Verisign says new gTLDs put millions at risk

Verisign has revived its old name collisions security scare story, publishing this week a weighty research paper claiming millions are at risk of man-in-the-middle attacks.
It’s actually a study into how a well-known type of attack, first documented in the 1990s, might become easier due to the expansion of the DNS at the top level.
According to the paper there might be as many as 238,000 instances per day of query traffic intended for private networks leaking to the public DNS, where attackers could potentially exploit it to all manner of genuinely nasty things.
But Verisign has seen no evidence of the vulnerability being used by bad guys yet and it might not be as scary as it first appears.
You can read the paper here (pdf), but I’ll attempt to summarize.
The problem concerns a virtually ubiquitous protocol called WPAD, for Web Proxy Auto-Discovery.
It’s used by mostly by Windows clients to automatically download a web proxy configuration file that tells their browser how to connect to the web.
Organizations host these files on their local networks. The WPAD protocol tries to find the file using DHCP first, but fails over to DNS.
So, your browser might look for a wpad.dat file on wpad.example.com, depending on what domain your computer belongs to, using DNS.
The vulnerability arises because companies often use previously undelegated TLDs — such as .prod or .global — on their internal networks. Their PCs could belong to domains ending in .corp, even though .corp isn’t real TLD in the DNS root.
When these devices are roaming outside of their local network, they will still attempt to use the DNS to find their WPAD file. And if the TLD their company uses internally has actually been delegated by ICANN, their WPAD requests “leak” to registry or registrant.
A malicious attacker could register a domain name in a TLD that matches the domain the target company uses internally, allowing him to intercept and respond to the WPAD request and setting himself up as the roaming laptop’s web proxy.
That would basically allow the attacker to do pretty much whatever he wanted to the victim’s browsing experience.
Verisign says it saw 20 million WPAD leaks hit its two root servers every single day when it collected its data, and estimates that 6.6 million users are affected.
The paper says that of the 738 new gTLDs it looked at, 65.7% of them saw some degree of WPAD query leakage.
The ones with the most leaks, in order, were .global, .ads, .group, .network, .dev, .office, .prod, .hsbc, .win, .world, .one, .sap and .site.
It’s potentially quite scary, but there are some mitigating factors.
First, the problem is not limited to new gTLDs.
Yesterday I talked to Matt Larson, ICANN’s new vice president of research (who held the same post at Verisign’s until a few years ago).
He said ICANN has seen the same problem with .int, which was delegated in 1988. ICANN runs one of .int’s authoritative name servers.
“We did a really quick look at 24 hours of traffic and saw a million and a half queries for domain names of the form wpad.something.int, and that’s just one name server out of several in a 24-hour period,” he said.
“This is not a new problem, and it’s not a problem that’s specific to new gTLDs,” he said.
According to Verisign’s paper, only 2.3% of the WPAD query leaks hitting its root servers were related to new gTLDs. That’s about 238,000 queries every day.
With such a small percentage, you might wonder why new gTLDs are being highlighted as a problem.
I think it’s because organizations typically won’t own the new gTLD domain name that matches their internal domain, something that would eliminate the risk of an attacker exploiting a leak.
Verisign’s report also has limited visibility into the actual degree of risk organizations are experiencing today.
Its research methodology by necessity was limited to observing leaked WPAD queries hitting its two root servers before the new gTLDs in question were delegated.
The company only collected relevant NXDOMAIN traffic to its two root servers — DNS queries with answers typically get resolved closer to the user in the DNS hierarchy — so it has no visibility to whether the same level of leaks happen post-delegation.
Well aware of the name collisions problem, largely due to Verisign’s 11th-hour epiphany on the subject, ICANN forces all new gTLD registries to wildcard their zones for 90 days after they go live.
All collision names are pointed to 127.0.53.53, a reserved IP address picked in order to catch the attention of network administrators (DNS uses TCP/IP port 53).
Potentially, at-risk organizations could have fixed their collision problems shortly after the colliding gTLD was delegated, reducing the global impact of the vulnerability.
There’s no good data showing how many networks were reconfigured due to name collisions in the new gTLD program, but some anecdotal evidence of admins telling Google to go fuck itself when .prod got delegated.
A December 2015 report from JAS Advisors, which came up with the 127.0.53.53 idea, said the effects of name collisions have been rather limited.
ICANN’s Larson echoed the advice put out by security watchdog US-CERT this week, which among other things urges admins to use proper domain names that they actually control on their internal networks.

