Showing posts with label phishing. Show all posts
Showing posts with label phishing. Show all posts

2017-08-27

News Review | Report: ICANN's New gTLDs As Global DNS Malware

News Review | ©2016 DomainMondo.com
Domain Mondo's weekly internet domain news review (NR 2017-08-27) with analysis and opinion: Features •  1) Report: ICANN's New gTLDs As Global DNS Malware, 2) Names, Domains & Trademarks: .COM Still King, Verisign, GoDaddy, Ted Cruz, ICANN & NTIA, New gTLDs Reality Check, .GAY, .MUSIC, 4) ICYMI Internet Domain News, 5) Most Read Posts.

1) ICANN's new gTLDs as global DNS malware--see "Statistical Analysis of DNS Abuse in gTLDs" below--ICANN Public Comment periods closing in September:
Figure 23, Report p. 13
SIDN Labs and TU Delft deliver final report for ICANN study | sidnlabs.nl: "... An interesting finding of our study is a clear upward trend in the absolute number of phishing and malware domains in new gTLDs while these numbers remain relatively constant in legacy gTLDs. Also, we discovered that new gTLDs have affected the number of domains used for spam in legacy gTLDs: abused domains in new gTLDs do not increase the number of total malicious registrations. Instead we observe a shift from legacy gTLDs to new gTLDs. Our findings suggest that some new gTLDs have increasingly become a target for malicious actors. For example, Spamhouse blacklisted at least 10% of all registered domains in as many as 15 new gTLDs at the last quarter of 2016See the report [pdf] for more details ... We conducted the SADAG study for the Competition, Consumer Choice, and Consumer Trust Review Team. The CCT Review Team was established to review how the New gTLD Program impacts competition, consumer choice and consumer trust." (emphasis and links added)

Let's review all the ways ICANN's new gTLDs are now known to be global DNS malware:

1. New gTLDs are known to  "break stuff" and cause "collisions;"

2. New gTLDs are known to "fail to work as expected" on the internet--the so-called "Universal Acceptance" (UA) problem--which ICANN knew about long before (since at least 2003) it expanded the gTLDs from just 22 to over 1200 beginning in early 2014, which is why ICANN tried to absolve itself of liability--even though it has failed to warn consumers (registrants)--see Base Registry Agreement Section 1.2:
1.2   Technical Feasibility of String.  While ICANN has encouraged and will continue to encourage universal acceptance of all top-level domain strings across the Internet, certain top-level domain strings may encounter difficulty in acceptance by ISPs and webhosters and/or validation by web applications.  Registry Operator shall be responsible for ensuring to its satisfaction the technical feasibility of the TLD string prior to entering into this Agreement. (emphasis added)
3. Absolute unlimited monopolistic pricing powers granted to new gTLD registry operators, including the right to unlimited increases in domain name registration and renewal fees--ICANN and its "ICANN community" (which is effectively controlled by registry operators and registrars) rejected the recommendation and advice of the the U.S. Department of Justice Antitrust Division to protect consumers (registrants). New gTLD Registry Operators are free to "rape and pillage" the global domain names marketplace and consumers (registrants) worldwide, thanks to ICANN.

4. The Electronic Frontier Foundation (EFF) has warned registrants to avoid new gTLDs due to ICANN's new gTLDs' flawed and overreaching RPMs.

5. And now, the icing on ICANN's global malware cake, SIDN Labs and Delft University of Technology's report (pdf), characterizing new gTLDs as "phishing and malware domains."

Is it any wonder some desperate new gTLD registry operators have tried giving away new gTLD domain names for free? Is it any wonder that new gTLD domain name registrations are collapsing--new gTLD Statistics by Top-Level Domains | ntldstats.com--new gTLDs' registrations are now "falling off a cliff":
 New gTLDs' domain name registrations collapsing
This is what happens when you let special interests (a/k/a lobbyists) run internet governance via a governance model known as "multistakeholderism," limiting and excluding governments from their proper role in protecting the public interest. Add to that the dysfunctional ICANN organization which created for its new gTLDs, a new "Global Domains Division" (try to find any reference to that in the ICANN Articles or Bylaws), primarily staffed by incompetent cronies of ICANN's equally inept ex-CEO who quit 3½ years into a 5-year contract. As I've said before, ICANN has proven to be unfit for the purpose for which it was originally intended.

