August 2008 - At-Large - lists.icann.org

Registrar Accreditation Agreement Revistions
by Alan Greenberg Aug. 6, 2008

Aug. 6, 2008

The comment period for the RAA revisions closed on Aug 4. All comments can be seen at http://forum.icann.org/lists/raa-consultation/ There are some very thoughtful and relevant contributions. In specific, I draw your attention to one by the US Dept. of Commerce at http://forum.icann.org/lists/raa-consultation/msg00061.html. Note that for some unknown reason, some of the attachments have had their filetype changes from .doc or .pdf to .bin, so it may take some extra effort to open them. They seem safe to open if you use the correct application program. Alan

1 0

Re: [At-Large] Rogue pharmacy sites -- outrageous
by Danny Younger Aug. 6, 2008

Aug. 6, 2008

Re: What provisions in the revised RAA address this sort of issue from a consumer perspective? The provisions are not in the revised RAA, but rather in the orginal RAA: 3.7.8 In the event Registrar learns of inaccurate contact information associated with a Registered Name it sponsors, it shall take reasonable steps to correct that inaccuracy. This is an enforcement issue under the current contract. The report indicates that registrars were notified through the WDRPS of inaccuracies, that registrars investigated the claim of inaccuracy and elected to suspend the domain names, that they then notified ICANN of their enforcement action, and thereafter made the decision to lift the domain suspension without the inaccuracy having been corrected. If this report is correct, I am of the view that such action, a failure to take reasonable steps to actually correct the inaccuracy, constitutes a material breach of contract. Let's see whether ICANN will take action under its contract, or if it will continue to coddle its registrars.

1 0

More Registrar Malfeasance Reported
by Danny Younger Aug. 6, 2008

Aug. 6, 2008

KnujOn has found at least 19 rogue pharmacy domains, sponsored through DIRECT INFORMATION PVT LTD D/B/A PUBLICDOMAINREGISTRY.COM (PDR) back in operation with the same content and at the same nameserver after being reported to ICANN by the Registrar as “suspended.” The nameserver is also sponsored by PDR and is itself an unlicensed pharmacy site. This is an example of a practice we have seen all too frequently where Internet companies will remove sites temporarily for reported policy violations only to restore them shortly afterwards. DIRECT INFO/PDR was rated the 9th Worst Registrar by KnujOn in terms of sponsoring spam sites previously. Clearly the consumer is not being protected by the current system. Full report here: http://www.knujon.com/news.html#08052008

1 0

ICANN disaster recover according to eWeek
by Evan Leibovitch Aug. 6, 2008

Aug. 6, 2008

FYI: http://www.eweek.com/c/a/Security/ICANN-Plans-For-Disaster-A-Registry-Failu… - Evan

1 0

Re: [At-Large] [ga] What are ICANN and VeriSign doing regarding CERT Advisory #800113 / DNS Cache Poisoning?
by Jeffrey A. Williams Aug. 6, 2008

