- At-Large - lists.icann.org

Re: [At-Large] [ga] What are ICANN and VeriSign doing regarding CERT Advisory #800113 / DNS Cache Poisoning?
by Jeffrey A. Williams Aug. 6, 2008

Aug. 6, 2008

George and all, Well yes this is a move in the right direction. But it is far too little and perhaps far too late as we have seen with Apple. See: See: (August 1, 2008) Apple released a patch for the recently disclosed and exploited DNS vulnerability, but while it fixes Mac OS X systems used as DNS servers, it does not protect Macs being used as client systems. Fully patched versions of both Tiger (version 10.4.11) and Leopard (version 10.5.4) do not adequately randomize DNS source ports. Apple released Security Update 2008-005 on Thursday, July 31 to address 17 flaws in its OS X operating system. - From Internet Storm Center: http://isc.sans.org/diary.html?storyid=4810 A quick packet dump of my fully patched Leopard machine (OS X 10.5.4) shows it is - as a DNS client - still using incrementing ports. http://www.theregister.co.uk/2008/08/01/osx_still_vulnerable/print.html http://www.informationweek.com/news/hardware/mac/showArticle.jhtml?articleI… http://www.computerworld.com/action/article.do?command=viewArticleBasic&art… Secondly, it wasn't Dan k. that origanally made note of this and many other DNS security holes that can expose users to serious danger. That was done back in 2001 on the old DNSO GA mailing list. George Kirikos wrote: > Hello, > > Just to followup, ICANN sent out a news release earlier: > > http://www.icann.org/en/announcements/announcement-06aug08-en.htm > > It's a step in the right direction, to help educate folks. However, > there's no true "fix", as the protocol itself is broken. A move towards > DNSSEC or other secure DNS would be the only appropriate long-term > solution. > > If there's ever a cyber 9/11, as Lessig discussed at: > > http://news.slashdot.org/article.pl?sid=08/08/05/220229 > > widespread DNS cache poisoning might be one of the root causes. > > I'd like to hear from VeriSign as to whether they're planning to > implement DNSSEC or a secure DNS alternative for .com/net, as PIR > intends for .org. > > Sincerely, > > George Kirikos > http://www.kirikos.com/ > > --- George Kirikos <gkirikos(a)yahoo.com> wrote: > > > > > Hello, > > > > ICANN and VeriSign have been oddly quiet over the entire DNS cache > > poisoning issue: > > > > http://www.kb.cert.org/vuls/id/800113 > > http://www.circleid.com/posts/87143_dns_not_a_guessing_game/ > > http://it.slashdot.org/article.pl?sid=08/07/08/195225&tid=172 > > > > PIR has a pending proposal to implement DNSSEC for .org: > > > > http://www.icann.org/registries/rsep/ > > > > Is that something that VeriSign has plans to accelerate for the > > important .com and .net registries, in order to prevent a long-term > > meltdown in DNS confidence/trust should DNS cache poisoning become > > widespread in August and beyond? > > > > No need for a "formal" press release, but I think the community > > deserves to know that people are working on the long-term solution to > > this problem, and making it a higher priority relative to other > > lesser > > issues. > > > > Point #14 in the latest policy newsletter appears to be the only > > "hint" > > that a few people are working on things: > > > > http://www.icann.org/topics/policy/update-jul08.htm#14 > > > > Hopefully something will happen before Cairo, as by then there might > > be > > widespread disruptions to the internet. Perhaps the Board might want > > to > > consider an early special meeting this week or next: > > > > http://www.icann.org/minutes/ > > > > instead of waiting until July 31st, in conjunction with the SSAC. > > > > Sincerely, > > > > George Kirikos > > http://www.kirikos.com/ Regards, Spokesman for INEGroup LLA. - (Over 281k members/stakeholders strong!) "Obedience of the law is the greatest freedom" - Abraham Lincoln "Credit should go with the performance of duty and not with what is very often the accident of glory" - Theodore Roosevelt "If the probability be called P; the injury, L; and the burden, B; liability depends upon whether B is less than L multiplied by P: i.e., whether B is less than PL." United States v. Carroll Towing (159 F.2d 169 [2d Cir. 1947] =============================================================== Updated 1/26/04 CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. div. of Information Network Eng. INEG. INC. ABA member in good standing member ID 01257402 E-Mail jwkckid1(a)ix.netcom.com My Phone: 214-244-4827

1 0

Rogue pharmacy sites -- outrageous
by Brendler, Beau Aug. 6, 2008

Aug. 6, 2008

http://www.knujon.com/news.html#08052008 This was passed on to me by a friend at Berkman affiliated with the StopBadware.org project (http://www.stopbadware.org) From the text: "This is an example of a practice we have seen all too frequently where Internet companies will remove sites temporarily for reported policy violations only to restore them shortly afterwards. In some cases the domains move from one Registrar to another (occasionally two Registrars with the same parent company, however), but this is a situation where the domains went right back where they were before. DIRECT INFO/PUBLICDOMAINREGISTRY was rated the 9th Worst Registrar in terms of sponsoring spam sites previously." What provisions in the revised RAA address this sort of issue from a consumer perspective? Or is this considered "outside ICANN's scope"? **************************************************************************** ******** SCANNED **************************************************************************** ********

