Bit-squatting – the latest risk to domain name owners

Forget phishing, forget cybersquatting, forget typosquatting, high-value domain name owners may have a whole new threat to worry about – “bit-squatting”.
This appears to be the conclusion of fascinating new research to be presented by Artem Dinaburg at the Black Hat and DEF CON hacker conferences in Las Vegas next week.
Defective internet hardware, it turns out, may be enabling a whole new category of typosquatting that could prove worrying for companies already prone to domain name abuse.
According to a summary of Dinaburg’s research, RAM chips can sometimes malfunction due to heat or radiation, resulting in “flipped bits”, where a 1 turns into a 0 or vice-versa.
Because the DNS uses ASCII encoding, a query containing a single flipped bit could actually send the user to a completely different domain name to the one they intended to visit.
To test the theory, Dinaburg appears to have registered the typo domain name mic2osoft.com. While it’s not visually confusing or a likely typo, in binary it is only one bit different to microsoft.com.
The ASCII binary code for the digit 2 is 00110010, which is only one bit different to the lower-case letter r, 01110010.
The binary for the string “microsoft” is:

011011010110100101100011011100100110111101110011011011110110011001110100

and the binary encoding for “mic2osoft” is (with the single changed bit highlighted):

011011010110100101100011001100100110111101110011011011110110011001110100

Therefore, if that one bit were to be accidentally flipped by a dodgy chip, the user could find themselves sending data to the bit-squatter’s domain rather than Microsoft’s official home.
I would assume that this is statistically only a concern for very high-traffic domains, and only if the bit-flipping malfunction is quite widespread.
But Dinaburg, who works for the defense contractor Raytheon, seems to think that it’s serious enough to pay attention to. He wrote:

To verify the seriousness of the issue, I bit-squatted several popular domains, and logged all HTTP and DNS traffic. The results were shocking and surprising, ranging from misdirected DNS queries to requests for Windows updates.
…
I hope to convince the audience that bit-squatting and other attacks enabled by bit-flip errors are practical, serious, and should be addressed by software and hardware vendors.

His conference presentations will also discuss possible hardware and software solutions.
For large companies particularly at risk of typosquatting, the research may also present a good reason to conduct a review of their trademark enforcement strategies.
I’m not going to be in Vegas this year, but I’m looking forward to reading more about Dinaburg’s findings.
The annual Black Hat and DEF CON conferences are frequently the venues where some of the most beautifully creative DNS hacks are first revealed, usually by Dan Kaminsky.
Kaminsky is not discussing DNS this year, judging by the agendas.
The conferences were founded by Jeff Moss, aka The Dark Tangent, who joined ICANN as its chief security officer earlier this year.

Final gTLD Applicant Guidebook expected this week

It’s been over a month since ICANN approved its new top-level domains program, but we still don’t have a final-final version of the Applicant Guidebook.
The resolution approving the program ICANN passed in Singapore called for a number of amendments to be made to the 352-page tome.
The current draft was published May 30, and so far ICANN has not said when the next version – likely to be the version used in the first round of applications – will be released.
I inquired, and now word has come from on high that ICANN’s new gTLD team hopes to have the English version of the new Guidebook published by the end of July – this coming weekend.
The Singapore resolution called for changes to the government Early Warning and Advice processes, added protection for Olympic and Red Cross trademarks, and a modification of the Uniform Rapid Suspension cybersquatting policy.
One has to wonder if the changes outlined in the resolution are the only changes that we’ll see – a month seems like a long time to make just a few fairly minor edits.
The resolution said the board “authorizes staff to make further updates and changes to the Applicant Guidebook as necessary and appropriate”.
The first round of new gTLD applications is set to open January 12.

Could .om become the next typo TLD?

