Verisign says new gTLDs put millions at risk

Verisign has revived its old name collisions security scare story, publishing this week a weighty research paper claiming millions are at risk of man-in-the-middle attacks.
It’s actually a study into how a well-known type of attack, first documented in the 1990s, might become easier due to the expansion of the DNS at the top level.
According to the paper there might be as many as 238,000 instances per day of query traffic intended for private networks leaking to the public DNS, where attackers could potentially exploit it to all manner of genuinely nasty things.
But Verisign has seen no evidence of the vulnerability being used by bad guys yet and it might not be as scary as it first appears.
You can read the paper here (pdf), but I’ll attempt to summarize.
The problem concerns a virtually ubiquitous protocol called WPAD, for Web Proxy Auto-Discovery.
It’s used by mostly by Windows clients to automatically download a web proxy configuration file that tells their browser how to connect to the web.
Organizations host these files on their local networks. The WPAD protocol tries to find the file using DHCP first, but fails over to DNS.
So, your browser might look for a wpad.dat file on wpad.example.com, depending on what domain your computer belongs to, using DNS.
The vulnerability arises because companies often use previously undelegated TLDs — such as .prod or .global — on their internal networks. Their PCs could belong to domains ending in .corp, even though .corp isn’t real TLD in the DNS root.
When these devices are roaming outside of their local network, they will still attempt to use the DNS to find their WPAD file. And if the TLD their company uses internally has actually been delegated by ICANN, their WPAD requests “leak” to registry or registrant.
A malicious attacker could register a domain name in a TLD that matches the domain the target company uses internally, allowing him to intercept and respond to the WPAD request and setting himself up as the roaming laptop’s web proxy.
That would basically allow the attacker to do pretty much whatever he wanted to the victim’s browsing experience.
Verisign says it saw 20 million WPAD leaks hit its two root servers every single day when it collected its data, and estimates that 6.6 million users are affected.
The paper says that of the 738 new gTLDs it looked at, 65.7% of them saw some degree of WPAD query leakage.
The ones with the most leaks, in order, were .global, .ads, .group, .network, .dev, .office, .prod, .hsbc, .win, .world, .one, .sap and .site.
It’s potentially quite scary, but there are some mitigating factors.
First, the problem is not limited to new gTLDs.
Yesterday I talked to Matt Larson, ICANN’s new vice president of research (who held the same post at Verisign’s until a few years ago).
He said ICANN has seen the same problem with .int, which was delegated in 1988. ICANN runs one of .int’s authoritative name servers.
“We did a really quick look at 24 hours of traffic and saw a million and a half queries for domain names of the form wpad.something.int, and that’s just one name server out of several in a 24-hour period,” he said.
“This is not a new problem, and it’s not a problem that’s specific to new gTLDs,” he said.
According to Verisign’s paper, only 2.3% of the WPAD query leaks hitting its root servers were related to new gTLDs. That’s about 238,000 queries every day.
With such a small percentage, you might wonder why new gTLDs are being highlighted as a problem.
I think it’s because organizations typically won’t own the new gTLD domain name that matches their internal domain, something that would eliminate the risk of an attacker exploiting a leak.
Verisign’s report also has limited visibility into the actual degree of risk organizations are experiencing today.
Its research methodology by necessity was limited to observing leaked WPAD queries hitting its two root servers before the new gTLDs in question were delegated.
The company only collected relevant NXDOMAIN traffic to its two root servers — DNS queries with answers typically get resolved closer to the user in the DNS hierarchy — so it has no visibility to whether the same level of leaks happen post-delegation.
Well aware of the name collisions problem, largely due to Verisign’s 11th-hour epiphany on the subject, ICANN forces all new gTLD registries to wildcard their zones for 90 days after they go live.
All collision names are pointed to 127.0.53.53, a reserved IP address picked in order to catch the attention of network administrators (DNS uses TCP/IP port 53).
Potentially, at-risk organizations could have fixed their collision problems shortly after the colliding gTLD was delegated, reducing the global impact of the vulnerability.
There’s no good data showing how many networks were reconfigured due to name collisions in the new gTLD program, but some anecdotal evidence of admins telling Google to go fuck itself when .prod got delegated.
A December 2015 report from JAS Advisors, which came up with the 127.0.53.53 idea, said the effects of name collisions have been rather limited.
ICANN’s Larson echoed the advice put out by security watchdog US-CERT this week, which among other things urges admins to use proper domain names that they actually control on their internal networks.

