« Economic impact payments (EIP) Phishing: US citizens under attack from US bases of phishing operations | Main | A 5-minute stakeholder intervention before the EU HLIG on #DNSabuse »

Tuesday, 01 March 2022

New TLDs are coming #Dangerclose.

3117174819_9074b9ae10_wA Domain Name Wire post, Time to pay attention to the next round of new TLDs, begins with an ominous:

They’re coming. Eventually.

While not as dramatic or enduring as Arnold Schwarzenegger's "I'll be back", the reporter cites policy activity at ICANN as evidence that new TLDs are coming. Eventually.

In a September 2019 post, and in response to the ICANN memorandum, Readiness to Support Future Rounds of New gTLDs, I asked,

Has enough been done to study and rectify the concentration of security threats in the new TLD space?

In that post, I quoted correspondence from ICANN's security advisory committee (SSAC) to ICANN's Senior Vice President of Global Domains Division. In its communique, SSAC expressed concern that "the last round of new gTLDs appears to have introduced the phenomenon of TLDs with exceptionally high rates of abusive registrations."

SSAC's concerns were well founded. ICANN's January 2019 monthly DAAR report noted that 48% of the domains identified as security threats were registered in the legacy TLDs. The legacy TLDs represent 88% of the the domain names resolving in the DNS at the time of the report. ICANN also reported that 51  percent of the domains identified as security threats were in new gTLDs, noting that the new gTLDs represented 11% of resolving domains. In simple speak, domains registered in the legacy TLDs far outnumbered domains registered in the new TLDs (an 8:1 ratio), yet there were more domains associated with security threats in the new TLDs than in the legacy TLDs.

The Cybercrime Information Center has reported phishing activity in the gTLD space since May 2020. As the trendline in the image indicates, the number of domains reported for phishing continues to grow..

The yearly measurements reported in Interisle's Phishing Landscape 2021 are even more troubling. The new TLDs' share of phishing domains reported was 3.5 times the new TLDs’ market share of 6%.

In February, 2021,  in Comments on the GNSO New gTLD Subsequent Procedures Draft Final Report, SSAC was again expressed concern: "Given the serious problems that some new gTLDs had with DNS abuse, it is clear that these issues need to be understood and mitigated prior to the launch of any new gTLDs under a new policy regime."

DNS abuse - or more correctly, cybercrimes that employ domain names - has flourished in the new TLD era. ICANN has done little to address this problem. ICANN policy development to mitigate DNS abuse is stuck in a definitional infinite loop. Registration data is redacted and access is rate limited. Domain names are weaponized in volume.

Since 2012, ICANN has not adopted meaningful policies, service level agreements, or contractual compliance tools to mitigate DNS abuse. ICANN's security, government, and at large advisory committees have made numerous recommendations to the Board and organization but the policy process is controlled by the service organizations, who benefit most from expanding the top level of the domain name space. 

Dangerclose

The military uses the phrase danger close when friendly forces are in extreme proximity of a target; simply put, friendly forces are at great risk of harm when the artillery, air, or naval gunfire support begins.

Guess who the friendly forces are?

Sarah Connor image by Helgi Halldórsson, Terminator image John Lawlor

Posted at 09:47 AM in Anti-Malware and Anti-phishing, Domain names and DNS |

Comments

Feed You can follow this conversation by subscribing to the comment feed for this post.

The comments to this entry are closed.

Find me on Mastodon and Facebook

Spotlight Posts

  • Interisle's Phishing Landscape 2024 is here
    Our Interisle team today announced the publication of an industry report, Phishing Landscape 2024, A Study of the Scope and Distribution of Phishing. Interisle’s fourth annual study examines nearly four million phishing reports collected from May 2023 to April 2024 and provides historical measurements using over 15 million phishing reports collected at the Cybercrime Information Center over a four year period. Findings from the study: • The total number of phishing attacks grew to ~1.9 million incidents worldwide. • Phishing attacks hosted at subdomain providers increased by 450,000+ reported names, representing 24% of all phishing attacks. • The use of...
  • Malware Trends, January - March, 2024 posted at the Cybercrime Information Center
    2024 began with a rise in domain names reported for hosting malware unlike any we have seen since we began measuring malware attacks in 2021. The 1Q2024 Top 20 TLDs included 10 new gTLDs, 6 ccTLDs, and 4 legacy gTLDs. Only three TLDs remained in the top 5 TLDs (COM, NET, INFO) from the prior quarter. The ORG and BR TLDs were replaced by SHOP (over 3,000% increase) and TOP (over 700% increase). All but one registrar in 1Q2024’s Top 20 registrar ranking showed increases of 100% or more. Several registrars had 4- and 5-figure percentage increases in domains reported....
  • Malware Trends, January - March, 2024 posted at the Cybercrime Information Center
    2024 began with a rise in domain names reported for hosting malware unlike any we have seen since we began measuring malware attacks in 2021. The 1Q2024 Top 20 TLDs included 10 new gTLDs, 6 ccTLDs, and 4 legacy gTLDs. Only three TLDs remained in the top 5 TLDs (COM, NET, INFO) from the prior quarter. The ORG and BR TLDs were replaced by SHOP (over 3,000% increase) and TOP (over 700% increase). All but one registrar in 1Q2024’s Top 20 registrar ranking showed increases of 100% or more. Several registrars had 4- and 5-figure percentage increases in domains reported....
  • Spotlight: Impersonation phishing using exact match hostnames
    Phishers have long embedded exact matches of brands in domain names that they register for phishing. Company, service, or product names in domains continue to deceive less technically savvy members of society. Phishers are increasingly using exact match strings to compose hostnames at free web sites for phishing. My Interisle colleagues and I looked at the web site domains and subdomains used in phishing attacks from November 2023 through January 2024. During that period, impersonation attacks against two brands stood out: United States Postal Service (USPS) and Facebook. Looking closely at these two brands, we are able to illustrate how...
  • Cybercrime supply chain interviews with Spamhaus Team
    The Spamhaus team recently interviewed me to learn more about Interisle's recent study, Cybercrime Supply Chain 2023, where we examine the supply chains used by cybercriminals to acquire resources for malware, spam, and phishing attacks. In Trends, policy and cheap TLDs - an interview with Dave Piscitello (Part 1), we dive into some of the study's key findings: Nearly 5 million domain names identified as resources for cybercrime. Over 1 million new gTLD domain names reported for spam activity. Over 500,000 subdomain hostnames reported as cybercrime resources at 229 subdomain resellers. The United States, China, India, Australia, and Hong Kong...

Search

My Photo

Categories