Will Oman’s .om domain follow in the footsteps of .co? Or .cm? Or neither?
The country-code top-level domain is set to be transferred to a new manager following an ICANN vote this coming Thursday.
The redelegation is one item on a unusually light agenda for the board’s July 28 telephone meeting. It’s on the consent agenda, so it will likely be rubber-stamped without discussion.
The domain is currently assigned to Oman Telecommunications Company, but the new owner is expected to be the national Telecommunications Regulatory Authority or an affiliated entity.
The Omani TRA was given authority over the nation’s domain names by Royal Decree in 2002.
It has already successfully had the Arabic-script ccTLD .عمان approved by ICANN for use as an internationalized domain name, but the IDN has not yet been delegated.
AusRegistry International this March won a $1.3 million contract with the TRA to provide software and services for the .om and .عمان registries.
At the time, the TRA said it planned to market both Latin and Arabic extensions to increase the number of domain registrations.
The .om ccTLD is of course a .com typo, like .co and .cm, but squatting is not currently possible due to its strict registration policies.
Only Omani entities may register .om domains today, and only third-level domains (such as example.com.om and example.net.om) may be registered. Domains may not be resold.
I have no particular reason to believe this situation will change under new stewardship, but it will certainly be worth keeping an eye on the TLD for possible policy changes.
When Cameroon’s .cm opened up, it implemented a widely vilified blanket wildcard in an attempt to profit from .com typos.
Colombia’s .co of course took the responsible route, disowning wildcards and embracing strong anti-squatting measures, even if its mere existence was still a headache for some trademark owners.

ICANN fights government gTLD power grab

ICANN has opposed a US move to grant governments veto power over controversial new top-level domain applications.
Cutting to the very heart of Obama administration internet governance policy, ICANN has told the National Telecommunications and Information Administration that its recent proposals would “undermine the very principle of the multi-stakeholder model”.
The stern words came in ICANN’s response to the NTIA’s publication of revisions to the IANA contract, the contract that allows ICANN to retain its powers over the domain name system root.
The NTIA’s Further Notice Of Inquiry contained proposed amendments to the contract, including this:

For delegation requests for new generic TLDS (gTLDs), the Contractor [ICANN] shall include documentation to demonstrate how the proposed string has received consensus support from relevant stakeholders and is supported by the global public interest.

This was widely interpreted as a US attempt to avoid a repeat of the .xxx scandal, when ICANN approved the porn gTLD despite the unease voiced by its Governmental Advisory Committee.
As I noted in June, it sounds a lot like code for “if the GAC objects, you must reject”, which runs the risk of granting veto powers to the GAC’s already opaque consensus-making process.
In his response to the FNOI (pdf), ICANN chief Rod Beckstrom says that the NTIA’s proposal would “replace” the “intensive multi-stakeholder deliberation” that created the newly approved Applicant Guidebook.
He also pointed out the logical inconsistency of asking IANA to remain policy-neutral in one part of the proposed contract, and asking it to make serious policy decisions in another:

The IANA functions contract should not be used to rewrite the policy and implementation process adopted through the bottom-up decision-making process. Not only would this undermine the very principle of the multi-stakeholder model, it would be inconsistent with the objective of more clearly distinguishing policy development from operational implementation by the IANA functions operator.

NTIA head Larry Strickling has been pounding the “multistakeholderism” drum loudly of late, most recently in a speech in Washington and in an interview with Kieren McCarthy of .nxt.
In the .nxt interview, Strickling was quite clear that he believes ICANN should give extra authority to governments when it comes to approving controversial strings.
The NTIA concern – shared by other government entities including the European Commission – is that controversial strings could lead to national blocking and potentially internet fragmentation.
While Strickling declined to comment on the specific provisions of the IANA contract, he did tell .nxt:

If the GAC as a consensus view can’t support a string then my view is that the ICANN Board should not approve the string as to do so in effect legitimizes or sanctions that governments should be blocking at the root zone level. And I think that is bad for the Internet.
Where you’re dealing with sensitive strings, where you’ve engaged the sovereignty of nations, I think it is appropriate to tip the hat a little bit more to governments and listen to what they say. On technical issues it wouldn’t be appropriate but on this particular one, you’ve got to listen a little bit more to governments.

He also indicated that the US would not necessarily stand up for its principles if confronted by substantial objections to a string from other governments:

So we would be influenced – I can’t say it would be dispositive – if a large number of countries have a problem with a particular string, even if it was one that might not be objectionable to the United States government.
And that is out of interest of protecting the Internet’s root from widespread blocking at the top-level by lots of governments.

Does this mean that the US could agree to a consensus GAC objection to a .gay gTLD? A .porn? A .freespeech? It certainly sounds like it.