2 1

Rights & Responsibilities
by Danny Younger Aug. 6, 2008

Aug. 6, 2008

Cheryl, Last year, the ALAC issued a Statement (1) on the RAA revisions. The Statement called for "a clause in the RAA to require registrars to show a standardized description of registrant rights". The proposed amendments to the RAA have acknowledged that request (2): "3.15 In the event that ICANN gives reasonable notice to Registrar that ICANN has published a webpage that identifies available registrant rights and responsibilities, and the content of such webpage is developed in consultation with registrars, Registrar shall provide a link to the webpage on any website it may operate for domain name registration or renewal clearly displayed to its Registered Name Holders at least as clearly as its links to policies or notifications required to be displayed under ICANN Consensus Policies." When can we expect the ALAC to start working on a Registrant Rights & Responsibilities draft? It was, after all, the ALAC's recommendation. The follow-up obligation is indeed yours. (1) http://www.alac.icann.org/correspondence/alac-raa-revision-statement-13sep0… (2) http://www.icann.org/en/topics/raa/redline-2001-raa-18jun08.pdf

2 1

[Fwd: [Fwd 9th false reason given to: Request to mailing list At-Large rejected]]
by Jeffrey A. Williams Aug. 6, 2008

Aug. 6, 2008

-------- Original Message -------- Subject: [Fwd 9th false reason given to: Request to mailing list At-Large rejected] Date: Tue, 05 Aug 2008 20:16:44 -0700 From: "Jeffrey A. Williams" <jwkckid1(a)ix.netcom.com> Organization: IDNS and Spokesman for INEGroup To: "matthias.langenegger(a)icann.org" <matthias.langenegger(a)icann.org>,Nick Ashton-Hart <nick.ashton-hart(a)icann.org>,at-large-owner(a)atlarge-lists.icann.org,Cheryl Langdon-Orr <cheryl(a)hovtek.com.au> CC: GAC Rep <ssene(a)ntia.doc.gov>,DOC/NTIA ICANN Rep <aheineman(a)ntia.doc.gov> Mattias and all, Yet again this is a false reason given. There were only 4 recipients which last I checked is less than 5, which is the max number of recipients according to Nicks most recent announcment. -------- Original Message -------- Subject: Request to mailing list At-Large rejected Date: Wed, 06 Aug 2008 08:09:11 -0400 From: at-large-bounces(a)atlarge-lists.icann.org To: jwkckid1(a)ix.netcom.com Your request to the At-Large mailing list Posting of your message titled "How to carjack a top Google exec, according to Google" has been rejected by the list moderator. The moderator gave the following reason for rejecting your request: "Too many recipients to the message" Any questions or comments should be directed to the list administrator at: at-large-owner(a)atlarge-lists.icann.org Regards, Spokesman for INEGroup LLA. - (Over 281k members/stakeholders strong!) "Obedience of the law is the greatest freedom" - Abraham Lincoln "Credit should go with the performance of duty and not with what is very often the accident of glory" - Theodore Roosevelt "If the probability be called P; the injury, L; and the burden, B; liability depends upon whether B is less than L multiplied by P: i.e., whether B is less than PL." United States v. Carroll Towing (159 F.2d 169 [2d Cir. 1947] =============================================================== Updated 1/26/04 CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. div. of Information Network Eng. INEG. INC. ABA member in good standing member ID 01257402 E-Mail jwkckid1(a)ix.netcom.com My Phone: 214-244-4827

1 0

Resend of:Apple DNS Patch Doesn't Fix Client Versions of OS X
by Jeffrey A. Williams Aug. 6, 2008