2) Names, Domains & Trademarks
•  .COM Still King10 tips for choosing the perfect domain | SearchEngineLand.com August 22, 2017: "... 3. Go for a .COM [domain name]--If you are serious about building a long-term brand online, there is nothing better than a .com. Using a 301-redirect to drive traffic to a .net or .org is totally fine, but owning the .com or the equivalent TLD for your target market country is critical ..."

•  VerisignWarren Buffett's Stake In The Internet--"VeriSign [domain: verisign.com, NASDAQ: VRSNis the manager of the .com and .net domain registers - they serve as a monopolistic gatekeeper to the Internet. There are three catalysts for this company's stock appreciation: pricing powers, the Internet's global expansion, and share buybacks. I believe this stock's long-term risk/reward ratio is greatly weighted towards reward ..."--SeekingAlpha.com  Aug. 22, 2017.

•  GoDaddy (domain: godaddy.com) (NYSE: GDDY) announced Tuesday that CEO Blake Irving would retire effective December 31, 2017, and Scott Wagner, GoDaddy President and COO, would assume the CEO role thereafter. Irving will continue to serve on GoDaddy's Board of Directors through June 2018.

•  Ted Cruz, ICANN & NTIATed Cruz should stop obstructing Trump’s [NTIA] nominee [David Redl] for telecom chief | rstreet.org by Joe Kane, Aug 22, 2017: "... Redl has been the subject of a largely unrelated fight waged by the junior senator from Texas over the Internet Assigned Numbers Authority [IANA]. Cruz continues to raise objections about the now-completed transfer of stewardship of IANA functions from NTIA to the Internet Corporation for Assigned Names and Numbers [ICANN]. ICANN is a private, nonprofit company ..." [Editor's note: Cruz has said he wants "assurances" from Redl, and frankly, I would have expected no less.]

•   New gTLDs Reality CheckThe Great Domain Correction of 2017? | pinkybrand.com"... China. China is HARD. You will not be successful there, as a foreign registry operator, at a minimum, unless you understand that you will likely lose money or barely break even for several years and are prepared to deal with that reality. You must be in it for the long term. Long term, at a minimum, is 5 years of sweating it out (flying back and forth on a near monthly basis) before things *might* work out. Over the short to medium term the domain industry is likely to shed inefficient registry and registrar operators and investors, especially some of those who banked on new domain extensions (new gTLDs) that have no real consumer traction—which are many— and can no longer, or are just unwilling, to fund the basic holding/operating costs, let alone fund any marketing team or person. For sure there is an easily foreseen correction—if not outright registration numbers recession—going on right now for some in the domain industry ... This includes ICANN, that may need to shed some personnel as a result of what may be "The Great Domain Correction of 2017"..."

•  .GAYRequest 17-3: Dotgay LLC | BAMC Recommendation on Reconsideration Request 17-3 | ICANN.org 23 Aug 2017: "BAMC [Board Accountability Mechanisms Committee] recommends that the Board deny Request 17-3."

•  .MUSIC:  Request 17-2: DotMusic Limited | BAMC Recommendation on Reconsideration Request 17-2 - ICANN.org 23 Aug 2017: "BAMC recommends that the Board deny Request 17-2."

4) ICYMI Internet Domain News 
  • "We’re currently living in a time digital strategists have deemed the data wild west. The next decade the data policies set could determine the basis of digital rights for the foreseeable future."--TechCrunch.com
  • Inciting Violence vs Freedom of Speech | Namecheap.com: "... The real danger in my opinion is what lies invisible yet is the most dangerous force that anyone of us will ever know. That is the insidious and dangerous force of power. The power to control our thoughts, our privacy, our opinions and most importantly our speech that lies within the dark nature of absolute power itself and takes over seemingly well meaning politicians, presidents, governments, movements that then use this power against us. This is the real danger that we must all be watchful for ..."--Richard Kirkendall, Namecheap CEO

[Editor's note: Investing has moved to the weekly Tech Review.]

