One of fastest growing trends of electronic communications is digital identity. The simplest way of establishing digital identity is to get a domain name and create a web site and email accounts. While this might have been a fairly complex undertaking some ten years ago, today it is a trivial matter. So trivial in fact that spammers and phishers can ply their trade with very low costs of entry. These low cost of entry have made the Internet a commodity business as traffic is handled in the aggregate and competitive pricing has made being an ISP a difficult business model. It also has created aggressive growth and adoption curves. The Internet is also the lowest common denominator... more
The following is an overview of the recent Honeynet Project and Research Alliance study called 'Know your Enemy:Phishing' aimed at discovering practical information on the practice of phishing. This study focuses on real world incidents based on data captured and analyzed from the UK and German Honeynet Project revealing how attackers build and use their infrastructure for Phishing based attacks. "This data has helped us to understand how phishers typically behave and some of the methods they employ to lure and trick their victims. We have learned that phishing attacks can occur very rapidly, with only limited elapsed time between the initial system intrusion and a phishing web site going online..." more
The sky is falling! The sky is falling! ...or is it? What is this thing called "pharming"? Put simply, it's redirection of web traffic, so that the server you think you're talking to actually belongs to a criminal. For example: you think you're talking to www.examplebank.com because it says so in the browser's address bar, but actually you're connected to www.mafia-R-us.ru. This can happen in three main ways: 1. DNS Hijack: a social engineering attack on the Internet infrastructure... more
The following excerpt is from the Free Software Magazine, March 2005 Issue, written by Kirk Strauser. To read the entire article, you may download the magazine here [PDF]. Also thanks to Yakov Shafranovich for making us aware of this publication. "Spam has existed since at least 1978, when an eager DEC sales representative sent an announcement of a product demonstration to a couple hundred recipients. The resulting outcry was sufficient to dissuade most users from repeating the experiment. This changed in the late 1990s: millions of individuals discovered the internet and signed up for inexpensive personal accounts and advertisers found a large and willing audience in this new medium." more
A few months ago, Ted Hardie (AD of Applications for the IETF) informed the MARID WG in the closure announcement as follows: "Given the importance of the world-wide email and DNS systems, it is critical that IETF-sponsored experimental proposals likely to see broad deployment contain no mechanisms that would have deleterious effects on the overall system. The Area Directors intend, therefore, to request that the experimental proposals be reviewed by a focused technology directorate..." more
Former CIA Director, George J. Tenet recently called for measures to safeguard the United States against internet-enabled attacks. "I know that these actions will be controversial in this age when we still think the Internet is a free and open society with no control or accountability, but ultimately the Wild West must give way to governance and control." Mr. Tenet seems about as confused about the internet as the ITU... more
Public blacklists are used on a daily basis by many enterprises in order to curb spam. Frederic Aoun and Bruno Rasle, co-authors of the book "Halte au Spam", unveiled today their latest study on the subject. This contribution is divided in two parts... more
The Federal Trade Commission and NIST had a two-day Authentication Summit on Nov 9-10 in Washington DC. When they published their report explaining their decision not to create a National Do Not Email Registry, the FTC identified lack of e-mail authentication as one of the reasons that it wouldn't work, and the authentication summit was part of their process to get some sort of authentication going. At the time the summit was scheduled, the IETF MARID group was still active and most people expected it to endorse Microsoft's Sender-ID in some form, so the summit would have been mostly about Sender-ID. Since MARID didn't do that, the summit had a broader and more interesting agenda. more
The term "Internet Governance" has become an area of particular attention in part as a consequence of widespread recognition that the Internet represents an important area of national interest for all countries seeking to participate in the benefits of global electronic commerce, distance learning, access to the encyclopedic wealth of information on the Internet, and in the social dimension that the Internet is creating. From the perspective of governments, the Internet is simultaneously a technology that promises high economic value for parties making use of it and a challenge in that it is unlike all other telecommunications media previously invented. more
The IETF MARID working group has been slogging away all summer trying to produce a draft standard about e-mail sender verification. They started with Meng Wong's SPF and Microsoft's Caller ID for E-mail, which got stirred together into a hybrid called Sender ID. One of the issues hanging over the MARID process has been Microsoft's Intellectual Property Rights (IPR) in Caller ID and Sender ID. The IETF has a process described in RFC 3668 that requires contributors to disclose IPR claims related to their contributions. more
The Noncommercial Users Constituency (NCUC) is the constituency group representing civil society organizations in the formation of domain name policy. In August 2004 it initiated a process to nominate people to serve on the UN Secretary-General's Working Group on Internet Governance, as representatives of civil society. Our purpose was to assist the Secretary-General to identify qualified and widely-supported individuals capable of serving on the WGIG on behalf of civil society. more
While several news stories are reporting that Sender-ID has been killed, that is not entirely true. While Sender-ID in its current form is dead because of Purported Responsible Address (PRA), the compromise version with MAILFROM and PRA scopes is not. Also, the co-chairs want to stay away from any other alternative algorithms that do RFC2822 checking because of possible Intellectual Property Rights (IPR) claims by Microsoft on that as well. Andrew Newton, one of two co-chairs of the working group, wrote in an email today to the group's discussion forum... more
This is the final part of a three-part series interview by Geert Lovink with Jeanette Hofmann, policy expert from Germany, where she talks about her experiences as a member of the ICANN's Nominating Committee and her current involvement as a civil society member of the German delegation for the World Summit of the Information Society (WSIS). "You have been visiting WSIS as a member of the German delegation. Could you share some of your personal impressions with us? Did you primarily look at WSIS as an ICT circus for governmental officials and development experts or was there something, no matter how futile, at stake there?..." more
Markus Kummer, Executive Coordinator, Secretariat of the United Nations Working Group on Internet Governance, is a career diplomat, who has served as eEnvoy of the Swiss Foreign Ministry in Bern since April 2002. His main tasks include foreign policy coordination in the area of information and communication technologies, in general, and the World Summit on the Information Society (WSIS), in particular. He chaired the negotiating group that developed an agreed text on Internet governance for the WSIS Declaration of Principles and Plan of Action in December 2003... Mr Kummer says: "The time-frame is very short indeed. And the task ahead of us is daunting." more
The International Telecommunication Union (ITU), held an ITU WSIS Thematic Meeting on Countering Spam from 7 to 9 July 2004, in Geneva, Switzerland. The meeting was focused around various topics including: Scope of the problem, Technical solutions, Consumer protection and awareness, Legislation and enforcement, and International cooperation. The following is a report by William J. Drake, Senior Associate International Centre for Trade and Sustainable Development in Geneva. more
A World-Renowned Source for Internet Developments. Serving Since 2002.