New Research Finds Over 80% of Domain Names Used by Phishers Are Legitimate Domains

New research from the Anti-Phishing Working Group (APWG) has found that up to 81% of domain names used for phishing are legitimate domains that have been hacked. More specifically, out of the 30,454 phishing domains under observation, only 5,591 domain names (18.5%) were registered by phishers according to APWG. The remaining small percentage of the domains used in phishing belonged to subdomain resellers such as ISPs and other web-based services. more

Shaping the Future of ICP-2: Community Input Extended to December 2024

In October 2023, the Number Resource Organization initiated a process to undertake a significant update to Internet Coordination Policy 2 (ICP-2); the policy which specifies the criteria for establishing new Regional Internet Registries (RIRs). The Address Supporting Organization Address Council (ASO AC) has been tasked with managing the revision process, emphasizing community engagement and transparency. more

Where is the Standard ‘Socket’ for Broadband?

When you plug into a broadband socket, what you are accessing is a distributed computing service that supplies information exchange. What is the service description and interface definition? For inspiration, we can look at the UK power plug. One of the great unsung fit-for-purpose innovations in British society is the BS1363 13 ampere power plug and socket. This is superior to other plugs by virtue of its solid construction and safe design. more

The FBI and the iPhone: Important Unanswered Questions

As you probably know, the FBI has gotten into Syed Farook's iPhone. Many people have asked the obvious questions: how did the FBI do it, will they tell Apple, did they find anything useful, etc.? I think there are deeper questions that really get to the full import of the break. How expensive is the attack? Security - and by extension, insecurity - are not absolutes. Rather, they're only meaningful concepts if they include some notion of the cost of an attack. more

Jevons Paradox and Internet Centrality

The story of computing and communications over the past eighty years has been a story of quite astounding improvements in the capability, cost and efficiency of computers and communications. If the same efficiency improvements had been made in the automobile industry cars would cost a couple of dollars, would cost fractions of a cent to use for trips, and be capable of travelling at speeds probably approaching the speed of light! more

FIFA and the Perils of No Accountability

Forgive me if you can, but I am about to say something blindingly obvious. The arrests made by the US Government and Swiss authorities of senior FIFA officials should remind us of a deep truth. Organizations must be accountable: to members, to users, to superiors, to markets, to someone who can say "stop what you are doing and amend your ways". When we consider the transfer of authority from the USG over the IANA function, let us keep in mind... more

Daily Search Engine Usage Reaching Email Usage

Use of search engines on a daily bases has been steadily rising from about one-third in 2002 to current rate of just under 50% according to a recent report by Pew Internet & American Life Project. With this increase, the search engine use will soon be reaching that of email which is currently 60% of internet users. The study also points out that these "new figures propel search further out of the pack, well ahead of other popular internet activities, such as checking the news, which 39% of internet users do on a typical day, or checking the weather, which 30% do on a typical day." more

Cloud Marketplaces Help Cut Through Confusing IaaS Pricing

A recent study from 451 Research reveals some interesting facts about the nature and complexity of cloud pricing. In theory, one of the major benefits of using the cloud is that on-demand pricing makes it easy to know exactly how much a company will be spending and avoid large-scale capital expenditure. That's certainly true, but the cloud space has yet to develop into a fully mature market, which means that companies have to tangle with wildly different pricing models and the cost itself can vary between vendors. more

Good Samaritans with Network Visibility

In a big open office 30 feet from me, a team of US Veterans speak intently on the phone to businesses large and small, issuing urgent warnings of specific cyber security threats. They call to get stubborn, confused people to take down hidden ransomware distribution sites. They call with bad news that a specific computer at the business has malware that steals login credentials. more

M3AAWG Offers Some Sensible Password Advice

M3AAWG is a trade association that brings together ISPs, hosting providers, bulk mailers, and a lot of infrastructure vendors to discuss messaging abuse, malware, and mobile abuse. (Those comprise the M3.) One of the things they do is publish best practice documents for network and mail operators, including two recently published, one on Password Recommendations for Account Providers, and another on Password Managers Usage Recommendations. more

A Note to PhDs Transferring From Academia to the ML Industry

Congratulations. You have successfully defended your PhD dissertation, and it was a defining moment in your life. Your professorial experience and teaching assistant credentials are finally going to pay off. Further, you might have hundreds of citations, and PhDs are sought after because of their subject matter expertise. Well, that is OK. All that hard work and discipline allows you to use your newly earned moniker and seek out additional opportunities, either within the scope of academia or corporate options. Wait, Wait, Wait, not so fast. If you are thinking of just strolling into the industry and immediately begin earning a six-figure salary, think again, my friend. more

Google Claims It Fixed the Security Holes the CIA Exploited

WikiLeaks shook the internet again on March 7, 2017, by posting several thousand documents containing information about the tools the CIA allegedly used to hack, among others, Android and iOS devices. These classified files were obtained from the CIA's Center for Cyber Intelligence, although they haven't yet been verified and a CIA official declined to comment on this incident. This isn't the first time that the U.S. government agencies were accused of crossing the line and undermining online security and civil liberties, as it's been only a year since the infamous FBI-Apple encryption dispute. It's like "1984" all over again. more

Hyperties: “Travel Adaptors” for the Cloud?

I have spent the day here in Berlin attending my second advisory board meeting for the EU research project reTHINK. I'm chewing over what I learnt about the possible future of the telecoms and cloud industry. There has been a decades-long tussle between the communications and computing parts of the ICT industry. Both sides wish to exert power over the digital economy. Sometimes this tussle works for the common good, sometimes not. more

IoT Botnet Source Code Responsible for Historic Attack Has Been Publicly Released

The source code for the IoT botnet 'Mirai' has been released," warns security expert Brian Krebs whose own website was targeted with the same botnet resulting in the historically large DDoS attack last month. more

The Sovereignty Paradox: What Iran’s 2026 Shutdown Reveals About the Fragmenting Internet

Iran's 2026 internet shutdown was not a glitch but a trial of digital sovereignty, revealing how easily connectivity can be weaponised to silence society, concentrate state power, and fracture the promise of a global internet. more