Olympics make more new gTLD demands

The International Olympic Committee, fresh from its big win at ICANN Singapore, is pushing for more special protections in the new top-level domains program.
ICANN only approved the new gTLD program last month with the proviso that Olympic and Red Cross strings – .redcross and .olympic for example – would be banned as gTLDs in the first round.
The decision was a pretty obvious piece of political bone-throwing to the Governmental Advisory Committee, which had backed the IOC’s cause.
Now the IOC wants to ensure ICANN will ban .olympic and .olympiad in eight additional languages, including four non-Latin scripts, as well as “confusingly similar” strings such as .olympics.
I expect ICANN will probably grant this concession, even though the idea that somebody other than the IOC could successfully apply for .olympics under existing rules has always been ludicrous.
The IOC has probably already spent just as much money lobbying for these changes as it would have cost to file a slam-dunk legal rights objection, as already allowed by the Guidebook.
And that would only have been necessary, of course, in the vanishingly improbable scenario where somebody was stupid enough to pay $185,000 to apply for .olympics in the first place.
But the IOC now also wants all of its brands banned at the second level in all new gTLDs. This seems like a bigger ask, given that ICANN resolved to protect the Olympic marks “for the top level only”.
In a July 1 letter to ICANN (pdf), published today, an IOC lawyer includes suggested text for the Applicant Guidebook, to be included in the default registry agreement, stating:

In recognition of legislative and treaty protection for the Olympic designations, the labels “OLYMPIC” and “OLYMPIAD” shall be initially reserved at the second level. The reservation of an Olympic designation label string shall be released to the extent Registry Operator reaches agreement with the International Olympic Committee.

This would give the Olympic brand as much protection as country names at the second level.
The problem with this, of course, is that it sets the precedent for a specially protected marks list, which ICANN has resisted and which the GAC specifically has not asked for.
It’s a problem ICANN has arguably brought on itself, of course, given that it already specially protects “icann”, “iana” and a number of other strings on spurious technical stability grounds.

CNN asks: Will .xxx domains cost $185,000?

If you’ve ever doubted what a rarefied world we work in, check out this new CNN interview with ICM Registry, which confusingly conflates .xxx with ICANN’s new top-level domains program.
Anchor Pauline Chiou uses the approval of new gTLD program as a segue into a brief interview with ICM president Stuart Lawley about the forthcoming .xxx sunrise period.
“If they want to apply for this one-time block do they have to pay this $185,000?” she asks
She goes on to press Lawley into launching a defense of ICANN’s program that I doubt he was expecting.

You’ll notice that Chiou also refers to ICANN as the “Internet Corporation for Assigned Names” and flatteringly describes it as “the group that oversees the development of the internet”.
For a casual viewer, it would be fairly easy to come away from this interview assuming Lawley works for ICANN, and that .xxx domains could cost $185,000.

Why we won’t see dotless domain names

Will http://google ever work?
Will any of the hundreds of .brand gTLDs expected to be approved by ICANN in its first round of new top-level domains resolve without dots?
Will users be able to simply type in the name of the brand they’re looking for into their browser’s address bar and have it resolve to the company’s official site?
Probably not, according to the experts.
ICANN’s Applicant Guidebook answers this question, but you need to know where to look, and to know a little about DNS records, to figure it out what it actually says.
Section 2.2.3.3 of the Guidebook (page 75 of the May 30 PDF) provides a list of the permissible contents of a new gTLD zone.
Specifically not allowed are A and AAAA records, which browsers need in order to find web sites using IPv4 and IPv6 respectively.
“To facilitate a dotless domain, you would need to place an A or a AAAA record in the zone, and these are not on the list of permitted record types,” said Kim Davies, root zone manager at IANA. “The net result is a default prohibition on dotless domains.”
Applicants may be able to obtain A/AAAA records if they specifically ask for them, but this is very likely to trigger an Extended Evaluation and a Registry Services Review, according to Davies and the Guidebook.
There’s an additional $50,000 fee for a Registry Services Review, with no guarantee of success. It will also add potentially months to the application’s processing time.
(Incidentally, ICANN has also banned DNS “wildcards”. You cannot have an infinite SiteFinder-style catch-all at the second level, you need to allocate domain names individually.)
Applicants that successfully obtain A/AAAA records, enabling dotless domains, would face a far greater problem than ICANN’s rules – endpoint software probably won’t support them.
“As it stands, most common software does not support the concept,” Davies said. “There is a common assumption that fully qualified domain names will have at least one dot in them.”
You can type IP addresses, host names, domain names or search terms into browser address bars, and dots are one of the ways the software figures out you’re looking for a domain.
You can test this today. There are already a handful of top-level domains, probably fewer than 20 and all ccTLDs, that have implemented an A record at the TLD level.
On some platforms, you may be able to get URLs such as http://io and http://ac to work.
They don’t revolve on any Windows 7 browser I’ve tested (Firefox/IE/Chrome), but I’d be interested in hearing your experiences, if you’d be so good as to leave a comment below.
Given the lack of software support, it may be a poor use of time and resources to fight ICANN for a dotless gTLD that most internet users won’t even be able to resolve.
According to a recent CircleID article by Paul Vixie, chairman of the Internet Systems Consortium, many browsers treat domains without dots as local resources.
Only if the browser’s “DNS search list” cannot find a local resource matching the dotless TLD will it then go out to the internet to look for it.
In some organizations, a local resource may have been configured which matches a new gTLD. There may be a local server called “mail” for example, which could clash with a .mail gTLD.
A recent article in The Register quoted security people fretting about what would happen if a malicious hacker somehow persuaded ICANN to approve a string such as .localhost or .lan.
These worries appear to be largely reliant on an erroneous belief that getting your hands on a gTLD is going to be as simple as registering a domain name.
In reality, there’s going to be months of technical evaluation – conducted in a fish-bowl, subject to public comment, applicant background checks and, in the case of a request for A records, the aforementioned Registry Services Review – before a gTLD is approved.
If everything works according to plan, security problems will be highlighted by this process and any gTLDs that would break the internet will be caught and rejected.
So it seems very unlikely that we’re going to see domains without dots hitting the web any time soon.
Domain names are designed to help people find you. Dotless domains today will not do that, even if ICANN does approve them.