Aug. 6, 2008

Joe and all, First, IMO, Joe is correct that DNSSEC will not save or fix any problems that are software related to DNS/BIND or client interfaces that are OS specific but were based upon what was known about Bind at the time of their creation. Second, Burnsteins DNS/BIND is only ONE version of DNS/BIND that is very secure. Our BindPlus is also very secure as well, no reported security problems reported in 49 months, and never a serious security hole found or reported sense it's release. Third, I respectfully disagree that ICANN can't do anything. They could have done allot over 6 years ago, and scoffed at anyone other than Paul Vixies Bind 8 at that time. That was a mistake, and many knew it but were silent publically. Forth, Joe is right, that with a little software Eng. forsight and expermintation most of the DNS/BIND security Holes are fixable and customizably so. What is missing is that there are very few GOOD software Eng., and even fewer that have an in depth understanding of DNS. Fifth, it is huge security problems like this that are bound to occur as long as social Eng. are making software decisions or managment decisions that are grounded in security and/or software. That's a leadership problem, and in this instance it is a ICANN leadership problem. Joe Baptista wrote: > > > On Wed, Aug 6, 2008 at 10:46 PM, George Kirikos <gkirikos(a)yahoo.com> > wrote: > > > Hello, > > Just to followup, ICANN sent out a news release earlier: > > http://www.icann.org/en/announcements/announcement-06aug > 8-en.htm > > It's a step in the right direction, to help educate folks. > However, > there's no true "fix", as the protocol itself is broken. A > move towards > DNSSEC or other secure DNS would be the only appropriate > long-term > solution. > > > There is nothing wrong with the protocol. Its the software thats the > issue. And this is easy to fix. I've run some tests and with a > little DNS magic you can make you DNS very secure. > > Another big help would be to update your software including any NAT > devices. > > The whole DNSSEC thing is another red herring in the making. > > Also there is nothing ICANN nor anyone else can do about this. The > world is running a lot of insecure servers. BIND has always been > buggy and true to form it will continue to be buggy. Have you any > idea how many buggy systems are out there. i.e. almost all of them. > Unless of course your running burnsteins DNS which already fixed this > problem a long time ago. > > It bother me that people who have no idea what the technical issues > are get so easily baited by this issue. George - let go the ICANN red > herring. Its just another smoke screen. > > The real issue here is what sort of out reach programs is ICANN > involved in to get people to upgrade and fix their buggy dns servers. > DNSSEC is not going to save them. > > cheers > joe baptista > > > > > If there's ever a cyber 9/11, as Lessig discussed at: > > http://news.slashdot.org/article.pl?sid=08/08/05/220229 > > widespread DNS cache poisoning might be one of the root > causes. > > I'd like to hear from VeriSign as to whether they're > planning to > implement DNSSEC or a secure DNS alternative for .com/net, > as PIR > intends for .org. > > Sincerely, > > George Kirikos > http://www.kirikos.com/ > > --- George Kirikos <gkirikos(a)yahoo.com> wrote: > > > > > Hello, > > > > ICANN and VeriSign have been oddly quiet over the entire > DNS cache > > poisoning issue: > > > > http://www.kb.cert.org/vuls/id/800113 > > > http://www.circleid.com/posts/87143_dns_not_a_guessing_game/ > > > > http://it.slashdot.org/article.pl?sid=08/07/08/195225&tid=172 > > > > > PIR has a pending proposal to implement DNSSEC for .org: > > > > http://www.icann.org/registries/rsep/ > > > > Is that something that VeriSign has plans to accelerate > for the > > important .com and .net registries, in order to prevent a > long-term > > meltdown in DNS confidence/trust should DNS cache > poisoning become > > widespread in August and beyond? > > > > No need for a "formal" press release, but I think the > community > > deserves to know that people are working on the long-term > solution to > > this problem, and making it a higher priority relative to > other > > lesser > > issues. > > > > Point #14 in the latest policy newsletter appears to be > the only > > "hint" > > that a few people are working on things: > > > > http://www.icann.org/topics/policy/update-jul08.htm#14 > > > > Hopefully something will happen before Cairo, as by then > there might > > be > > widespread disruptions to the internet. Perhaps the Board > might want > > to > > consider an early special meeting this week or next: > > > > http://www.icann.org/minutes/ > > > > instead of waiting until July 31st, in conjunction with > the SSAC. > > > > Sincerely, > > > > George Kirikos > > http://www.kirikos.com/ > > > > > > -- > Joe Baptista > www.publicroot.org > PublicRoot Consortium > ---------------------------------------------------------------- > The future of the Internet is Open, Transparent, Inclusive, > Representative & Accountable to the Internet community @large. > ---------------------------------------------------------------- > Office: +1 (360) 526-6077 (extension 052) > Fax: +1 (509) 479-0084 > > Regards, Spokesman for INEGroup LLA. - (Over 281k members/stakeholders strong!) "Obedience of the law is the greatest freedom" - Abraham Lincoln "Credit should go with the performance of duty and not with what is very often the accident of glory" - Theodore Roosevelt "If the probability be called P; the injury, L; and the burden, B; liability depends upon whether B is less than L multiplied by P: i.e., whether B is less than PL." United States v. Carroll Towing (159 F.2d 169 [2d Cir. 1947] =============================================================== Updated 1/26/04 CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. div. of Information Network Eng. INEG. INC. ABA member in good standing member ID 01257402 E-Mail jwkckid1(a)ix.netcom.com My Phone: 214-244-4827

1 0

Re: [At-Large] [ga] What are ICANN and VeriSign doing regarding CERT Advisory #800113 / DNS Cache Poisoning?
by Jeffrey A. Williams Aug. 6, 2008