XYZ settles Verisign’s back-end switcheroo lawsuit

XYZ.com has settled a lawsuit filed against it against Verisign stemming from XYZ’s acquisition of .theatre, .security and .protection.
Verisign sued the new gTLD registry operator for “interfering” with its back-end contracts with the previous owners last August, as part of its campaign to compete against new gTLDs in the courtroom.
XYZ had acquired the .security and .protection ICANN contracts from security Symantec, and .theatre from a company called KBE Holdings.
As part of the transitions, all three applications were modified with ICANN to name CentralNic as the back-end registry services provider, replacing Verisign.
Verisign sued on the basis of tortious interference and business conspiracy. It was thrown out of court in November then amended and re-filed.
But the case appears to have now been settled.
Negari issued a grovelling not-quite-apology statement on his blog:

I am pleased to report that the recent case filed by Verisign against CentralNic, Ltd., XYZ and myself has been settled. After looking at the claims in dispute, we regret that as a result of our acquisition of the .theatre, .security and .protection extensions and our arrangement for CentralNic to serve as the backend service provider for these extensions, that Verisign was prevented from the opportunity to pursue monetization of those relationships. As ICANN’s new gTLD program continues to evolve, we would caution others who find themselves in similar situations to be mindful of the existing contracts extension owners may have with third parties.

Registries changing their minds about their back-end provider is not unheard of.
In this case, large portions of Verisign’s final amended complaint were redacted, suggesting some peculiarities to this particular switch.
If there was a monetary component to the settlement, it was not disclosed. The original Verisign complaint had demanded damages of over $2 million.

Verisign facing its own activist investor

While new gTLD registries Rightside and Minds + Machines have faced board-room challenges by activist investors in recent months, it seems industry heavyweight Verisign is contended with a similar problem.
John Chevedden, once described as an “economy class” activist due to his relatively small stakes, is attempting to give smaller Verisign shareholders the ability to propose directors for the company’s board.
Rather than attempting to gut the companies he invests in, he tries to make the odd incision into their corporate governance in order to give smaller investors a greater voice in their companies.
He’s filed a proposal, which will be voted on at Verisign’s June 9 annual general meeting, for a new “proxy access” bylaw.
Essentially, the proposal would allow an unlimited number of shareholders who collectively own over 3% of the company’s stock to propose two people for director elections (or 25% of the board, whichever is greater).
But Verisign’s current board is recommending that shareholders vote against the proposal, saying it’s “unnecessary”.
The company says that it plans to introduce its own proxy access bylaw that would be slightly different.
The Verisign alternative would limit the size of the nominating gang to 20 shareholders. That would mean that each individual investor would have to own much larger stakes, in order to pass the 3% threshold and nominate director candidates.
Verisign says Chevedden’s proposal, which does not limit the number of small shareholders involved, would be expensive and unwieldy to manage.
Chevedden reportedly has quite a decent success rate with these kinds of proposals.

Verisign has great quarter but sees China growth slowing

Verisign beat its sales expectations in the first quarter of the year, but leadership said rapid growth from Chinese registrants will now “normalize”.

The .com/.net registry last night reported net income up 21% at $107 million, on revenue that was up 9.1% to $282 million.
That’s based primarily on it selling 2.65 million net new .com/.net names during the quarter, at 7.1% increase on the Q1 2014 level baseline. It said it sold 10 million new names in the quarter, up from 8.7 million a year ago.
For comparison, Q1 2015 saw 1.51 million net adds across the two TLDs. Three months ago, the company had predicted net adds to be 1.5 to 2 million names.
It had 142.5 million names at the end of the quarter, 126.6 million of which were .com.
CEO James Bidzos told analysts: “We again saw activity coming from registrars in China that exceeded our expectations.”
However, he added: “At this point, we expect activity from registrars in China to normalize as we continue through the second quarter.”
When pressed, CFO George KIlguss elaborated (according to the SeekingAlpha earnings call transcript):

as we look at the trends, we’ve seen the demand that happened in the second half of the first quarter kind of ebb and flow. So we saw it come. It was pretty strong for a few weeks and then it came back to more than normalized path. So we don’t have a perfect crystal ball, but based on the trends that we’ve seen that we’ve been tracking, it seems to be back on the normalized path for that particular region, at least as what we’ve seen historically.

