Latest news of the domain name industry

Recent Posts

ICANN vows to fight TAS bug “monkey business”

Kevin Murphy, April 20, 2012, 09:37:17 (UTC), Domain Policy

ICANN chief security officer Jeff Moss has pledged to fully disclose what new gTLD application data was leaked to which users via the TLD Application System security bug.
Talking to ICANN media chief Brad White in a video interview, Moss said:

We’re putting everyone on notice: we know what file names and user names were displayed to what people who were logged in and when. We want to do this very publicly because we want to prevent any monkey business. We are able to reconstruct what file names and user names were displayed.

ICANN has been going through its logs and will know “very specifically” what data was visible to which TAS users, he said.
The bug, he confirmed, was related to file deletions:

Under certain circumstances that were hard to replicate users that had previously deleted files could end up seeing file names of users that had uploaded a file… Certain data was being revealed to users that were not seeking data, it was just showing up on their screen.

The actual contents of the files uploaded to TAS were not visible to unauthorized users, he confirmed. There are also no reasons to believe any outside attacks occurred, he said.
He refused to reveal how many applicants were affected by the vulnerability, saying that ICANN has to first double-check its data in order to verify the full extent of the problem.
The interview reveals that the bug could manifest itself in a number of different ways. Moss said:

The problem has several ways it can express itself… we would solve it one way and it would appear another way, we would solve it another way and it would appear a third way. At some point we were just uncomfortable that we understood the core issue and that’s when we took the system offline.

TAS was taken down April 12, just 12 hours before the new gTLD application window closed.
ICANN has been providing daily updates ever since, and has promised to reveal tonight when TAS will reopen for business, for how long, and whether April 30 Big Reveal day has been postponed.
Applicants first reported the bug March 19, but ICANN did not realize the extent of the problem until later, Moss said.

In hindsight now we realized the 19th was the first expression of this problem, but at the time the information displayed made no sense to the applicant, it was just random numbers… at that point there were no dots to connect.

Here’s the video:

Tagged: , , , ,

Comments (12)

  1. KD says:
    April 20, 2012 at 10:36 am

    To be honest I hate what ICANN is doing with the gTLD expansion. ICANN is requiring companies prove their technical abilities, but ICANN itself would not be able to pass the most basic questions on the GTLD application itself!
    However I have to give Jeff Moss serious credit for putting his face on this. And he is a very calm and collected guy. ICANN should use him going forward for more publicity events. Though I would NEVER want to be in his position!
    It is unfortunate that ICANN is making so much money, and screwing the world in the process. They wont comment on why they are going against Congress, the Senate, NTIA and so many other organizations. Which begs to question if this is in the world’s benefit or just ICANN’s benefit. And that is where I feel really bad for Jeff Moss, he is just becoming a pawn in the GTLD expansion. And who knows, maybe he is like others before him and he is personally invested in the gTLD expansion?
    Either way, I really feel he did a great job in this interview. But I fear he is becoming an ICANN pawn that is there only to give credence to a process nobody wants except ICANN……. Only time will tell.

    Reply
  2. Avri Doria says:
    April 20, 2012 at 11:23 am

    I appreciate the explanations concerning the type and extent of the bug and look forward to hearing more as more is understood. I also very much respect Jeff Moss’ approach.
    While this is not a stream for comment on the new gTLD program, I do want to mention that many people in communities around the world and especially in language communities other than the English language appreciate the opportunities afforded by the new gTLD program and are eager to see it move forward once the bug has been eradicated.

    Reply
  3. Andrew says:
    April 20, 2012 at 2:01 pm

    I don’t get it. Some applicants were inadvertently exposed to other applicant’s filenames, and now it sounds like they’re blaming those applicants for seeing the data? Maybe I’m misreading your article, but this seems to suggest people did something wrong by viewing this data:
    “We’re putting everyone on notice: we know what file names and user names were displayed to what people who were logged in and when. We want to do this very publicly because we want to prevent any monkey business.”

    Reply
    • Kevin Murphy says:
      April 20, 2012 at 2:13 pm

      I think the point he was trying to make is that it’s better if the data is disclosed than kept secret.
      Just because a filename flashed up on somebody’s screen, doesn’t necessarily mean that person saw it or paid it any attention.
      As I mentioned a few days ago, I’ll bet some applicants will be surprised to find out they were exposed to the bug.

      Reply
  4. John Berryhill says:
    April 20, 2012 at 2:39 pm

    “Maybe I’m misreading your article, but this seems to suggest people did something wrong by viewing this data”
    IMHO, the hazard would be that someone made a change to their intended string(s) on the basis of that knowledge (assuming they even knew what they were looking at, and would be inclined to change their plans on a spur of the moment basis). This would seem to be an extremely low likelihood thing to have happened, but the takeaway from the comment appears to be that the “prevent monkey business” phrase simply means that knowing who was able to see what and when, would render behavior consistent with that “string change” scenario to be apparent.
    He’s not suggesting that anyone did engage in “monkey business” by either intentionally generating the error condition or acting on it. But for everyone’s piece of mind, once the apps are revealed and contending strings are on the table, the data that they are gathering now will be useful to allay any suspicions that the bug had been exploited in any way.

    Reply
  5. KD says:
    April 20, 2012 at 3:21 pm

    @Avri Doria
    When I read your “pro gTLD” response it seemed clear to me you were somehow a beneficiary to the gTLD expansion. A quick Google search shows you will be a beneficiary.
    But let’s not argue on this point. We will wait a few weeks until the extensions are revealed. Most will be for .brands. And contrary to your comments, only very few will be for extensions in other languages other than English. (maybe only 1% or so!)

    Reply
    • Avri Doria says:
      April 20, 2012 at 3:59 pm

      Indeed. In fact I think we will all be beneficiaries of a thousand flowers blooming. Just as I expect many will continue to benefit from being anti-gTLD. I would have looked up your info, but there are far too many KDs for me to sort through.
      cheers
      ps. i know better than to respond to messages like this. All I can say is the devil made me do it. I will improve, I promise.

      Reply
  6. Tom G says:
    April 20, 2012 at 3:29 pm

    This is my question:
    With 12 hours left in the window, why not complete the cycle – THEN analyze the logs, compile the data, understand who saw the files and when, how that information may have been used.
    Now, anyone who may have seen sensitive information has had plenty of time to devise a way to exploit it. For example, put together a competitive application and contrive a plausible defense of that application and the sensitive information they may have seen.
    Unless maybe there was some other motive to close and re-open, effectively extending the window for application preparation.

    Reply
  7. Tom G says:
    April 20, 2012 at 3:30 pm

    I mean, they knew about a potential problem for weeks, why close the window with just 12 hours left?

    Reply
  8. Chris LaHatte says:
    April 20, 2012 at 10:05 pm

    And if anyone thinks they have been treated unfairly in this process, they know where to go-http://www.icann.org/en/help/ombudsman

    Reply
  9. Tom G says:
    April 21, 2012 at 1:24 am

    Probably just realized with 12 hours left and the load on the system there was no way applicants would be able to complete.

    Reply

Add Your Comment