Latest news of the domain name industry

Recent Posts

Spam is not our problem, major domain firms say ahead of ICANN 66

Kevin Murphy, October 21, 2019, 14:30:06 (UTC), Domain Policy

Eleven of the largest domain name registries and registrars have denied that spam is something they should have to deal with, unless it’s used to proliferate other types of abuse such as phishing or malware.
In a newly published “Framework to Address Abuse” (pdf), the companies attempt to define the term “DNS abuse” narrowly to capture only five (arguably only four and a half) specific types of online threat.
That abuse comprises malware, phishing, botnets, pharming and spam.
The companies agree that these are activities which registrars and registries “must” act upon.
But the document notes that not all spam is its responsibility, stating:

While Spam alone is not DNS Abuse, we include it in the five key forms of DNS Abuse when it is used as a delivery mechanism for the other four forms of DNS Abuse. In other words, generic unsolicited e-mail alone does not constitute DNS Abuse, but it would constitute DNS Abuse if that e-mail is part of a phishing scheme.

In other words, registrars and registries should not feel responsible for the billions of spams sent every day using their domains, unless the spam runs further malware, phishing, pharming or botnet abuse.
The signatories of the framework are Public Interest Registry, GoDaddy, Donuts, Tucows, Amazon Registry Services, Blacknight, Afilias, Name.com, Amazon Registrar, Neustar, and Nominet UK.
It may seem like they’ve presented a surprisingly narrow definition, but it’s in line with what current ICANN contracts dictate.
Neither the standard Registry Agreement nor Registrar Accreditation Agreement mention spam at all. Six years ago, ICANN specifically said that spam is “outside of ICANN’s scope and authority”.
Under the RA, registries have to oblige their registrars to ban registrants from “distributing malware, abusively operating botnets, phishing, piracy, trademark or copyright infringement, fraudulent or deceptive practices, counterfeiting or otherwise engaging in activity contrary to applicable law”.
They also have to maintain statistical reports on the amount of “pharming, phishing, malware, and botnets” in their zones, and provide those reports to ICANN upon demand. A recent audit found that 5% of registries, mainly dot-brands, were not doing this.
However, ICANN’s Domain Abuse Activity Reporting system, an effort to provide some transparency into how gTLDs are being abused, does in fact track spam. It does not track pharming, which is a fairly obscure and little-used form of DNS attack.
The DAAR report for September shows that spam constituted 73% of all tracked abuse.
The ICANN board of directors today identified DAAR as one of a few dozen priorities for the coming year.
Similarly, the cross-community working group known as the CCT Review Team, which was tasked with looking into how the new gTLD program has impacted competition and consumer trust, had harsh words for spam-friendly registries, and provided a definition of “DNS Security Abuse” that specifically included “high volume spam”.
The review recommended that ICANN introduce more measures to force contracted parties to deal with this type of abuse. This could include incentives for registries to clean up their zones and abuse volume thresholds that would automatically trigger compliance actions.
The new framework document comes in the context of an ongoing debate within the ICANN community about what “DNS abuse” is.
Two partners at Interisle, a security consultancy that often works for ICANN, recently guest-posted on DI to say that this term has become meaningless and should be abandoned in favor of “security threat”.
They argued that the definition should include not only spam, but also stuff like IP infringement, election interference, and terrorism.
But the main threat to contracted parties probably comes from the Governmental Advisory Committee, backed by law enforcement, which is pushing for stronger rules covering abusive content.
During a webinar last week, the US Federal Trade Commission, the FBI, and Europol argued that registries and registrars should be obliged to do more to combat abuse, specifically including spam.
“Whether or not you call it phishing or spam or whether it has a malware payload or not, ultimately it’s all email, and email remains the most common tool of cybercriminals to ensnare their victims, and that’s why we in law enforcement care about the domains used to send emails,” said Gabriel Andrews of the FBI’s Cyber Initiative Resource Fusion Unit, on the call.
Registries and registrars countered, using the same language found in the new framework, that generic spam is a content issue, and outside of their remit.
The two sides are set to clash again at ICANN’s annual general meeting in Montreal next month, in a November 6 face-to-face session.
While 11 entities signed the new framework, it’s arguably only nine companies. Name.com is owned by Donuts and both Amazon firms obviously have the same parent.
But it does include the two largest registrars, and registries responsible for running several hundred commercial gTLDs, dot-brands and ccTLDs.
While none of the signatories of the framework have a particular reputation for being spam-friendly, other companies in the industry — particularly some of the newest and cheapest new gTLDs — tend to attract spammers like flies to a turd.
Some of the signatories are perhaps surprising, given their past or ongoing behavior to tackle content-based abuse in their own zones.
Nominet, notably, takes down tens of thousands of domains ever year based on little more than police assurances that the domains are being used to sell counterfeit merchandise or infringe copyright.
The .uk registry also preemptively suspends domains based on algorithms that guess whether they’re likely to be seen as encouraging sexual violence or could be used in phishing attacks.
Donuts also has a trusted notifier relationship with the movie and music industries that has seen it take down dozens of names being used for mass copyright infringement.
PIR has previous endorsed, then unendorsed, the principal of a “UDRP for copyright”, a method of giving Big Content a way of going through due process to have domains taken or suspended.
Outside the spam issue, while the new registry-registrar framework says that registries and registrars should not get involved in matters related to web site content, it also says they nevertheless “should” (as opposed, one assumes based on the jargon usually found in internet standards, to “must”) suspend domains when they’re being used to distribute:

