« APWG Monograph: ICANN interpretation of GDPR impedes cyberinvestigations | Main | How to protect your small business from cyber attacks »

Tuesday, 13 August 2019

Unspecific CZDS contract language makes zone data access approvals a dice roll

After reading yet another round of complaints regarding the approvals process for ICANN's Centralized Zone Data Service (CZDS), I set up an experiment. I applied for all Top-level domains (TLDs) available from the CZDS on May 28 2019 to observe how promptly registries respond to requests. I applied as an "Individual" by checking this choice in the profile. For reason, I stated my purpose, "I investigate phishing and fraud web sites. Zone data are needed to identify newly resolving domain names that may be used in these attacks."

Approval response times are all over the map

The chart below illustrates the arrival dates of the 1117 approval emails received from May 28, 2019 through August 13, 2019 (note: I use logarithmic scale for readability). 
 
Screenshot (143)
Seventy one  percent (71%) of TLDs respond within 2-3 business days. Kudos to these operators who have automated or streamlined this process. 

There are still registry operators who have not processed CZDS applications after fifty-five business days, an ample opportunity to process a request for which there are few causes for denial except for incomplete applicant data:

TLDs with Applications Pending since May 28, 2019 
aigo citadel hoteles luxury stada
airtel cyou ice madrid voting
alstom dealer ifm man vuelos
amica discover inc mango wed
apple duns intel mint weibo
beats eus intuit mobily williamhill
bharti firmdale ipiranga mtn wme
bnpparibas flir ist passagens xn--5tzm5g (网站)
bradesco gal istanbul quebec xn--80asehdb (онлайн)
build gdn lacaixa redstone xn--80aswg (сайт)
bzh gop liaison seat xn--9krt00a (微博)
canon hdfcbank lpl shaw xn--kput3i (手机)
cbn helsinki lplfinancial sina xn--mgbab2bd (بازار)
        xn--mgbb9fbpob (موبايلي)

I was denied access by

  • deloitte, moscow, xn--80adxhks (москва) denied access claiming invalid organization field. This could be a CZDS error, because I identified myself as "individual". 
  • emi, scot denied access for "invalid reason or details". I'm confounded by this response. If my email was invalid, how did I get a response? Or more troubling... why is investigating fraud or phishing not a valid reason? 
  • tatar - incomplete user information. To the best of my knowledge, my information is correct, and satisfied 1117 other operators.

Why is this even hard?

My not-an-attorney experience whenever a contract is involved inclines me to believe that unspecific or absent language is a likely suspect. There is no service level agreement for CZDS responses. Many operators are diligent and work within the spirit of the contract. Others perhaps have a variety of reasons why CZDS is unimportant or a low priority.  

ICANN should be able to fix this. Zone data isn't proprietary or secret. If over 70% of the operators have resolved the matter through apparent automation, surely these operators or ICANN organization can encourage the remaining 30% to automate as well.  

More to come

Studying renewal behavior would also be valuable. I recently saw a post on an opsec mail list where 100+ renewals were delayed by weeks or months. Since delays of renewals create gaps for automation that collects zones for both daily and historical (security) analysis, renewal behavior is perhaps a more pressing concern. In a future post, I will be sharing the renewal "experience" from my experiment with you.

Posted at 01:23 PM in Domain names and DNS |

Comments

Feed You can follow this conversation by subscribing to the comment feed for this post.

The comments to this entry are closed.

Find me on Mastodon and Facebook

Spotlight Posts

  • Interisle's Phishing Landscape 2024 is here
    Our Interisle team today announced the publication of an industry report, Phishing Landscape 2024, A Study of the Scope and Distribution of Phishing. Interisle’s fourth annual study examines nearly four million phishing reports collected from May 2023 to April 2024 and provides historical measurements using over 15 million phishing reports collected at the Cybercrime Information Center over a four year period. Findings from the study: • The total number of phishing attacks grew to ~1.9 million incidents worldwide. • Phishing attacks hosted at subdomain providers increased by 450,000+ reported names, representing 24% of all phishing attacks. • The use of...
  • Malware Trends, January - March, 2024 posted at the Cybercrime Information Center
    2024 began with a rise in domain names reported for hosting malware unlike any we have seen since we began measuring malware attacks in 2021. The 1Q2024 Top 20 TLDs included 10 new gTLDs, 6 ccTLDs, and 4 legacy gTLDs. Only three TLDs remained in the top 5 TLDs (COM, NET, INFO) from the prior quarter. The ORG and BR TLDs were replaced by SHOP (over 3,000% increase) and TOP (over 700% increase). All but one registrar in 1Q2024’s Top 20 registrar ranking showed increases of 100% or more. Several registrars had 4- and 5-figure percentage increases in domains reported....
  • Malware Trends, January - March, 2024 posted at the Cybercrime Information Center
    2024 began with a rise in domain names reported for hosting malware unlike any we have seen since we began measuring malware attacks in 2021. The 1Q2024 Top 20 TLDs included 10 new gTLDs, 6 ccTLDs, and 4 legacy gTLDs. Only three TLDs remained in the top 5 TLDs (COM, NET, INFO) from the prior quarter. The ORG and BR TLDs were replaced by SHOP (over 3,000% increase) and TOP (over 700% increase). All but one registrar in 1Q2024’s Top 20 registrar ranking showed increases of 100% or more. Several registrars had 4- and 5-figure percentage increases in domains reported....
  • Spotlight: Impersonation phishing using exact match hostnames
    Phishers have long embedded exact matches of brands in domain names that they register for phishing. Company, service, or product names in domains continue to deceive less technically savvy members of society. Phishers are increasingly using exact match strings to compose hostnames at free web sites for phishing. My Interisle colleagues and I looked at the web site domains and subdomains used in phishing attacks from November 2023 through January 2024. During that period, impersonation attacks against two brands stood out: United States Postal Service (USPS) and Facebook. Looking closely at these two brands, we are able to illustrate how...
  • Cybercrime supply chain interviews with Spamhaus Team
    The Spamhaus team recently interviewed me to learn more about Interisle's recent study, Cybercrime Supply Chain 2023, where we examine the supply chains used by cybercriminals to acquire resources for malware, spam, and phishing attacks. In Trends, policy and cheap TLDs - an interview with Dave Piscitello (Part 1), we dive into some of the study's key findings: Nearly 5 million domain names identified as resources for cybercrime. Over 1 million new gTLD domain names reported for spam activity. Over 500,000 subdomain hostnames reported as cybercrime resources at 229 subdomain resellers. The United States, China, India, Australia, and Hong Kong...

Search

My Photo

Categories