Aug. 6, 2008

George and all, Well yes this is a move in the right direction. But it is far too little and perhaps far too late as we have seen with Apple. See: See: (August 1, 2008) Apple released a patch for the recently disclosed and exploited DNS vulnerability, but while it fixes Mac OS X systems used as DNS servers, it does not protect Macs being used as client systems. Fully patched versions of both Tiger (version 10.4.11) and Leopard (version 10.5.4) do not adequately randomize DNS source ports. Apple released Security Update 2008-005 on Thursday, July 31 to address 17 flaws in its OS X operating system. - From Internet Storm Center: http://isc.sans.org/diary.html?storyid=4810 A quick packet dump of my fully patched Leopard machine (OS X 10.5.4) shows it is - as a DNS client - still using incrementing ports. http://www.theregister.co.uk/2008/08/01/osx_still_vulnerable/print.html http://www.informationweek.com/news/hardware/mac/showArticle.jhtml?articleI… http://www.computerworld.com/action/article.do?command=viewArticleBasic&art… Secondly, it wasn't Dan k. that origanally made note of this and many other DNS security holes that can expose users to serious danger. That was done back in 2001 on the old DNSO GA mailing list. George Kirikos wrote: > Hello, > > Just to followup, ICANN sent out a news release earlier: > > http://www.icann.org/en/announcements/announcement-06aug08-en.htm > > It's a step in the right direction, to help educate folks. However, > there's no true "fix", as the protocol itself is broken. A move towards > DNSSEC or other secure DNS would be the only appropriate long-term > solution. > > If there's ever a cyber 9/11, as Lessig discussed at: > > http://news.slashdot.org/article.pl?sid=08/08/05/220229 > > widespread DNS cache poisoning might be one of the root causes. > > I'd like to hear from VeriSign as to whether they're planning to > implement DNSSEC or a secure DNS alternative for .com/net, as PIR > intends for .org. > > Sincerely, > > George Kirikos > http://www.kirikos.com/ > > --- George Kirikos <gkirikos(a)yahoo.com> wrote: > > > > > Hello, > > > > ICANN and VeriSign have been oddly quiet over the entire DNS cache > > poisoning issue: > > > > http://www.kb.cert.org/vuls/id/800113 > > http://www.circleid.com/posts/87143_dns_not_a_guessing_game/ > > http://it.slashdot.org/article.pl?sid=08/07/08/195225&tid=172 > > > > PIR has a pending proposal to implement DNSSEC for .org: > > > > http://www.icann.org/registries/rsep/ > > > > Is that something that VeriSign has plans to accelerate for the > > important .com and .net registries, in order to prevent a long-term > > meltdown in DNS confidence/trust should DNS cache poisoning become > > widespread in August and beyond? > > > > No need for a "formal" press release, but I think the community > > deserves to know that people are working on the long-term solution to > > this problem, and making it a higher priority relative to other > > lesser > > issues. > > > > Point #14 in the latest policy newsletter appears to be the only > > "hint" > > that a few people are working on things: > > > > http://www.icann.org/topics/policy/update-jul08.htm#14 > > > > Hopefully something will happen before Cairo, as by then there might > > be > > widespread disruptions to the internet. Perhaps the Board might want > > to > > consider an early special meeting this week or next: > > > > http://www.icann.org/minutes/ > > > > instead of waiting until July 31st, in conjunction with the SSAC. > > > > Sincerely, > > > > George Kirikos > > http://www.kirikos.com/ Regards, Spokesman for INEGroup LLA. - (Over 281k members/stakeholders strong!) "Obedience of the law is the greatest freedom" - Abraham Lincoln "Credit should go with the performance of duty and not with what is very often the accident of glory" - Theodore Roosevelt "If the probability be called P; the injury, L; and the burden, B; liability depends upon whether B is less than L multiplied by P: i.e., whether B is less than PL." United States v. Carroll Towing (159 F.2d 169 [2d Cir. 1947] =============================================================== Updated 1/26/04 CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. div. of Information Network Eng. INEG. INC. ABA member in good standing member ID 01257402 E-Mail jwkckid1(a)ix.netcom.com My Phone: 214-244-4827

1 0

Rogue pharmacy sites -- outrageous
by Brendler, Beau Aug. 6, 2008

Aug. 6, 2008

http://www.knujon.com/news.html#08052008 This was passed on to me by a friend at Berkman affiliated with the StopBadware.org project (http://www.stopbadware.org) From the text: "This is an example of a practice we have seen all too frequently where Internet companies will remove sites temporarily for reported policy violations only to restore them shortly afterwards. In some cases the domains move from one Registrar to another (occasionally two Registrars with the same parent company, however), but this is a situation where the domains went right back where they were before. DIRECT INFO/PUBLICDOMAINREGISTRY was rated the 9th Worst Registrar in terms of sponsoring spam sites previously." What provisions in the revised RAA address this sort of issue from a consumer perspective? Or is this considered "outside ICANN's scope"? **************************************************************************** ******** SCANNED **************************************************************************** ********

2 1

Rights & Responsibilities
by Danny Younger Aug. 6, 2008

Aug. 6, 2008

Cheryl, Last year, the ALAC issued a Statement (1) on the RAA revisions. The Statement called for "a clause in the RAA to require registrars to show a standardized description of registrant rights". The proposed amendments to the RAA have acknowledged that request (2): "3.15 In the event that ICANN gives reasonable notice to Registrar that ICANN has published a webpage that identifies available registrant rights and responsibilities, and the content of such webpage is developed in consultation with registrars, Registrar shall provide a link to the webpage on any website it may operate for domain name registration or renewal clearly displayed to its Registered Name Holders at least as clearly as its links to policies or notifications required to be displayed under ICANN Consensus Policies." When can we expect the ALAC to start working on a Registrant Rights & Responsibilities draft? It was, after all, the ALAC's recommendation. The follow-up obligation is indeed yours. (1) http://www.alac.icann.org/correspondence/alac-raa-revision-statement-13sep0… (2) http://www.icann.org/en/topics/raa/redline-2001-raa-18jun08.pdf