(1) child sexual abuse materials (“CSAM”); (2) illegal distribution of opioids online; (3) human trafficking; and (4) specific and credible incitements to violence.

These are exceptions because they constitute “the physical and often irreversible threat to human life”, the framework says.
Ultimately, this all boils down to a religious debate about where the line is drawn between “DNS” and “content”, it seems to me.
The contracted parties draw the line at threats to human life, whereas others want action on other forms of abuse largely because registries and registrars are in the best position to help.

Tagged: , , , , , , , , , , , , , , ,

Comments (11)

  1. Rubens Kuhl says:
    October 21, 2019 at 2:37 pm

    Registries and registrars are not in the best position to help; hosting companies are. Contracted parties only have nuclear options available to them.
    But people keep trying strong-arming ICANN due to its gTLD policy and contractual role, which is becoming a vulnerability of the industry.

    Reply
    • Derek says:
      October 21, 2019 at 5:14 pm

      Theory of operation and semantics are great, but let’s consider a real word example. Chase bank is being spoofed, but not for phishing, rather for advance fee fraud purposes. The registrar distances themselves from any abuse. Any report has to go to the hoster. A report follows to the hoster. Lovely domain suspension page. But the MX is re-pointed. Scamming business as usual. Let’s also consider the associated domains (there are multiples of these) are registered with fake registration data. Further consider these domains ping pong between two hosters. At least one hoster is actively facilitating. They are also a reseller. Apart from the “ICANN Accredited registrar” and “TRUSTEe” certified logos (fake), they must exist under a rock on a steep precipice in Nigeria, 5 numbers further than the highest in this street where the precipice is after the last house.
      So, should we be sending our reports to the facilitator?
      This is also extremely common in advance fee fraud, the small sister to BEC.

      Reply
      • Rubens Kuhl says:
        October 21, 2019 at 7:21 pm

        DNS records are also not managed by the registrar, but by a DNS provider. It could be the registrar, as the hoster can be the registrar, but it’s not due to its role as registrar.

        Reply
  2. John Laprise says:
    October 21, 2019 at 2:47 pm

    At Large begs to differ. To Rubens point, while they might not be in the best position, they are in a position to help. It’s a team effort.

    Reply
  3. Acro says:
    October 21, 2019 at 2:54 pm

    This is complete and utter bullshit.
    Here’s how spam works:
    Registries arrange low priced domain deals with Registrars. E.g. NameCheap agrees to offer sub-$2 registrations with the .ICU and .BEST Registries.
    If they can get paid in BTC, that’s a lovely bonus for the spammers, who now have an endless supply of cheap domains and relative anonymity.
    Lastly, they tap on free reverse proxy services such as CloudFlare, hiding their real server IP. That means, they can be in Eastern Europe where most spam originates from, or Central America and spam relentlessly.
    ICANN should penalize Registries that have no built-in support for blocking spam. For example, whatever the .XYZ Registry does to combat spam, it works. Daniel Negari deserves some public praise for this.
    See https://domaingang.com/domain-news/namecheap-and-cloudflare-domain-spam-is-currently-out-of-control/

