Latest news of the domain name industry

Recent Posts

Four of the top 100 brands have insecure domain names

Kevin Murphy, May 26, 2010, Domain Tech

Some of the world’s most famous global brands have domain names that are still vulnerable to the Kaminsky exploit and could be hijacked by others.

Earlier today, I ran all of the brands on Deloitte’s list of the top 100 brands through a vulnerability testing tool provided by IANA.

The results show that four of these brands – all household names – have domains classed as “highly vulnerable” to the Kaminsky exploit.

If the IANA test is reliable, this means that false data could be injected into their name servers, potentially redirecting users to a web site belonging to the attacker.

Another eight brands had domains that the IANA tool reported might be “vulnerable” to attacks, but which had measures in place to mitigate the risk.

The Kaminsky bug has been public for almost two years. It’s a cache poisoning attack in which a recursive name server is tricked into providing false data about a domain.

It becomes particularly scary when a domain’s authoritative name servers also have their recursive functions turned on. A successful attack could redirect all traffic to a compromised domain to a server managed by the attacker.

The surest way to avoid vulnerability is to turn off recursion. IANA says: “Authoritative name servers should never be configured to provide recursive name service.”

Alternatively, a method known as source port randomization can make the risk of being compromised by the Kaminsky exploit so small it’s barely a threat at all.

The IANA tool reports that four of the top 100 brands have at least one “highly vulnerable” authoritative name server that has recursion enabled and no source port randomization.

The other eight “vulnerable” domains were identified as running on at least one authoritative server that had recursion turned on and source port randomization enabled.

I’m not an expert, but I don’t believe this second category of companies has a great deal to worry about in terms of Kaminsky.

I picked the Deloitte brand list for this experiment because it is the list of brands Deloitte believes require the most trademark protection under ICANN’s new TLD process.

.CO Internet is already using the list during its sunrise period for the .co domain.

Michele Neylon of Blacknight has found some more vulnerable servers over here.

ICANN accused of Twitter faux pas over Arabic domains

The registry behind one of the new Arabic-script ccTLDs has sharply criticised ICANN for the way it introduced internationalized domain names to the root this week.

Adrian Kinderis, CEO of AusRegistry, accused ICANN, specifically those responsible for the IANA function, of “embarrassing incompetency” and cultural insensitivity.

Kinderis’ beef is that IANA added the three new Arabic IDNs to the root without giving their local managers so much as a headsup.

AusRegistry is the back-end provider for امارات. the United Arab Emirates’ new IDN ccTLD, as well as its ASCII original.

“I was alarmed to discover that the relevant ccTLD Managers were only notified many hours after the fact, long after the same IANA staff member had broadcast the news on a personal Twitter account,” he blogged.

While Kinderis was diplomatic enough not to name names, he’s talking about IANA registry manager Kim Davies, who broke the web-changing news on Wednesday with a tweet.

“This was an inappropriate manner in which to announce an event of this importance,” Kinderis wrote. “It displays a disturbing lack of understanding and a complete disregard of the cultural and political significance of this event within the Arabic world.”

He goes on to point out that the announcement was made during Saudi Arabia’s weekend, leaving ccTLD managers scrambling to get their marketing in place on their day off.

I could keep quoting. It’s a fairly extraordinary attack on aspects of ICANN’s culture. Go have a read.

I-Root yanks Beijing node

Kevin Murphy, March 31, 2010, Domain Tech

Autonomica, which runs i-root-servers.net, has stopped advertising its Anycast node in Beijing, after reports last week that its responses were being tampered with.

In the light of recent tensions between China and the US, people got a bit nervous after the Chilean ccTLD manager reported some “odd behaviour” to the dns-ops mailing list last week.

It seemed that DNS lookups for Facebook, Twitter and YouTube were being censored as they returned from I-Root’s node in China, which is hosted by CNNIC.

There was no suggestion that Autonomica was complicit in any censorship, and chief executive Karl Erik Lindqvist has now confirmed as much.

“Netnod/Autonomica is 100% committed to serving the root zone DNS data as published by the IANA. We have made a clear and public declaration of this, and we guarantee that the responses sent out by any i.root-servers.net instance consist of the appropriate data in the IANA root zone,” he wrote.

While Lindqvist is not explicit, the suggestion seems to be that somebody on the Chinese internet not associated with I-Root has been messing with DNS queries as they pass across the network.

This is believed to be common practice in China, whose citizens are subject to strict censorship, but any such activity outside its borders obviously represents a threat to the internet’s reliability.

The CNNIC node is offline until further notice.