Verisign is currently negotiating for the renewal of its .com contract with ICANN, which may or may not enable it to raise its government-frozen registry prices in future.

Porn firm wins .cam after years of objections

The controversial new gTLD .cam has been won at auction by Dutch porn site operator AC Webconnecting, putting an end to over two years of back-and-forth objections.
Rival applicants Rightside and Famous Four Media both withdrew their applications earlier this week.
The contest for .cam was marked by several objections and appeals.
In 2013, Verisign filed and lost String Confusion Objections against AC Webconnecting and Famous Four, but won its near-identical objection against Rightside.
Verisign had claimed that .cam and .com are so similar-looking that confusion among internet users is bound to arise.
Because the SCO panels in the three cases returned differing opinions, Rightside was one of two applicants given the right to appeal by ICANN in October 2014.
I never quite understood why Verisign wasn’t also given the right to appeal.
Rightside won the right to stay in the .cam contention set almost a year later.
Despite all that effort, it did not prevail in the resulting auction.
Separately, back in 2013, AC Webconnecting filed and lost Legal Rights Objections against its two rivals, based on a “.cam” trademark it acquired purely for the purpose of fighting off new gTLD competitors.
I’d be lying if I said I knew a lot about the soon-to-be registry.
Based in Rotterdam, its web site comes across as a wholly safe-for-work web design firm.
However, it seems to be mainly in the business of operating scores, if not hundreds, of webcam-based porn sites.
Its application for .cam states that it will be for everyone with an interest in photography, however.
When it goes live, its most direct competitor is likely to be Famous Four’s .webcam, which already has an 18-month and 70,000-domain head start.
It remains to be seen whether its clear similarity to .com will in fact cause significant confusion.

It’s official: new gTLDs didn’t kill anyone

The introduction of new gTLDs posed no risk to human life.
That’s the conclusion of JAS Advisors, the consulting company that has been working with ICANN on the issue of DNS name collisions.
It is final report “Mitigating the Risk of DNS Namespace Collisions”, published last night, JAS described the response to the “controlled interruption” mechanism it designed as “annoyed but understanding and generally positive”.
New text added since the July first draft says: “ICANN has received fewer than 30 reports of disruptive collisions since the first delegation in October of 2013. None of these reports have reached the threshold of presenting a danger to human life.”
That’s a reference to Verisign’s June 2013 claim that name collisions could disrupt “life-supporting” systems such as those used by emergency response services.
Names collisions, you will recall, are scenarios in which a newly delegated TLD matches a string that it is already used widely on internal networks.
Such scenarios could (and have) led to problems such as system failure and DNS queries leaking on to the internet.
The applied-for gTLDs .corp and .home have been effectively banned, due to the vast numbers of organizations already using them.
All other gTLDs were obliged, following JAS recommendations, to redirect all non-existent domains to 127.0.53.53, an IP address chosen to put network administrators in mind of port 53, which is used by the DNS protocol.
As we reported a little over a year ago, many administrators responded swearily to some of the first collisions.
JAS says in its final report:

Over the past year, JAS has monitored technical support/discussion fora in search of posts related to controlled interruption and DNS namespace collisions. As expected, controlled interruption caused some instances of limited operational issues as collision circumstances were encountered with new gTLD delegations. While some system administrators expressed frustration at the difficulties, overall it appears that controlled interruption in many cases is having the hoped-for outcome. Additionally, in private communication with a number of firms impacted by controlled interruption, JAS would characterize the overall response as “annoyed but understanding and generally positive” – some even expressed appreciation as issues unknown to them were brought to their attention.