    Reply
  4. Volker Greimann says:
    October 21, 2019 at 4:10 pm

    One thing you misread in the framework becomes apparent where you conclude that ” registrars and registries should not feel responsible …” (for other kinds of abuse). Contracted parties may very much still take up these issues in their own abuse policies and many (like CentralNic Registrars) do.
    These issues are just not DNS abuse and should not be regulated by ICANN. We can still take action, if we want to.
    CentralNic is not a signatory to the frameswork at this time (we – like most others – were not asked).

    Reply
    • Derek says:
      October 21, 2019 at 7:23 pm

      I’ll say this for CentralNic. They really try. I’m not associated with them, but I do deal with them from time to time on abuse issues.
      As you also say – yes, these contracted parties can take a stance against certain types of abuse. Some have. Ironically one such relationship was born years back after a rather irate email to a CEO of a large registrar.
      The biggest challenge is knowing who to trust when receiving reports.
      “I bought a pair of shoes for $50 online, went to another website and saw it advertised for $45. I was scammed! Kill it!”. This is not quite abuse. When the very actors responsible for huge fraudulent consumer and business losses are the registrants, even resellers, also not honoring any agreement, we have DNS abuse. The online content is merely a manifestation of a problem that started at registration time, especially if all the supplied registration details are fake. This actually queries the value of any contract that any registrar has and any obligations and protections, when one of the parties is patently bogus. When we find ~250 domains all with fraudulent content and making up the entire reseller’s portfolio, we have an issue. When we then find metadata fingering the CEO of this small company in the online content, we have a major problem. Some registrars acknowledge this, some simply could not care. Dare I say the two biggest registrars that self blind to anything in this area are US based? DNS abuse is real. We can acknowledge it or deny it, the bad actors couldn’t care and can abuse domains to the detriment of all. While a malicious registrant has control of the domain’s DNS, we have no ability to mitigate abuse perpetuated with such a domain.
      This is also why GAC gave guidelines and did not resort to specific abuse types, rather giving examples. Simply consider BEC. When GAC put out the Beijing advisory, this was not much of a known threat. Yet the GAC advice already covered it because they did not get caught up in semantics. Some registrars and registries implemented the guidelines, some already has policies that denied abuse. Other will probably always fight against it because it affects the bottom line.

      Reply
      • Volker Greimann says:
        October 22, 2019 at 8:20 am

        As I deal with abuse on the registrar side of CentralNic, I’ll take that compliment and will pass it to the team.
        We take abuse of our infrastructure seriously and have voluntarily adopted policies that go beyond the proposed framework.
        However, while we do feel that we have a role to play, much of the complaints we receive is misdirected at us and should be taken up with the parties that can address most issues directly: Domain name registrants and their hosting providers. When the registrant is the one acting in bad faith, contacting them will not do much good, but then there always is their hosting service.
        Hosting is where the content is and where the content can be removed, there is where regulation should happen. Content is where most of the abuse we see in our daily reporst to our abuse mailbox happens. And content is the one thing we usually can’t do anything about.
        We’ll continue doing what we can, but given the limitations of the registrar and registry roles, we are not the best place to address this.

        Reply
        • Derek says:
          October 23, 2019 at 6:25 pm

          “I’ll take that compliment and will pass it to the team.”
          As it was intended, so please do. It is hard earned and well deserved.

          Reply
  5. Theo Geurts says:
    October 21, 2019 at 7:49 pm

    Volker has a good point. Registrars go beyond what is proposed in the framework.
    A year ago, we started using cyber threat intelligence and deployed OSINT techniques to combat abuse at Realtime Register B.V.
    Mitigation efforts through Open Threat Exchanges are also part of the standard procedures now.
    That being said and while I appreciate the upcoming discussion about security threats at ICANN 66, we still need to be careful here.
    Rubens is spot on when he mentions we only have the nuclear option, and with that power comes great responsibility.

    Reply

Leave a Reply to Acro

Click here to cancel reply.