The Security Skeptic

A 5-minute stakeholder intervention before the EU HLIG on #DNSabuse

I was invited to participate in an 11 March 2022 meeting of the EU High Level Internet Governance expert group to discuss domain name abuse. Following a presentation of a Study on Domain Name System (DNS) Abuse commissioned by the European Commission, I gave a 5-minute intervention. This EC study is comprehensive and well worth reading. My Interisle colleagues are proud to have our Phishing Landscape 2021 Study and other related studies mentioned in the EC study. 

The transcript follows. 

Interisle intervention to EC HLIG on DNS Abuse

Opening Remarks	Thank you for the opportunity to address you today. My name is David Piscitello. I am a partner and researcher at Interisle Consulting Group. Interisle studies domain name abuse; more precisely, we study how criminal uses domain names and Internet addresses in cyberattacks and cybercrimes. We work to identify where criminals obtain the resources that they need to conduct attacks or perpetrate crimes and to identify and observe where criminal activity is occurring on the Internet. Specifically, we provide measurements of abuse at TLD, registrar and hosting networks in annual studies and quarterly reports at the Cybercrime Information Center. Since May 2020, we have collected over 12 million phishing and malware reports. These allow us to perform historical or longitudinal analyses which can identify systemic abuses of the DNS. The Study on Domain Name System (DNS) Abuse commissioned by the European Commission cites several of our measurements and findings from our Phishing Landscape 2021 Study. Our methodologies are similar to those used by our fellow European researchers who contributed to that study. Our data corroborate the Study’s finding that criminals acquire domain names with the specific purpose of perpetrating an abuse or cybercrime. We also find that criminals acquire large numbers of domains to construct criminal infrastructures that they use or lease to others to launch cyberattacks or to host harmful content such as malware or phishing web pages. Particularly in the generic Top level domain name space, we observe that criminals exploit or benefit from characteristics of domain registration services.
Focus on domain registration	The EC’s DNS Abuse study is comprehensive, so I will summarize the domain name registration services “problem space”. Registration contact data is critically important to investigators when they are attempting to identify criminal actors, but also because it can be used to identify all the domain names that a criminal uses for a given attack. Today, much of the contact data that can be used to identify perpetrators of abuse or crimes is unavailable. Our January 2021 study (Whois Contact Data Availability) revealed that Registration contact data is redacted for 57% of all generic Top-level Domain (gTLD) names, and that Only around 11.5% of domains may belong to natural persons who are subject to GDPR. Including ‘proxy-protected’ domains, for which the identity of the domain owner is deliberately concealed, 85% of gTLD domain registrants can no longer be identified. Since the data are redacted, we cannot determine whether the data are accurate. Access to redacted contact data for lawful purposes, in the timely and uniform manner that would help mitigate abuse, is essentially non-existent and this situation worsens every day. The inability to reconcile these issues to the satisfaction of legislators, ICANN policy makers, and the public sector-private sector actors who need registration data greatly impairs efforts to mitigate DNS abuse or crime.
Weaponizing Domains	To close, I want to call attention to features of domain registration services that allow rapid registrations of domain names in large numbers.Cybercriminals take advantage of bulk registration services to weaponize large numbers of domain names.We use the term “weaponize” to refer to an act of adapting something nominally benign to serve as a tool in the pursuit of some malignant (criminal) activity. When terrorists misuse fertilizers to construct improvised explosive devices, they are “weaponizing” ammonium nitrate. When criminals divert pseudoephedrine to the manufacture of methamphetamine, they inflict harm or loss of life by weaponizing a medication intended to relieve suffering. I ask you to consider, When cybercriminals acquire and employ thousands of internet domain names to conduct cybercrimes, they are misusing domain names to cause financial loss or harm. In the extreme cases of ransomware attacks against healthcare or emergency systems or critical infrastructures, the potential harms include loss of life The EC may wish to consider whether measures similar to those employed to control other “weaponizable” commodities are necessary and appropriate. Our October 2019 study on criminal abuse of domain registration services suggests measures that might be adopted. The study is available at Interisle.net. On behalf of my colleagues at Interisle I want to again thank you for the opportunity to speak to the EU High Level Internet Governance Expert Group on the subject of DNS Abuse.We hope that we can assist you in further deliberations.

Malware Trends, January - March, 2024 posted at the Cybercrime Information Center

2024 began with a rise in domain names reported for hosting malware unlike any we have seen since we began measuring malware attacks in 2021.


The 1Q2024 Top 20 TLDs included 10 new gTLDs, 6 ccTLDs, and 4 legacy gTLDs. Only three TLDs remained in the top 5 TLDs (COM, NET, INFO) from the prior quarter. The ORG and BR TLDs were replaced by SHOP (over 3,000% increase) and TOP (over 700% increase).

All but one registrar in 1Q2024’s Top 20 registrar ranking showed increases of 100% or more. Several registrars had 4- and 5-figure percentage increases in domains reported. These exceptionally high percentages are a result of these registrars having very few (no more than a couple hundred) malware domains reported in the Oct-Dec 2023 quarter but (tens of) thousands of malware domains in this quarter.

We have repeatedly observed similar swings in domains reported for phishing, but this is the first such for malware. Some (combination of) policy, practices, processes or pricing that contributes repeatedly to a pandemic phishing landscape may now be attracting malware actors. Read more...

 

Malware Trends, January - March, 2024 posted at the Cybercrime Information Center

2024 began with a rise in domain names reported for hosting malware unlike any we have seen since we began measuring malware attacks in 2021.


The 1Q2024 Top 20 TLDs included 10 new gTLDs, 6 ccTLDs, and 4 legacy gTLDs. Only three TLDs remained in the top 5 TLDs (COM, NET, INFO) from the prior quarter. The ORG and BR TLDs were replaced by SHOP (over 3,000% increase) and TOP (over 700% increase).

All but one registrar in 1Q2024’s Top 20 registrar ranking showed increases of 100% or more. Several registrars had 4- and 5-figure percentage increases in domains reported. These exceptionally high percentages are a result of these registrars having very few (no more than a couple hundred) malware domains reported in the Oct-Dec 2023 quarter but (tens of) thousands of malware domains in this quarter.

We have repeatedly observed similar swings in domains reported for phishing, but this is the first such for malware. Some (combination of) policy, practices, processes or pricing that contributes repeatedly to a pandemic phishing landscape may now be attracting malware actors. Read more...