There are a number of other substantial additions to the report, largely focusing on types of use cases JAS believes are responsible for most name collision traffic.
Oftentimes, such as the random 10-character domains Google’s Chrome browser uses for configuration purposes, the collision has no ill effect. In other cases, the local system administrators were forced to remedy their software to avoid the collision.
The report also reveals that the domain name corp.com, which is owned by long-time ICANN volunteer Mikey O’Connor, receives a “staggering” 30 DNS queries every second.
That works out to almost a billion (946,728,000) queries per year, coming when a misconfigured system or inexperienced user attempts to visit a .corp domain name.

Verisign warns about Chinese .com boom

Verisign has warned investors that the current boom in .com sales is largely coming from Chinese domainers and may not be sustainable.
The company has added an unprecedented 4.1 million domain in .com and .net so far during the fourth quarter.
“While there continues to be demand for domain names globally, the recent increased volume for Verisign’s top level domains, as well as top level domains of other registries, during the fourth quarter is coming largely through registrars in China,” the company said in a Securities and Exchange Commission filing.
It listed several factors that are likely responsible for the sudden uptick, but warned that renewal rates are typically not great.

In the past, Verisign has discussed many factors that affect the demand for domain names, including, but not limited to economic, social, and regulatory conditions, Internet adoption, Internet penetration, and increasing e-commerce. In addition to these factors affecting demand, Verisign is also evaluating additional potential factors unique to China that may also be responsible for the recent increased volume of new registrations in China.
In no particular order, these potential factors, or combination of factors, could include, but may not be limited to, government initiatives in China to develop their online economy such as ‘Internet Plus;’ registry and registrar regulatory requirements; cultural influences such as the popularity of numeric domain names; increasing competition amongst Chinese registrars; potential increases in domain name investment activity; and recent capital markets volatility and access to capital in China.
Verisign cannot predict if or how long this increased pace of gross additions will continue and we cannot at this time predict what the renewal rate for these domain names will be. Verisign has noted in the past that renewal rates for domain names registered in emerging markets, such as China, have historically been lower than those registered in more developed markets.

It’s difficult to imagine that Chinese investors have managed to find four million unregistered domains worth keeping.
There are currently 123,497,852 domains in the .com zone file, according to Verisign’s web site.
Verisign is not the only registry that appears to be benefiting from a deluge of registrations from China.
XYZ.com has seen over 440,000 domains added to its .xyz zone file in the last three weeks, bringing its total to over 1.5 million, which appear to be largely coming through Chinese registrars.

Pro-.com analyst “sponsored” by Verisign. Is this a big deal?

Verisign has admitted it “sponsors” an analyst who has written more than a dozen articles singing the praises of .com and questioning the value of new gTLDs over the last few years.
Zeus Kerravala is the founder and principal analyst at ZK Research. He writes a regular column for Network World called Network Intelligence.
Last week, domain industry eyebrows were raised by the latest in a series of pro-.com articles — all of which seem to have been removed by Network World in the last 24 hours — to appear in the column.
The latest article was entitled “Why more companies are ditching new domain names and reverting to .com“.
Kerravala basically mined domain industry blogs, including this one, for examples of companies preferring .com over ccTLDs and new gTLDS, to support a view that .com is awesome and other TLDs are not.
He could have quite easily have used the same method to reach the opposite conclusion, in my view.
The Halloween-themed article concluded:

The good news is that .com will be here now and into the future, just like it has been for the past 30 years to provide treats to businesses after they have been “tricked” by other TLDs.

The article, and 12 more before it dating back to August 2012, looked to some like Verisign spin.
Other headlines include “Why .com is still the domain of choice for businesses” and “New generic top-level domain names do more harm than good” and “Companies are movin’ on up to .com domain names”.
They’re all basically opinion pieces with a strongly pro-.com slant.
The opinion that .com is better than the alternatives is not uncommon, especially among domainers who have lots of money tied up in .com investments.
The fact that Kerravala, who doesn’t usually touch the domain industry in his column, has written a dozen stories saying essentially the same thing about .com over the last couple of years looked a bit odd to some in the domain industry.
And it turns out that he is actually on the Verisign payroll.
A Verisign spokesperson told DI: “ZK Research is a sponsored industry analyst and blogger.”
The company declined to answer a follow-up question asking whether this meant he was paid to blog.
Kerravala told DI that Verisign is one of his clients, but denied blogging on its behalf. He said in an email:

