« New TLDs are coming #Dangerclose. | Main | Malware Landscape 2022: unabated malware growth, continued exploitation of IoT devices »

Monday, 14 March 2022

A 5-minute stakeholder intervention before the EU HLIG on #DNSabuse

I was invited to participate in an 11 March 2022 meeting of the EU High Level Internet Governance expert group to discuss domain name abuse. Following a presentation of a Study on Domain Name System (DNS) Abuse commissioned by the European Commission, I gave a 5-minute intervention. This EC study is comprehensive and well worth reading. My Interisle colleagues are proud to have our Phishing Landscape 2021 Study and other related studies mentioned in the EC study. 

The transcript follows. 

Interisle intervention to EC HLIG on DNS Abuse

Opening Remarks

Thank you for the opportunity to address you today.

My name is David Piscitello. I am a partner and researcher at Interisle Consulting Group.

Interisle studies domain name abuse; more precisely, we study how criminal uses domain names and Internet addresses in cyberattacks and cybercrimes. We work to identify where criminals obtain the resources that they need to conduct attacks or perpetrate crimes and to identify and observe where criminal activity is occurring on the Internet.

Specifically, we provide measurements of abuse at TLD, registrar and hosting networks in annual studies and quarterly reports at the Cybercrime Information Center.

Since May 2020, we have collected over 12 million phishing and malware reports. These allow us to perform historical or longitudinal analyses which can identify systemic abuses of the DNS. The Study on Domain Name System (DNS) Abuse commissioned by the European Commission cites several of our measurements and findings from our Phishing Landscape 2021 Study. Our methodologies are similar to those used by our fellow European researchers who contributed to that study. Our data corroborate the Study’s finding that criminals acquire domain names with the specific purpose of perpetrating an abuse or cybercrime.

We also find that criminals acquire large numbers of domains to construct criminal infrastructures that they use or lease to others to launch cyberattacks or to host harmful content such as malware or phishing web pages.

Particularly in the generic Top level domain name space, we observe that criminals exploit or benefit from characteristics of domain registration services.

Focus on domain registration

The EC’s DNS Abuse study is comprehensive, so I will summarize the domain name registration services “problem space”.

Registration contact data is critically important to investigators when they are attempting to identify criminal actors, but also because it can be used to identify all the domain names that a criminal uses for a given attack.

Today, much of the contact data that can be used to identify perpetrators of abuse or crimes is unavailable. Our January 2021 study (Whois Contact Data Availability) revealed that

  • Registration contact data is redacted for 57% of all generic Top-level Domain (gTLD) names,

and that

  • Only around 11.5% of domains may belong to natural persons who are subject to GDPR.

Including ‘proxy-protected’ domains, for which the identity of the domain owner is deliberately concealed,

  • 85% of gTLD domain registrants can no longer be identified.

Since the data are redacted, we cannot determine whether the data are accurate.

Access to redacted contact data for lawful purposes, in the timely and uniform manner that would help mitigate abuse, is essentially non-existent and this situation worsens every day.

The inability to reconcile these issues to the satisfaction of legislators, ICANN policy makers, and the public sector-private sector actors who need registration data greatly impairs efforts to mitigate DNS abuse or crime.

Weaponizing Domains

To close, I want to call attention to features of domain registration services that allow rapid registrations of domain names in large numbers.Cybercriminals take advantage of bulk registration services to weaponize large numbers of domain names.We use the term “weaponize” to refer to an act of adapting something nominally benign to serve as a tool in the pursuit of some malignant (criminal) activity.

  • When terrorists misuse fertilizers to construct improvised explosive devices, they are “weaponizing” ammonium nitrate.
  • When criminals divert pseudoephedrine to the manufacture of methamphetamine, they inflict harm or loss of life by weaponizing a medication intended to relieve suffering.

I ask you to consider,

  • When cybercriminals acquire and employ thousands of internet domain names to conduct cybercrimes, they are misusing domain names to cause financial loss or harm. In the extreme cases of ransomware attacks against healthcare or emergency systems or critical infrastructures, the potential harms include loss of life

The EC may wish to consider whether measures similar to those employed to control other “weaponizable” commodities are necessary and appropriate. Our October 2019 study on criminal abuse of domain registration services suggests measures that might be adopted. The study is available at Interisle.net.

On behalf of my colleagues at Interisle I want to again thank you for the opportunity to speak to the EU High Level Internet Governance Expert Group on the subject of DNS Abuse.We hope that we can assist you in further deliberations.

Posted at 09:22 AM in Domain names and DNS |

Comments

Feed You can follow this conversation by subscribing to the comment feed for this post.

The comments to this entry are closed.

Find me on Mastodon and Facebook

Spotlight Posts

  • FTC's proposed Trade Regulation Rule on Impersonation of Government and Businesses is important for #infosec
    M3AAWG comments on the FTC's proposed rule Trade Regulation Rule on Impersonation of Government and Businesses is available. I was one of the contributors to the comment. In the comment, M3AAWG "suggests additional regulatory solutions and best practices to complement the goals of this rule, such as clarifying the scope of the rule to include the use of domain names in impersonation schemes and the use of technologies that enable impersonation" and the important role that Whois plays in investigating impersonation and fraud. Several reports that my Interisle colleagues and I published are cited in the comment, along with the...
  • Cybercrime Information Center reports sharp increases in phishing attacks, unique domains reported in August-October 2022 time period
    A recent ebb in domain names reported for phishing created some euphoria in the domain industry. With phishing activity, as with tides, ebbs are invariably followed by flows. In their August- October 2022 Quarterly Phishing Activity, the Cybercrime Information Center observed a 40% increase in phishing attacks and a nearly 20% increase in unique domain names reported for phishing.
  • Cybercrime Information Center's YouTube Channel
    My colleagues and I at Interisle have created a YouTube channel to complement the quarterly reporting and studies of cybercrime we host at the Cybercrime Information Center. Our goal is to share, in a few minutes, the findings and insights from our research in a format that's easily accessible and shareable, informative, and entertaining. The inaugural videos provide 2-5 minute summaries of our annual Phishing and Malware Landscape studies. We'll continue to produce videos of our annual studies. If you like what you see, leave us a comment.
  • Malware Landscape 2022: unabated malware growth, continued exploitation of IoT devices
    My colleagues at Interisle and I have published a study, Malware Landscape 2022: A Study of the Scope and Distribution of Malware. The study, which analyzed 2.5 million records of distinct malware events from May 2021 to April 2022 collected by the Cybercrime Information Center, explains what malware was most prevalent, where malware was served from, and what resources criminals used to pursue their attacks.
  • New TLDs are coming #Dangerclose.
    A Domain Name Wire post, Time to pay attention to the next round of new TLDs, begins with an ominous: They’re coming. Eventually. While not as dramatic or enduring as Arnold Schwarzenegger's "I'll be back", the reporter cites policy activity at ICANN as evidence that new TLDs are coming. Eventually. In a September 2019 post, and in response to the ICANN memorandum, Readiness to Support Future Rounds of New gTLDs, I asked, Has enough been done to study and rectify the concentration of security threats in the new TLD space? In that post, I quoted correspondence from ICANN's security advisory...

Search

My Photo

Categories