Legal fight breaks out over .pr domains

The University of Puerto Rico has accused the manager of the .pr top-level domain of hoodwinking ICANN in order to “illegally” take over the registry.
It recently filed a lawsuit seeking to regain control of .pr, saying that the current registry operator has made an estimated $2 million from domain registrations since it somehow took over the ccTLD.
The lawsuit and other documents tell a remarkable story, one in which a University department quietly spun itself out as a private for-profit company and took .pr with it.
If the claims are true, ICANN may have made a huge screw-up by inadvertantly allowing the ccTLD to be transferred from the University into private hands.
According to an archived copy of the IANA delegation record for .pr, the ccTLD was from 1988 until about 2007 delegated to:

University of Puerto Rico
Gauss Laboratory
Facundo Bueso Building
Office 265
Rio Piedras 00931
Puerto Rico

That’s the Sponsoring Organization. The administrative and technical contacts also stated that UPR was in charge of the domain. The contact email address was @uprr.pr, the University’s domain.
Today, the IANA record is quite different:

Gauss Research Laboratory Inc.
Calle Vesta 801
San Juan 00923
Puerto Rico

The University is no longer listed. The contact email addresses are now @nic.pr. These new details have been in effect apparently since some time in 2007.
To my eye, this looks like the stewardship of .pr was transferred from one organization, the University of Puerto Rico, to another, Gauss Research Laboratory Inc.
But IANA never produced a redelegation report – as it must when a registry changes hands – and the ICANN board never voted to redelegate.
According to a July 2007 letter (pdf) circulating this week from David Conrad, who was then IANA general manager at ICANN, the changes merely reflected a “structural reorganization” of the registry:

Since the underlying organization performing registry services for .PR did not change (it was Gauss Laboratory before and after the change), this is not considered a full redelegation, and therefore does not result in a public report with board approval.

But the University claims that long-time manager Oscar Moreno set up Gauss as a non-profit organization to handle .pr when he retired from UPR, then in 2007 changed it to the for-profit corporation that is now the designated registry manager.
A 2009 letter from UPR to ICANN general counsel John Jeffrey (pdf), which emerged on mailing lists last week, said Moreno was trying to sell his company, and the ccTLD, to a third party.
IANA, according to the letter, was fooled into thinking the University backed the transfer of control due to a letter from a faculty member who did not have the authority to authorize the changes.
The University sued Moreno in late May (pdf), seeking an injunction ordering him to transfer .pr back to UPR and to return the $2 million it believes .pr domain sales have raised since 2007.
IANA redelegations are rarely straightforward.
A recent report from the Country Code Names Supporting Organization found that ccTLD redelegations have been basically a bloody mess – unpredictable, opaque and poorly documented.
ICANN does not discuss IANA requests, but I’m currently aware of a handful of ongoing redelegation battles, such as those over Niue’s .nu and Rwanda’s .rw.
It is suspected that Irish operator IEDR is currently trying to have .ie taken away from its nominal sponsor, University College Ireland, which has put the fear into at least one registrar.