they are a client like many of the other large technology firms. Although I blog, like many analysts, I am first an foremost an analyst. I have paid relationships with tech vendors, service providers, end user firms, resellers and the financial community.
Verisign pays me for inquiry time and to have access to my research. Verisign has many relationships like this with many analyst firms and I have this type of relationship with many other technology firms.
In no way do vendors pay me to write blogs nor do they influence my research or my opinions. Sometimes, I may choose to interview a vendor on a certain topic and include them in the article.

Kerravala had not disclosed in his Network World articles or boilerplate biography that Verisign is one of his clients.
In a January 2014 article published on SeekingAlpha, “New Generic Top Level Domain Names Pose No Threat To VeriSign“, contains a disclosure that reads in part “I have no business relationship with any company whose stock is mentioned in this article.”
Kerravala said in an email that although his relationship with Verisign started in 2013, the company was not a client at the time the SeekingAlpha article appeared.
The relationship came to light after new gTLD registry Donuts emailed Kerravala via a third party — and Kerravala says under false pretenses — claiming to have liked his most recent article and asking for a contact name at Verisign.
He would have responded honestly to just being asked directly by Donuts, he said.
In a telephone conversation yesterday, he said that his articles about .com represent his genuinely held beliefs which, as we agree, are not particularly unusual.
He observed that DI has a generally pro-TLD-competition point of view, and that many of my advertisers are drawn from the new gTLD industry, and said that his relationship with Verisign is not dissimilar to DI’s relationship to its advertisers.

Verisign’s silly .xyz lawsuit thrown out

Verisign has had its false advertising lawsuit against the .xyz gTLD registry thrown out of court.
XYZ.com this week won a summary judgement, ahead of a trial that was due to start next Monday.
“By granting XYZ a victory on summary judgement, the court found that XYZ won the case as a matter of law because there were no triable issues for a jury,” the company said in a statement.
The judge’s ruling does not go into details about the court’s rationale. XYZ’s motion to dismiss has also not been published.
So it’s difficult to know for sure exactly why the case has been thrown out.
Verisign sued in December, claiming XYZ and CEO Daniel Negari had lied in advertising and media interviews by saying there are no good .com domain names left.
Many of its claims centered on this video:

XYZ said its ads were merely hyperbolic “puffery” rather than lies.
Verisign also claimed that XYZ had massively inflated its purported registration numbers by making a shady $3 million reciprocal domains-for-advertising deal with Network Solutions.
XYZ general counsel Grant Carpenter said in a statement: “These tactics appear to be part of a coordinated anti-competitive scheme by Verisign to stunt competition and maintain its competitive advantage in the industry.”
While Verisign has lost the case, it could be seen to have succeeded in some respects.
XYZ had to pay legal fees in “the seven-figure range”, as well as disclose hundreds of internal company documents — including emails between Negari and me — during the discovery phase.
Through discovery, Verisign has obtained unprecedented insight into how its newest large competitor conducts its business.
While I’ve always thought the lawsuit was silly, I’m now a little disappointed that more details about the XYZ-NetSol deal are now unlikely to emerge in court.

Verisign offers free public DNS

Verisign has launched a free recursive DNS service aimed at the consumer market.
Public DNS, as the service is called, is being positioned as a way to avoid having your browsing history collated and sold for marketing purposes by your ISP.
There’s no charge, and the company is promising not to sell your data. It also does not plan to monetize NXDOMAIN traffic.
So what’s in it for Verisign? According to a FAQ:

One of Verisign’s core operating principles is to be a good steward of the Internet. Providing the Verisign Public DNS service supports the overall ecosystem of DNS and solidifies end-user trust in the critical navigation that they have come to depend upon for their everyday interactions.

Verisign also offers paid-for recursive DNS services to enterprises, so there may be an up-sell opportunity here.
The market for free public DNS currently has big players including Cisco’s OpenDNS and Google.
If you want to use the Verisign service, the IP addresses to switch to are 64.6.64.6 and 64.6.65.6.