1,000th new gTLD goes live

The 1,000th new gTLD from the 2012 application round was delegated yesterday.
It was either .shop or .realestate, appropriately enough, which both appear to have been added to the DNS root zone at about the same time.
Right now, there are actually only 999 new gTLDs live in the DNS. That’s because the unwanted .doosan was retired in February.
During its pre-launch planning for the new gTLD program, ICANN based its root zone stability planning on the assumption that fewer than 1,000 TLDs would be added to the root per year.
In reality, it’s taken much longer to reach that threshold. The first few new gTLDs were added in late October 2013, 945 days ago.
On average, in other words, a new gTLD has been added to the root slightly more than once per day.
Over that same period, nine ccTLDs — internationalized domain names applied for via a separate ICANN program — have also gone live.
The 1,000th new gTLD to be added to the IANA database was .blog.
There are 1,314 TLDs in the root all told.

M+M makes $3.2 million in five days from .vip

Minds + Machines has billed $3.2 million in .vip domain names sales after the first five days of operation, the company said this morning.
It’s already managed to pay off the cost of acquiring the domain at the September 2014 auction, which was $3.1 million.
Between 1600 UTC May 17, when .vip went to general availability, and the same time May 22, the gTLD racked up 203,720 domains, the company said.
The $3.2 million is a “billings” number, which will convert to accounting revenue over the lifetime of the domains.
For comparison, billings in the whole of 2015 was $7.9 million.
M+M now has over half a million domains under management, a 64% increase from the start of the year, the company said.
Registrations from China, where presumably owning a .vip name does not make you look like a douchebag, accounted for over 80% of the registrations. Almost half of its registrars are Chinese.
Major Chinese registrars are currently selling .vip names for CNY 25-26 (about $4) apiece.
The discrepancy between that low price and the $3.2 million (which implies an average wholesale price of about $16) is due to the effects of premiums, sunrise and multi-year registrations, CEO Toby Hall told DI.
M+M, like the vast majority of TLD registries, is not currently licensed in China, so these names will not legally be allowed to be developed into sites until the company has gone through the full governmental approval process.
Hall said in a press release:

The Chinese market for top-level domains is real and we are delighted to have accessed this key region through the .vip launch… It is a major milestone for the Company, the new management team and our business model centred on working with best-in-class partners across every aspect of our business so as to best monetize our assets while maintaining a tight control on central overheads. It demonstrates that, when properly executed, how quickly the initial investment costs for a domain can be recovered and the potential for a strong recurring revenue established. The .vip launch equally illustrates how as a b2b business we do not have to burn funds on marketing to reach end-consumers and achieve outstanding results.

He’s referring there primarily to M+M’s ongoing restructuring, which has seen the company ditch its registrar business in favor of a more heavily channel-focused approach.

Donuts quietly buys .shopping from Uniregistry (and .jetzt)

Just a few months after Uniregistry bought out Donuts to win .shopping, Donuts has bought the pre-launch gTLD back.
Donuts has also bought live gTLD .jetzt from a Swedish company.
The .shopping deal is a weird one.
Uniregistry and Donuts were the only two applicants for .shopping, until Uniregistry paid Donuts to withdraw its application back in January.
Uniregistry went on to sign its ICANN Registry Agreement in March, but less than a month later, April 27, transferred the contract to Donuts.
.shopping had been entangled in the .shop contention set, which was eventually resolved when GMO Registry paid $41.5 million at ICANN auction.
Despite the unusual circumstances, Uniregistry CEO Frank Schilling said today it was just the simple sale of a string. Donuts declined to comment. Neither revealed a price.
The second Donuts acquisition, closed April 26, was of .jetzt, which was applied for, delegated to and managed by New TLD Company AB of Sweden.
That gTLD, which is German for “.now”, has been in general availability for almost two years but has only 5,600 names in its zone file.
Donuts declined to comment, but it seems to me we’re looking at a failing gTLD looking for a white knight in this instance.

Nominet to run .blog’s back-end

Nominet is to run the back-end registry systems for .blog, the company announced this evening.
We reported earlier today that .blog has a surprise new owner — Knock Knock, Whois There, which belongs to Automattic, owner of WordPress.com — and it seems the change of ownership comes with a change of back-end.
Primer Nivel, the company that applied for .blog and just transferred the ICANN contract to Automattic, had named Malaysian also-ran Qinetics as its original back-end.
“Nominet will provide the registry services, as well as technical support to the registrar channel,” Nominet said tonight. The deal includes EPP and DNS.
Nominet’s press release confirms that registrants will not need a WordPress.com account to buy a .blog domain name.
It’s the second big back-end deal for Nominet in recent weeks. The company recently revealed it will be taking over technical services for all 28 of Minds + Machines new gTLDs.
Automattic/KKWT is predicting 250,000 .blog registrations in 2016, and general availability is not expected until the fourth quarter.

