The Security Skeptic

China Hijack, yet another CNN-jack, or simply a FOX-pas?

Those of you awash in the flood of unfiltered, uncorroborated news describing how a Chinese ISP hijacked 15% of the Internet may want to read Craig Labovitz's stellar article on the incident. For those of you with children in the room, let me warn you in advance: Craig's article is awash with facts, statistical evidence, and constructive insight.  

Here are some teaser facts and insights from Craig's article. First, the facts:

"On April 8th a Chinese Internet provider announced 40,000 routes belonging to other ISPs / enterprises around the world."

"ATLAS data from 80 carriers around the world graphed below shows little statistically significant increase [in traffic forwarded to the Chinese ISP] due to the hijack on April 8, 2010."

Based on observed traffic, the diverted traffic "never topped a handful of Gbps. And in an Internet quickly approaching 80-100Tbps, 1-3 Gbps of traffic is far from 15% (it is much closer to 0.015%)."

[Note: ATLAS is reputed to be the world's largest distributed darknet sensor network. In common language, it's a gigantic monitoring system that collects and analyzes Internet traffic from collection points all over the globe.]

Now the insights:

"in an industry crowded with security marketing and hype, it is important we limit the hyperbole and keep the discussion focused around the legitimate long-term infrastructure security threats and focused on technical realities."

"We need to fix Internet infrastructure security, but we also need to be precise in our analysis of the problems."

Please take time to click through and read the full article. Well done, Craig!

How to protect your domain registration accounts

ICANN's Security and Stability Advisory Committee has published a Registrant's Guide to Protecting Domain Name Registration Accounts against compromise and misuse.

The report begins by describing a threat landscape for domain names. It explains why attackers are motivated to gain access to accounts that registrars provide for managing domain names and DNS configurations of these domains. It continues to explain how attackers use compromised accounts to facilitate other ecrimes (phishing, spam, hosting of illegal goods, and more). 

The report next encourages readers to ask, How important are our domain names, what do we risk if we lose them, or what loss or harm will our organization suffer if they are misused? This is Risk Asssessment 101. The report offers sets of measures that organizations can adopt to mitigate risks and explains how these measures can be implemented “in house” or outsourced to contracted third parties.

The report concludes with lists of questions that organizations should ask registrars and registries concerning their registration processes and protection mechanisms. This may be the most important part of the report. Organizations can use the list to obtain information about registrar processes that will enable organizations to make informed decisions when choosing a registrar(s).

SSAC  indicates that the report "specifically targets individuals or organizations that recognize that the operational value of a domain name in use is extremely or critically important." Frankly, any individual or organization who relies on web or other Internet presence will find something useful from the report despite it's densely ICANN-ese presentation.   

For example, the report discusses how to

• protect domain name account credentials. Many of the recommended practices - password composition, protection, retention, and recovery - are measures that organizations apply as best practices elsewhere (such as corporate Wikis) but tend to overlook with a registrar account.
• integrate routine correspondence from registrars into a workflow that can eliminate human error that could result in the loss (expiration) of a critical domain name.
• organization can apply "intrusion detection" techniques by monitoring the WHOIS records and DNS configurations for their domain names.
• maintain accurate and sufficient information to recover a hijacked domain or lost/compromised DNS zone data in an emergency situation.

This report doesn't recommend policy change (although it's pretty clear from the report where policy change might best be applied). The report assesses the domain account threat landscape and the mitigations available from third parties and takes a pragmatic approach: if you want better protection, you need to manage the risk as you would for any other asset you hold, and here's how to do it.