites launched, redirects, registries etc, Dot Brand Observatory prepared a few visual graphics. more

Another Day, Another Set of Hacking Attacks. News At 11.

While reading Reuters I came across a news article indicating that a number of high profile agencies - from the United Nations to the Canadian Government to government of Taiwan - were broken into over a period of the past five years. ... I'll say it right now, even though I haven't been briefed on it. It was China. more

China Betting on IPv6 and First Mover Advantage

The United States' reluctance to invest in IPv6 makes it more likely that China will be in a position to gain the first-mover advantage it seeks. ...Liu Dong, president of the Beijing Internet Institute sums it up succinctly: "We think we can develop the killer applications," he says. China plans to show the rest of the world just how advanced its Internet is at the 2008 Olympics in Beijing. CNGI will control the facilities -- everything from security cameras to the lighting and thermostats -- at the Olympic venues, and events will be broadcast live over the Internet. Even the taxis in Beijing's snarled traffic will connect to CNGI via IPv6 sensors so that dispatchers will be able to direct their drivers away from congestion. more

Three Reasons Why CISOs Need to Understand Domain Security

Domain name abuse is one of the most dangerous and under-regulated issues in digital business security today. An attack on a web domain can lead to the redirection of a company's website, domain spoofing, phishing attacks, network breaches, and business email compromise (BEC). Domains used as a company's online world are part of an organization's external attack surface and need to be continuously monitored for cybercrime attacks and fraud. more

Wikileaks and the Gaps in Internet Governance

The recent publication of leaked United States diplomatic cables by Wikileaks has produced an extremist reaction by some governments, provoking them and compliant large corporations to strike out at the organisation's Web site, its financial base, and the person of its founder, Julian Assange. For the Civil Society Internet Governance Caucus (IGC), this highlights the need for cross-border Internet governance issues to be made subject to a due process of law, informed by sound political frameworks, including those of human rights. more

IPv6… Becoming a Hot Topic Again?

Is IPv6 a hot topic again in the wake of the increased coverage of the looming IPv4 address depletion? This was the theme of a coffee break discussion we had at the recent MENOG3 conference in Kuwait. With as many opinions as participants, I turned to "Google Trend" to help me get a better feel... Using IPv6 as search word and varying the time line indeed provided some interesting perspective and tidbits on when and where IPv6 seems to be or have been a hot topic indeed. more

The Purple Team Pentest

It's not particularly clear whether a marketing intern thought he was being clever or a fatigued pentester thought she was being cynical when the term "Purple Team Pentest" was first thrown around like spaghetti at the fridge door, but it appears we're now stuck with the term for better or worse. Just as the definition of penetration testing has broadened to the point that we commonly label a full-scope penetration of a target's systems with the prospect of lateral compromise and social engineering as a Red Team Pentest -- delivered by a "Red Team" entity operating from a sophisticated hacker's playbook. more

ICANN and the Hyper-Aggressive Trademark Owners: The “Monster Test”

We read and hear a lot of complaints from trademark interests about allegedly rampant cybersquatting and other forms of trademark infringement, but it's rare to see a story about reverse domain name hijacking and other abuses committed by them. That's what made it so refreshing to see an article in the Saturday, April 4th Wall Street Journal titled "The Scariest Monster of All Sues for Trademark Infringement – Fancy Audio-Cable Outfit Defends Its Brands; A Mini Golf Course Fights Back". more

IGF 2024 in Riyadh: AI, WSIS+20 and the Global South

"Building our Multistakeholder Digital Future" was the theme of the 19th edition of the UN-based Internet Governance Forum (IGF). It attracted more than 11.000 participants (Offline and Online) from all over the world in Riyadh/Saudi Arabia, December 15-19, 2024. In the 307 plenaries, workshops, open fora, lightening talks and other conversations in the meeting rooms and the lobby halls of the King Abdulaziz International Conference Center (KAICC), nearly everything... more

Towards More Efficient Registry-Registrar Relations

On the morning of Wednesday 15th October, the The Domain Name Association (the DNA) held an important working group meeting during ICANN 51 Los Angeles. The topic was to discuss several operational issues between registries and registrars. The meeting's unofficial ongoing name is the Registry-Registrar Operations Working Group. The meeting was a continuation of an inaugural meeting that was held back in June of this year, and covered in a Industry Association: An Implementation Model circulated by the DNA from September 17, by Executive Director Kurt Pritz. more