Radix joins the Hollywood content police

Radix has become the second major gTLD registry to announce a content policing deal with the movie industry.
It today said it has signed an agreement with the Motion Picture Association of America similar to the one Donuts announced in February.
Like Donuts, Radix will treat the MPAA as a “trusted notifier” for the purposes of taking down “large-scale pirate websites”.
Radix said the deal “imposes strict standards for such referrals, including that they be accompanied by evidence of clear and pervasive copyright infringement, and a representation that the MPAA has first attempted to contact the registrar and hosting provider for resolution.”
Donuts described its notifier program in this document (pdf). Radix said its arrangement is “similar”.
The Donuts-MPAA deal proved somewhat controversial.
The Electronic Frontier Foundation invoked the slippery slope argument, saying of it:

The danger in agreements like this is that they could become a blanket policy that Internet users cannot avoid. If what’s past is prologue, expect to see MPAA and other groups of powerful media companies touting the Donuts agreement as a new norm, and using it to push ICANN and governments towards making all domain name registries disable access to an entire website on a mere accusation of infringement.

The EFF said these kinds of deals could ultimately lead to legal freedom of speech being curtailed online.
We’re not quite there yet — right now we have two gTLD registries (albeit covering over 200 gTLDs) and one trusted notifier — but I expect more similar deals in future, branching out into different industries such as music and pharamaceuticals.
The deals stem in part from the Domain Name Association’s Healthy Domains Initiative, which aims to avoid ICANN/government regulation by creating voluntary best practices for the industry.
The advantage of a voluntary arrangement is that there’s no risk of a terminal sanction — such as losing your registry contract — if you fail to live up to its terms.
Radix’s portfolio includes .website, .space, .online and .tech. It’s also a .music and .web applicant.

WordPress reveals IT bought .blog for $19 million

WordPress.com owner Automattic has outed itself as the bankroll behind the winner of the .blog auction and the new owner of the forthcoming new gTLD.
Founder Matt Mullenweg also revealed that the company paid around $19 million for the domain at private auction in February 2015, about $1 million more than the amount DI estimated at the time.
Until now, the winning .blog applicant, which fought off competition from eight competitors including Google, M+M, Radix and Donuts, was only known as Primer Nivel.
Primer Nivel is a Panamanian company previously described to DI as an investment vehicle with links to Colombian registrar My.co.
To the best of my knowledge, Automattic’s involvement with the bid has never even been hinted at, but Automattic founder Matt Mullenweg said in a blog post last night that it has been involved since well before the auction took place.

It’s now public that Automattic is the company behind Knock Knock Whois There LLC, the registry for the new .blog TLD. (And a great pun.) We wanted to stay stealth while in the bidding process and afterward in order not to draw too much attention, but nonetheless the cost of the .blog auction got up there (people are estimating around $20M).

An earlier version of the blog post put the price at “about $19m”, as captured by Google.

ICANN approved the reassignment of the .blog contract from Primer Nivel to Knock Knock WHOIS There on April 29.
In the original Primer Nivel application, only My.co CEO Gerardo Aristizabal and VP of business development Carlos Neira were listed as shareholders of 15% or more of the company in its answer to question 11 of the application form.
ICANN processed a change request to the question 11 answer in March 2014, but did not publish the result of the change. It may merely have been a change of personal contact information.
One has to wonder whether, had WordPress’ involvement in Primer Nivel been public, the .blog auction could have fetched even more.
One might imagine that Google, which competes with WordPress with its Blogger service, would have viewed .blog as more threatening in a rival’s hands.
But Primer Nivel and now Automattic/KKWT appear to have no intention to make .blog a WordPress-exclusive gTLD. The original application stated that it would be open to all, and ICANN has since banned so-called “closed generics”.
The registry has already opened a web site at kkwt.domains, which is currently pitching the product to accredited registrars.
It says it plans to go to general availability and “activate” 250,000 .blog domains before the end of the year.
Automattic obtained an ICANN registrar accreditation back in October 2010 but to date has not sold a single domain via that accreditation.
It offers WordPress.com hosting customers domain registrations, but I believe it does so as a GoDaddy reseller.
.blog is currently in “transition to delegation” and it’s probably only a matter of days before it is delegated to the internet.
Mullenweg blogged that the sunrise period is expected to start in August, with and October landrush.
Pricing is expected to be in line with current industry standards, including premium tiers.
The gTLD has always been one of my favorites, and having WordPress backing it will almost certainly make it more successful than if the registry were an independent third party, possibly raising the profile of new gTLDs as a whole.

