1 / 39

Rudi Vansnick – ISOC Belgium/EURALO Garth Bruen – Knujon.com / NARALO

Registries, Registrars and abuse of domains. Rudi Vansnick – ISOC Belgium/EURALO Garth Bruen – Knujon.com / NARALO. Program. Introduction Role of Registries and Registrars Some abuses in .be Abuse of domains: samples Some practical cases Mission and Goals Questions and Answers. ICANN.

raziya
Download Presentation

Rudi Vansnick – ISOC Belgium/EURALO Garth Bruen – Knujon.com / NARALO

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Registries, Registrars and abuse of domains Rudi Vansnick – ISOC Belgium/EURALO Garth Bruen – Knujon.com / NARALO

  2. Program • Introduction • Role of Registries and Registrars • Some abuses in .be • Abuse of domains: samples • Some practical cases • Mission and Goals • Questions and Answers

  3. ICANN Internet Corporation for Assigned Names and Numbers Registries ccTLD's gTLD's Acc. Registrars Agents Registrant / licensee Role of Registries & Registrars

  4. Some abuses in .be

  5. Some abuses in .be

  6. Some abuses in .be

  7. Some abuses in .be

  8. Some abuses in .be

  9. Some abuses in .be

  10. Registrars: Basic Issues and Concerns • Lack of transparency and accountability • Reseller abuse • Typo squat as selling point? • Lack of registrant verification • Arbitrary policy enforcement • Flouting the local law • Blocking access to Whois • Failure to comply with current RAA • False Suspensions • ccTLD abuse • Bulk Registrations with bad data • Gateway for spam and abuse

  11. Registrars as Gatekeepers

  12. Registrars as Gatekeepers • WHOIS forgery has created a massive new class of completely unknown persons engaged in illicit traffic • If Registrars are network administrators they have failed massively to validate who accesses the network • We need metrics and follow-up appeal • Are drug traffickers, counterfeiters, software pirates, and money launders the Registrar’s biggest customers?

  13. E-Crime Infrastructure (as it concerns Registrars)

  14. Unknown Influence Often Illicit Drug Traffic

  15. What else? – All Profit-Driven • Money laundering • Software Piracy • Counterfeit Consumer Goods • Domain Inflation • Phishing/Intrusions • Employment Scams • Prostitution

  16. Illicit E-Pharma Manifesto • Recently obtained and translated “how to” guide for rogue pharmacies • Casually references ease of bulk Registering • Directs associates to ICANN website • States some Registrars more cooperative than others

  17. Obfuscated Registrars • Mail drop addresses and “brass plate” business registrations • Dozens of Registrars not disclosing real address or even country of location • OnlineNIC is current concern • Missing language from RAA

  18. Where do domain-related fraud profits go? • Consumers in wealthier countries purchase illicit products online • Money often goes to unsavory characters in poorer countries • Poisonous, substandard and fake products are shipped to consumers, injury occurs • General citizens in poorer countries do not benefit

  19. WHOIS Fraud and Illicit Domains • Forged WHOIS Records: ASDF • Blank WHOIS Records • Non-Existent WHOIS Records • False suspension reports • Registrars can and should prevent • Security community will help • We have solutions that will not disrupt or burden Registrars or ICANN

  20. ASDF • ASDF is the first four characters on the second row a standard QWERTY keyboard • Thousands of illicit web pharmacies are registered with this obviously bogus information • Many more examples are subtle but just as preventable at the point of registration

  21. Blank WHOIS Records and Illicit Domains • WHOIS DATA AS OF 2008/08/01 01:15:01 REGISTRAR WHOIS: REGISTRY WHOIS: Whois Server Version 2.0 Domain Name: GEHRUEELS.COM • Registrar: XIN NET TECHNOLOGY CORPORATION Whois Server: whois.paycenter.com.cn Referral URL: http://www.xinnet.com Name Server: NS1.VOBIUTE.COM Name Server: NS2.VOBIUTE.COM Status: ok Updated Date: 18-feb-2008 Creation Date: 18-feb-2008 Expiration Date: 18-feb-2009

  22. Non-existent WHOIS Records and Illicit Domains Spammed domain with no WHOIS record redirects to unlicensed pharmacy

  23. False suspension reports Domain Name: AMERICANPERFECTMEDS.COMRegistrant: Directi False Whois Suspended Account Directi False Whois Suspended Account (inaccuratewhois@suspended-domain.com) This Domain is Suspended Due to inaccurate Whois Contact Support Desk null,0000 US Tel. +00.0000 *Directi has corrected – cited reseller abuse

  24. Some Practical Cases • Register.com • Xin Net • OnlineNIC • ParavaNet • eNom

  25. Register.com • 8771 Junk Domains Touting Phantom Cash Offers • 144 Fake Companies Registering Domains • 46,183 Spam emails to consumers

  26. Xin Net • 34,284 Illicit Domains with false Whois records • 1,763,014 Recorded spam messages • Reported invalid domains still up • Mostly rogue pharmacies

  27. eNom • Domain Inflation • Spammed domains are for sale • Traffic in names artificially raises bidding prices

  28. OnlineNic: Where are you? • Assumed to be in China, professes to be in United States • Fake Pharmacies • Software Piracy • General dishonesty and obfuscation hurts accountability and transparency

  29. ParavaNet: Where are you? From this morning: Registrant: Parava Networks Networks Parava info2@parava.net5444 Westheimer Rd. Ste 1585 Houston 77056 US Domain Name: parava.net From July, 2008: *Issued Breach Notice on Friday

  30. Mission and Goals • Fix the Policy Loopholes (RAA) • Support the Policy • Enforce the Policy • Upgrade of WDPRS • We propose building mechanisms to solve these problems… • Other “good” stuff

  31. Our Job as Policy Developers • The consequences of not implementing good policy are permissive; the consequences of implementing bad policy are destructive.

  32. Make Internet Abuse Policy Enforcement User Friendly • End users do not know where to start when abused • “Headers”, “IP,” “ASN”, etc. are foreign words ordinary users • Adopt simple methods for handling unwanted traffic • Create provider standards and guidelines

  33. Help Consumers Navigate Bureaucracy • Consumer inclusion in policy is controversial • Instead, build avenues to express grievances that generate trust

  34. Data not junk

  35. “good” stuff • Breach notices work: Joker and Beijing Net have made considerable improvements • Enforcement has impact: EstDomains closure has had domino-effect on cybercrime • Small loopholes = big problems – but fixing small holes has fantastic results! Strengthening RAA will solve large portions of the problem

  36. Purpose of Internet? • Communication and Trade? • Not created so registrants could talk to each other • Not a “closed” circuit for industry-only • It’s open so consumers can participate and industry can profit – neither exists without the other • Adding consumer advocacy layer does not threaten current model • Future Internet could include every consumer as a “registrant”

  37. Upgrade of WDPRS • WHOIS Data Problem Report System • Critical tool for addressing fraud and abuse • Created in 2002 but not upgraded since! • Rapid expansion of the Internet needs expanded enforcement resources • New WDPRS will help, but more tools needed…

  38. Why ICANN Should “Address” Spam • ICANN clearly is not responsible for spam • Should not be a “front-end” abuse handler – not practical from functional standpoint • Determining what spam is is difficult – “I know it when I see it” • However, ICANN should develop an overall policy to aggressively address conditions that enable spam from within the mandate.

  39. Questions and Answers • This is your time…

More Related