5) Most read posts (# of pageviews Sun-Sat) this past week on DomainMondo.com: 
1. News Review: Last Round of ICANN New gTLD .AFRICA Litigation?
2. Explaining Swings in Bitcoin’s Price, Cryptocurrency Primer (video)

-- John Poole, Editor, Domain Mondo 

feedback & comments via twitter @DomainMondo


DISCLAIMER

2017-06-29

Global Phishing Survey, New gTLD Domain Names, Malicious Registrations

graphic of APWG Global Phishing Survey major findings
source: APWG Global Phishing Survey, infra
"... the problem in the nTLDs [new generic top-level domains] are malicious registrations, made for the purpose of phishing. Of the 6,549 domains used for phishing in the 228 nTLDs, 86% (5,633) were registered maliciously ... 71% of those malicious registrations were found in just ten nTLDs [chart below] ... The TLD market is now more crowded and competitive than at any time in history, and some nTLD registries have been competing aggressively on price ..."--APWG, infra
Top ten nTLDs with malicious domain name registrations
source: APWG.org
APWG (Anti-Phishing Working Group | domain: apwg.org)  released its latest Domain Name Use and Trends report (embed below) on 26 June 2017:

"Some Key Findings in this report:
  • There were at least 255,065 unique phishing attacks worldwide. This represents an increase of over 10% from the 230,280 attacks we identified in 2015. An attack is defined as a phishing site that targets a specific brand or entity. A single domain name can host several discrete phishing attacks against different banks, for example.
  • The attacks occurred on 195,475 unique domain names. This is the most we have recorded in any year since we began these reports in 2007. The number of domain names in the world grew from 287.3 million in December 2014 to 329.3 million in December 2016.
  • Of the 195,475 domains used for phishing, we identified 95,424 domain names that we believe were registered maliciously by phishers. This is an all-time high, and almost three times as many as the number we found in 2015. A little over half of these registrations were made by Chinese phishers. The other 100,051 domains were almost all hacked or compromised on vulnerable Web hosting. This means that nearly half of all domains that hosted phishing sites were maliciously registered.
  • Seventy-five percent of the malicious domain registrations were in just four TLDs: .COM, .CC, .PW, and .TK. More than 90% of malicious domains were found in just 14 TLDs. Please see pages 16-17 for more detail.
  • We counted 679 targeted brands. This dropped from 783 in 2015. Phishers are still creating kits dedicated to attacking both popular targets and new targets.
  • Phishing occurred in 454 top-level domains (TLDs). Two-hundred twenty-nine (228) were new top-level domains launched since 2013." (emphasis added)
The Anti-Phishing Working Group (APWG)is a non-profit industry association focused on eliminating the identity theft and fraud that result from the growing problem of phishing and email spoofing. The organization provides a forum to discuss phishing issues, define the scope of the phishing problem in terms of hard and soft costs, and share information and best practices for eliminating the problem.

Global Phishing Survey: Domain Name Use and Trends in 2016 (embed below)


See also:


feedback & comments via twitter @DomainMondo


DISCLAIMER

2017-03-28

Cyber Attacks: Phishing Emails & Ransomware; Security & Privacy (video)

How to Spot a Phishing Email:

Published on Mar 16, 2017: Kate Upton, Jennifer Lawrence, and John Podesta are among victims of these cleverly disguised messages. 

See also: If Your iPhone is Stolen, These Guys May Try to iPhish You | KrebsOnSecurity.com

Video playlist:

Video playlist:
  1. How to Protect Yourself From Cyber Attacks Involving Ransomware I Fortune 2:10
  2. How To Use Two-Factor Authentication to Keep Hackers Away I Fortune 1:32
  3. The Bright Side of the Dark Web I Fortune 2:29
  4. Use These Secure Apps to Protect Your Privacy I Fortune 1:50

More info: National Cyber Security Alliance | StaySafeOnline.org

feedback & comments via twitter @DomainMondo


DISCLAIMER

2017-02-26

News Review: ICANN Multistakeholder vs Multilateral Internet Governance

News Review | ©2016 DomainMondo.com
Domain Mondo's weekly review of internet domain news:

Features • 1. ICANN Multistakeholder vs Multilateral Internet Governance; 2. Why ICANN Multistakeholderism Is Failing; 3. Private Agreements and Antitrust Liability; 4. How ICANN threatens DNS Security & Stability; 5. Phishers shifting to ICANN's new gTLDs; 6. Bogus DMCA Take Down Notices; 7. TMCH Revised Report; 8. Internet Freedom Report: Malta, Cameroon, China; 9. A 'Digital Geneva Convention'; 10. Trump's Trademark in China; 11. Outlook email for your domain name; 12. SHA1 collision; 13. Hacked ICANN data still sells; 14. ICANN events May 9-15 in Madrid; 15. ICANN Public Comment Periods closing in March; 16. Most popular posts this past week.

1. ICANN Multistakeholder vs Multilateral Internet Governance
"I think if we get rid of that [IANA functions] contract we will be free of the pressures"--ICANN President and CEO Fadi Chehade, February 10, 2015.
February 2017: "... The reformed [ICANN] multistakeholder internet governance approach faces significant challenges ... If the multistakeholder model is seen as ineffective in addressing the vulnerabilities that enable cybercrime, or being completely peripheral to the issue, developing economies could question its legitimacy and seek answers in the multilateral system .... "There are also worries that ICANN, the operator of the IANA functions, will abuse its authority and ignore the interests of internet users. In the past, ICANN has been accused of ignoring the views of governments, prioritizing private sector interests, and mismanaging its finances. ICANN recently implemented enhancements to address these and similar concerns. Nevertheless, ensuring that ICANN remains accountable will be critical to demonstrating that the multistakeholder approach works. It will also act as a bulwark against Russian and Chinese efforts at greater intergovernmental control over the internet."--Maintaining U.S. Leadership on Internet Governance | Council on Foreign Relations | cfr.org (emphasis added).

2. Why ICANN multistakeholderism is failing--"industry self-regulation often fails to protect the public"--"lack of transparency, accountability, participation, and representation"--
source: Presentation on DNS and Content Regulation | Electronic Frontier Foundation
source: Presentation on DNS and Content Regulation | Electronic Frontier Foundation
Note re: Public Interest Registry's arbitration process--Systemic Copyright Infringement Alternative Dispute Resolution Policy (SCDRP) | Public Interest Registry | pir.org February 23, 2017--"Given certain concerns that have been recently raised in the public domain, Public Interest Registry is pausing its SCDRP development process to reflect on those concerns and consider forward steps. We will hold [i.e., stop] any further development of the SCDRP until further notice." (emphasis added)
UPDATE: Shadow Regulation Withers In The Sunlight | Electronic Frontier Foundation | eff.org: "... It’s not surprising that a plan developed in secret, without input from Internet users, would disregard users’ rights. As we’ve explained, truly “healthy” Internet governance requires inclusion, balance, and accountability, all of which were absent here. Public Interest Registry did the right thing by hitting the brakes on this proposal. Its brief announcement today acknowledges the importance of good policy-development processes ..."
ICANN's Commercial and Business Users Constituency (BC), Intellectual Property Constituency (IPC), ISPs and Connectivity Providers Constituency (ISPCP) complain about the NonCommercial Users Constituency (NCUC.orgsession at ICANN57 "DNS and Content Regulation" (one leading participant was Electronic Frontier Foundation, EFF.org)--
15 Feb 2017 Letter from BC, IPC and ISPCP (pdf) to Göran Marby, Steve Crocker, and ICANN Board of Directors, published by ICANN on 21 February 2017:
"... for the Hyderabad meeting, a single sponsor group proposed a HIT (High Interest Topic) session on DNS and Content Regulation. Initially, the sponsoring group was allowed to select panelists and designate the moderator, who was also part of the sponsoring organization. Through persistence by other stakeholders, panel participation was broadened considerably. Still, during the HIT session, the sponsoring organization opened with a presentation of their position. In our view, this did not meet the level of broad participation of the ICANN community to warrant a high-interest session ..."
Response from Göran Marby, ICANN President & CEO (embedded below, highlighting added)--or how ICANN subtly shuts down free speech, participation, and representation that conflicts with powerful private profit-seeking corporate interests such as represented by BC, IPC, and ISPCP, and the other unelected non-governmental special interests that dominate ICANN--