2 1

[Fwd: [Fwd 9th false reason given to: Request to mailing list At-Large rejected]]
by Jeffrey A. Williams Aug. 6, 2008

Aug. 6, 2008

-------- Original Message -------- Subject: [Fwd 9th false reason given to: Request to mailing list At-Large rejected] Date: Tue, 05 Aug 2008 20:16:44 -0700 From: "Jeffrey A. Williams" <jwkckid1(a)ix.netcom.com> Organization: IDNS and Spokesman for INEGroup To: "matthias.langenegger(a)icann.org" <matthias.langenegger(a)icann.org>,Nick Ashton-Hart <nick.ashton-hart(a)icann.org>,at-large-owner(a)atlarge-lists.icann.org,Cheryl Langdon-Orr <cheryl(a)hovtek.com.au> CC: GAC Rep <ssene(a)ntia.doc.gov>,DOC/NTIA ICANN Rep <aheineman(a)ntia.doc.gov> Mattias and all, Yet again this is a false reason given. There were only 4 recipients which last I checked is less than 5, which is the max number of recipients according to Nicks most recent announcment. -------- Original Message -------- Subject: Request to mailing list At-Large rejected Date: Wed, 06 Aug 2008 08:09:11 -0400 From: at-large-bounces(a)atlarge-lists.icann.org To: jwkckid1(a)ix.netcom.com Your request to the At-Large mailing list Posting of your message titled "How to carjack a top Google exec, according to Google" has been rejected by the list moderator. The moderator gave the following reason for rejecting your request: "Too many recipients to the message" Any questions or comments should be directed to the list administrator at: at-large-owner(a)atlarge-lists.icann.org Regards, Spokesman for INEGroup LLA. - (Over 281k members/stakeholders strong!) "Obedience of the law is the greatest freedom" - Abraham Lincoln "Credit should go with the performance of duty and not with what is very often the accident of glory" - Theodore Roosevelt "If the probability be called P; the injury, L; and the burden, B; liability depends upon whether B is less than L multiplied by P: i.e., whether B is less than PL." United States v. Carroll Towing (159 F.2d 169 [2d Cir. 1947] =============================================================== Updated 1/26/04 CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. div. of Information Network Eng. INEG. INC. ABA member in good standing member ID 01257402 E-Mail jwkckid1(a)ix.netcom.com My Phone: 214-244-4827

1 0

Resend of:Apple DNS Patch Doesn't Fix Client Versions of OS X
by Jeffrey A. Williams Aug. 6, 2008

Aug. 6, 2008

All, Sorry that the list moderator/admin. has trouble counting to 5. So I have resent the below Email... Yet another too soon.knee jerk claim by Apple. See: (August 1, 2008) Apple released a patch for the recently disclosed and exploited DNS vulnerability, but while it fixes Mac OS X systems used as DNS servers, it does not protect Macs being used as client systems. Fully patched versions of both Tiger (version 10.4.11) and Leopard (version 10.5.4) do not adequately randomize DNS source ports. Apple released Security Update 2008-005 on Thursday, July 31 to address 17 flaws in its OS X operating system. - From Internet Storm Center: http://isc.sans.org/diary.html?storyid=4810 A quick packet dump of my fully patched Leopard machine (OS X 10.5.4) shows it is - as a DNS client - still using incrementing ports. http://www.theregister.co.uk/2008/08/01/osx_still_vulnerable/print.html http://www.informationweek.com/news/hardware/mac/showArticle.jhtml?articleI… http://www.computerworld.com/action/article.do?command=viewArticleBasic&art… Regards, Spokesman for INEGroup LLA. - (Over 281k members/stakeholders strong!) "Obedience of the law is the greatest freedom" - Abraham Lincoln "Credit should go with the performance of duty and not with what is very often the accident of glory" - Theodore Roosevelt "If the probability be called P; the injury, L; and the burden, B; liability depends upon whether B is less than L multiplied by P: i.e., whether B is less than PL." United States v. Carroll Towing (159 F.2d 169 [2d Cir. 1947] =============================================================== Updated 1/26/04 CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. div. of Information Network Eng. INEG. INC. ABA member in good standing member ID 01257402 E-Mail jwkckid1(a)ix.netcom.com My Phone: 214-244-4827

1 0