Former ICANN chair joins M+M

Peter Dengate Thrush, the former ICANN chairman who pushed through approval of the new top-level domains program less than a month ago, is to join new gTLD firm Minds + Machines.
He has become executive chairman of Top Level Domain Holdings, M+M’s parent company, which is listed on the Alternative Investment Market.
The hire will undoubtedly boost M+M’s credibility and raise its profile, but is already also raising eyebrows.
TLDH plans to apply to ICANN for potentially dozens of new gTLD contracts next year, both with partners and customers and on its own.
Dengate Thrush has been granted options to buy 15 million TLDH shares for 8p each, roughly the same as its current price, which he can exercise at a rate of 1.25 million per quarter through July 2014.
TLDH currently has no revenue to speak of. Its future share price will depend on its ability to sign registry services customers and win new gTLDs through the ICANN process.
It’s fairly easy to extrapolate scenarios where Dengate Thrush’s compensation package is worth millions.
His chairmanship of ICANN’s board of directors came to an end June 24, just a few days after it voted to approve the new gTLD program.
During that vote, dissenting director Mike Silber accused the board of voting too soon, saying it was being hurried by “ego-driven deadlines”.
This was a reference to Dengate Thrush and fellow new gTLD cheerleader Rita Rodin Johnston, both of whom were due to see their terms on the board expire that week.
Dengate Thrush is the first ICANN chair to take a high-paying domain name industry job following his time with ICANN.
His predecessor, Vint Cerf, joined Google. Earlier, Esther Dyson went on to invest in and work with a number of technology start-ups.
ICANN does not have a policy preventing former employees or directors taking lucrative jobs working for the companies that they were previously essentially regulating.
Indeed, some of its directors currently work for such companies.
Few in the ICANN community doubted that Dengate Thrush, an IP lawyer by trade, would join a new gTLD company. The question was which one.
I asked him, along with CEO Rod Beckstrom and senior VP Kurt Pritz, at a press conference in Singapore, whether they would be prevented from joining a new gTLD firm.
The answer, basically, was: “No.”
ICANN staff and board sign confidentiality agreements that prevent them taking secrets into future employers, but there’s nothing to prevent a “revolving door” between industry and regulator.
There have already been calls from parts of the ICANN community to create a new ethics policy, after senior registry liaison Craig Schwartz left to join the VeriSign-backed .bank project.
GNSO Council chair Stephane Van Gelder of the French registrar Indom suggested in a blog post this morning that ICANN should consider hiring independent directors and barring them from working in the industry for a year after their terms end.
It would be pretty difficult to enforce such a rule on the board as it is currently made up, given that it draws some of its members, by design, from the domain name industry.
ICANN’s new vice chair Bruce Tonkin works for Melbourne IT, a registrar, for example. He recused himself from the new gTLD vote because of this conflict of interest.
It would be silly for ICANN to ban him from working for Melbourne IT after his term expires if he’s allowed to work there during the term itself.
While no rules appear to have been broken, M+M’s new hire may sit uncomfortably with some.
It will certainly reinforce beliefs, where they are held, that the new gTLD program is largely a money-grabbing exercise by the domain industry.

Last chance to tell ICANN how to plug new gTLDs

“How Do We Raise Global Awareness of New gTLDs?”
ICANN asked that question a month ago and tomorrow is your last chance to respond to the public comment period it set up to gather suggestions.
So far, the number of responses is in the single figures.
I quite like Danny Younger’s suggestion: “It might be wise for a communications plan to include a warning to the general public about misleading ‘pre-registration’ schemes.”
A press release containing such a warning would almost certainly gather headlines – hacks love a bit of conflict – but it could also risk making the new gTLD process look a bit slapdash.
Easily the most laughable suggestion filed with ICANN so far comes from 4U Systems:

I would like to offer the use of .4U.com in your campaign. For example, New-gTLDs.4U.com, Domains.4U.com,Internet-Innovations.4U.com, new-domains.4U.com, Internet-expansions.4U.com, ICANN-applications.4U.com, TLD-launch.4U.com, ICANN-facts.4U.com, podcasts.4U.com, social-media.4U.com…the possibilities are limitless… the avenues to the information, countless. Therefore, we would like to talk further about how we may assist in the gTLD campaign with 4U.

Has any reader ever encountered a more fundamentally badly judged or desperation-smacking piece of business development outreach?