3.  Private Agreements and Antitrust Liability--Section 5 of the Federal Trade Commission Act, 15 U.S.C. § 45 "(a)(1) Unfair methods of competition in or affecting commerce, and unfair or deceptive acts or practices in or affecting commerce, are hereby declared unlawful .... (4) (B) All remedies available to the Commission with respect to unfair and deceptive acts or practices shall be available for acts and practices described in this paragraph, including restitution to domestic or foreign victims." (emphasis added)--See Opinion and Order of the Federal Trade Commission (pdf) In the Matter of 1-800 Contacts, Inc., Docket No. 9372 (keyword advertising bidding agreements):
",,, Given that the Complaint alleges liability based only on private agreements that do not constitute government petitioning, 1-800 Contacts’ Third Defense fails .... Because the Complaint alleges that 1-800 Contacts violated Section 5 solely by entering into private bidding agreements, we hold that the Noerr-Pennington doctrine does not apply and 1-800 Contacts’ Third Defense fails as a matter of law. Similarly, because Complaint Counsel need not prove 1-800 Contacts’ lawsuits to be objectively and subjectively unreasonable to establish a Section 5 violation, 1-800 Contacts’ Second Defense also fails. We therefore grant Complaint Counsel’s motion." (emphasis added)

4.  How ICANN threatens Domain Name System Security & Stability:
"In 2015, ICANN's compliance department caused financial harm to a domain name registrant because of a minor, perceived inaccuracy in their domain name's WHOIS records. In this instance, the registrant had a mailing address in Virginia and a phone number with a Tennessee area code. While both details were valid, and the registrant was contactable, a "violent criminal” filed a complaint with ICANN alleging that the details were inaccurate. The complaint was accepted by ICANN and passed along to the domain name registrar. The registrar, fearing a non-compliance notice from ICANN, suspended the domain name without performing any investigation into the claim, resulting in the registrant losing access to their business email account and website."--source infra--
At the NCPH Intersessional, [ICANN] Compliance Concerns Take Centre Stage | circleid.com Feb 23, 2017: ".... as things stand at present, if a domain name can be repossessed from a registrant for any reason at all, without any due process being followed, and in direct violation of Article 1 of the organisation's bylaws, it might well be ICANN that is posing a threat to the security and stability of the Domain Name System" (emphasis added).  See also ICANN Compliance Lends a Hand to a Violent Criminal While Trashing a Legitimate Business | circleid.com.

Editor's note: never forget that among the real core values of ICANN, as established during the Fadi Chehade-Akram Atallah regime (2012-2016), are dishonesty, incompetence, and cronyism.

5. New study reveals phishers are shifting their sights to ICANN's new gTLDs and the cloud: "A study by cybersecurity firm PhishLabs indicates that the volume of phishing attacks grew by almost one-third last year, with cloud storage brands set to overtake financial services as the top targets. Researchers also found that phishing perpetrators are increasingly turning to new gTLDs to dupe internet users."--WorldTrademarkReview.com (emphasis and link added).

6. Bogus DMCA Take Down Notices: in a comment to the U.S. Copyright Office (pdf), Google reports that 99.95% of URLs it was asked to take down last month didn't even exist in its search indexes. "For example, in January 2017, the most prolific submitter submitted notices that Google honored for 16,457,433 URLs. But on further inspection, 16,450,129 (99.97%) of those URLs were not in our search index in the first place."