World’s first vanity gTLD goes live

Hong Kong billionaire Richard Li has become the first person to own a top-level domain matching his name.
The new gTLD .richardli went live on the internet today.
The registry is Pacific Century Asset Management (HK) Limited, a subsidiary of PCCW, the Hong Kong telecomms and internet giant of which Li is chair.
Forbes estimated Li’s personal wealth in 2015 at $4.7 billion, making him the 360th richest guy in the world.
The gTLD is a pure brand-protection play, according to the 2012 application, which states:

An important goal of the TLD is the safeguard of the intellectual property right of our Chairman’s name Richard Li.
…
The establishment of the .richardli TLD on the Internet safeguards our brand’s intellectual property right (in this case, our Chairman’s name Richard Li). PCCW has invested substantially in the online areas and will continue to do so.

There are no domains currently resolving in .richardli, though we should expect nic.richardli to start resolving in the coming days.
I believe .richardli was the only applied-for new gTLD that exactly matches a specific individual’s personal name.
A handful of gTLDs representing PCCW’s brands in Latin and Chinese scripts also went live today.

Rightside to modernize eNom, predicts $75m new gTLD revs

Rightside used its first quarter earnings call yesterday to address, albeit indirectly, some of the criticisms recently leveled at it by activist investors and competitors.
CEO Taryn Naidu revealed for the first time how the company sees the new gTLD market playing out in the longer term.
He said than in three to five years, Rightside expects annual revenue from its registry business to come it at $50 million to $75 million.
That’s a hell of a lot more than it makes today.
In the first quarter, registry revenue was $2.6 million, compared to $1.6 million a year ago. Annualized, that’s a shade over $10 million.
On the back of an envelope, Rightside seems to need roughly 50% growth per year over five years to hit the low end of its target.
Naidu told analysts that one factor built into this projection is that third-party registrars will start to sell just as many new gTLD domains as Rightside’s registrars do.
Currently, Rightside sees 15% to 20% new gTLD, but with others it’s 3% to 5%, he said.
Naidu said he expects margins to be 20% at the EBITDA level.
The revelation of these targets may go some way to address investor concerns that Rightside is putting too much effort into its new gTLD business at the expense of its cash-generating registrars.
J Carlo Cannell of Cannell Capital expressed these views and others in March, and was supported by fellow investor Frank Schilling, CEO of Uniregistry.
Naidu last night also addressed concerns about eNom, which Cannell had called a “time capsule” due to its aging user experience.
He admitted that eNom is “encumbered by some older technology” but said it was being fixed.
“Later this quarter we will be rolling out the first phase of our development efforts, which include a dramatically revamped user interface, a new suite of software development tools and a new developer hub to help our partners learn, develop and test faster,” he said.
The registrar business brought in $44 million in the quarter, up from $41.9 million. Aftermarket revenue was $9.3 million compared to $7.3 million.
Overall, revenue was up 9% at $55.1 million, with a net loss of $5.1 million. That compared to income of $1.9 million a year ago.
Naidu also seemed to obliquely address the criticism that a lot of Rightside’s new gTLDs are shit — .democrat, .dance, .army, .navy, and .airforce have been singled out by Cannell and others — by talking about how the company doesn’t necessarily put the same amount of effort into marketing its whole stable.
Some gTLDs will be marketed more heavily later, he said, comparing it to a real estate owner holding on to parcels of land for later development.
Naidu also talked up Rightside’s prospects in China, where apparently .pub is doing quite well because registrants think it means “public” rather than “drinking establishment”.

.flir becomes the 1,300th TLD

There are now 1,300 top-level domains live on the internet.
The milestone was hit today when the dot-brand .flir was delegated to FLIR Systems, a $1.5 billion-a-year thermal imaging systems manufacturer.
Its nic.flir domain is now live and currently redirects to existing sites in other TLDs.
According to the DI database, there are 292 ccTLDs, of which 45 are internationalized domain names.
There are 1,008 gTLDs of which 84 are IDNs; 985 were applied for in the 2012 new gTLD application round.
Of the gTLDs, 347 are dot-brands (defined as where the registry has signed Spec 9 and/or Spec 13 of the new gTLD Registry Agreement).