7. Trademark Clearinghouse Revised Report | ICANN.org: On 23 February 2017, ICANN published the Revised Report of the Independent Review of the Trademark Clearinghouse (pdf): "...  we find that although trademark holders value access to the Sunrise period and many submit proof of use to become eligible for Sunrise registrations, few trademark holders make [new gTLD] Sunrise registrations. This could be due in part to the expense of Sunrise registrations or because other protections of the TMCH services reduce the need for trademark holders to utilize Sunrise registrations." (emphasis added)

8. Internet Freedom Report: Malta, Cameroon, China:
  • Maltese protest proposed internet news laws: Several thousands people took to the streets of the capital of Malta on Sunday to protest against a new bill that will force Internet news sites to register with the government.--Reuters.com
  • Cameroon must urgently free the internet in Anglophone regions - UN expert | AfricaNews.com: "Cameroon should immediately reverse the ‘‘appalling violation of their (citizen’s) right to freedom of expression,” in its Anglophone regions by restoring internet access, a United Nations expert has said."
  • China Ramps Up Control of Domain Names, Adds New Layer to Great Firewall | rfa.org"The draft regulations, which were first released for public consultation in March 2016, would require any websites operating in China to register with a Chinese domain name, which is subject to state control and can be used to shut down entire websites within the country-level .cn top-level domain."
Also note: Internet Freedom Festival | 6 – 10 March 2017: The Global Unconference of the Internet Freedom Communities, March 6-10, 2017, Valencia, Spain.

9.  A 'Digital Geneva Convention': "... Just as the Fourth Geneva Convention has long protected civilians in times of war, we now need a Digital Geneva Convention that will commit governments to protecting civilians from nation-state attacks in times of peace. And just as the Fourth Geneva Convention recognized that the protection of civilians required the active involvement of the Red Cross, protection against nation-state cyberattacks requires the active assistance of technology companies. The tech sector plays a unique role as the internet’s first responders, and we therefore should commit ourselves to collective action that will make the internet a safer place, affirming a role as a neutral Digital Switzerland that assists customers everywhere and retains the world’s trust ..."--Brad Smith, Microsoft President and Chief Legal Officer, blogs.microsoft.com. See also Bruce Schneier: It's time for internet-of-things regulation | searchsecurity.techtarget.com.

10.  Names, Domains, Trademarks: President Trump wins trademark rights for his name in China | worldipreview.com.

11.  Outlook email for your domain name:
  • Hands-On with Outlook.com Premium | Thurrott.com"if you sign up now, “your subscriptions will auto-renew annually at $19.95 (Outlook.com Premium) .... This is an affordable option*, and it’s a nice way for a family to get a custom domain and not be stuck with an outlook.com or hotmail.com address."
  • More info:  https://premium.outlook.com/#/Offer  "you can create personalized addresses for up to 5 people and sync everything to your existing Outlook.com mailbox."
  • See also: "the $20 offer is still available, so if you’re looking to save some money, you might want to move quickly: This offer expires March 31, 2017. Note that you still need to pay for your custom domain. You can do that via an outside registrar or through Microsoft"--Thurrott.com

12. Announcing the first SHA1 collision | security.googleblog.com"For the tech community, our findings emphasize the necessity of sunsetting SHA-1 usage. Google has advocated the deprecation of SHA-1 for many years, particularly when it comes to signing TLS certificates."

13. Hacked ICANN data still sells for hundreds of dollars years after breach | cyberscoop.com: "Three years after hackers used a spearphishing attack to successfully gain access to internal data at the Internet Corporation for Assigned Names and Numbers (ICANN), the data is still being passed around and sold on black markets for $300, complete with claims that it’s never been leaked before."

14. ICANN events May 9-15 in Madrid: 1) ICANN GDD Industry Summit May 9-11, 2017; 2) 6th Registration Operations Workshop May 12, 2017; 3) ICANN DNS Symposium May 13, 2017; 4) OARC 26 May 14-15, 2017. Read more at InternetSociety.org.

15. ICANN Public Comment Periods that close in March, 2017:

16.  Most popular posts (# of pageviews Sun-Sat) this past week on DomainMondo.com:
  1. News Review: China Cyber Sovereignty vs ICANN Multistakeholderism
  2. Three Business Lessons You Can Learn From Airbnb (video)
  3. Splunk $SPLK Helping Companies Make Sense of Machine Data (video)
  4. TechReview | Zuck's Facebook Letter and the Snapchat $SNAP IPO (video)

-- John Poole, Editor, Domain Mondo 

feedback & comments via twitter @DomainMondo


DISCLAIMER

Domain Mondo archive