Aug. 6, 2008

All, Sorry that the list moderator/admin. has trouble counting to 5. So I have resent the below Email... Yet another too soon.knee jerk claim by Apple. See: (August 1, 2008) Apple released a patch for the recently disclosed and exploited DNS vulnerability, but while it fixes Mac OS X systems used as DNS servers, it does not protect Macs being used as client systems. Fully patched versions of both Tiger (version 10.4.11) and Leopard (version 10.5.4) do not adequately randomize DNS source ports. Apple released Security Update 2008-005 on Thursday, July 31 to address 17 flaws in its OS X operating system. - From Internet Storm Center: http://isc.sans.org/diary.html?storyid=4810 A quick packet dump of my fully patched Leopard machine (OS X 10.5.4) shows it is - as a DNS client - still using incrementing ports. http://www.theregister.co.uk/2008/08/01/osx_still_vulnerable/print.html http://www.informationweek.com/news/hardware/mac/showArticle.jhtml?articleI… http://www.computerworld.com/action/article.do?command=viewArticleBasic&art… Regards, Spokesman for INEGroup LLA. - (Over 281k members/stakeholders strong!) "Obedience of the law is the greatest freedom" - Abraham Lincoln "Credit should go with the performance of duty and not with what is very often the accident of glory" - Theodore Roosevelt "If the probability be called P; the injury, L; and the burden, B; liability depends upon whether B is less than L multiplied by P: i.e., whether B is less than PL." United States v. Carroll Towing (159 F.2d 169 [2d Cir. 1947] =============================================================== Updated 1/26/04 CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. div. of Information Network Eng. INEG. INC. ABA member in good standing member ID 01257402 E-Mail jwkckid1(a)ix.netcom.com My Phone: 214-244-4827

1 0

[Fwd: Re: [ga] More Registrar Malfeasance Reported]
by Jeffrey A. Williams Aug. 6, 2008

Aug. 6, 2008

All, Forwarding this as it seems that Nick is unable or unwilling to manage a list forum by his own rules properly. -------- Original Message -------- Subject: Re: [ga] More Registrar Malfeasance Reported Date: Tue, 05 Aug 2008 17:05:42 -0700 From: "Jeffrey A. Williams" <jwkckid1(a)ix.netcom.com> Organization: IDNS and Spokesman for INEGroup To: ga(a)gnso.icann.org, Governance/IGC <governance(a)lists.cpsr.org> CC: "alac(a)atlarge-lists.icann.org" <alac(a)atlarge-lists.icann.org>,Stacy Burnette <stacy.burnette(a)icann.org> References: <444690.28282.qm(a)web52209.mail.re2.yahoo.com> Danny and all, Thank you again for your diligance here. This again demonstrates why ICANN and especially the GNSO, and ICANN registrars need DOC/NTIA as well as other supervision. Danny Younger wrote: > > KnujOn has found at least 19 rogue pharmacy domains, sponsored through DIRECT INFORMATION PVT LTD D/B/A PUBLICDOMAINREGISTRY.COM (PDR) back in operation with the same content and at the same nameserver after being reported to ICANN by the Registrar as suspended. The nameserver is also sponsored by PDR and is itself an unlicensed pharmacy site. This is an example of a practice we have seen all too frequently where Internet companies will remove sites temporarily for reported policy violations only to restore them shortly afterwards. DIRECT INFO/PDR was rated the 9th Worst Registrar by KnujOn in terms of sponsoring spam sites previously. Clearly the consumer is not being protected by the current system. Full report here: http://www.knujon.com/news.html#08052008 > Regards, Spokesman for INEGroup LLA. - (Over 281k members/stakeholders strong!) "Obedience of the law is the greatest freedom" - Abraham Lincoln "Credit should go with the performance of duty and not with what is very often the accident of glory" - Theodore Roosevelt "If the probability be called P; the injury, L; and the burden, B; liability depends upon whether B is less than L multiplied by P: i.e., whether B is less than PL." United States v. Carroll Towing (159 F.2d 169 [2d Cir. 1947] =============================================================== Updated 1/26/04 CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. div. of Information Network Eng. INEG. INC. ABA member in good standing member ID 01257402 E-Mail jwkckid1(a)ix.netcom.com My Phone: 214-244-4827

1 0

Apple DNS Patch Doesn't Fix Client Versions of OS X
by Jeffrey A. Williams Aug. 4, 2008

Aug. 4, 2008

All, Yet another too soon.knee jerk claim by Apple. See: (August 1, 2008) Apple released a patch for the recently disclosed and exploited DNS vulnerability, but while it fixes Mac OS X systems used as DNS servers, it does not protect Macs being used as client systems. Fully patched versions of both Tiger (version 10.4.11) and Leopard (version 10.5.4) do not adequately randomize DNS source ports. Apple released Security Update 2008-005 on Thursday, July 31 to address 17 flaws in its OS X operating system. - From Internet Storm Center: http://isc.sans.org/diary.html?storyid=4810 A quick packet dump of my fully patched Leopard machine (OS X 10.5.4) shows it is - as a DNS client - still using incrementing ports. http://www.theregister.co.uk/2008/08/01/osx_still_vulnerable/print.html http://www.informationweek.com/news/hardware/mac/showArticle.jhtml?articleI… http://www.computerworld.com/action/article.do?command=viewArticleBasic&art… Regards, Spokesman for INEGroup LLA. - (Over 281k members/stakeholders strong!) "Obedience of the law is the greatest freedom" - Abraham Lincoln "Credit should go with the performance of duty and not with what is very often the accident of glory" - Theodore Roosevelt "If the probability be called P; the injury, L; and the burden, B; liability depends upon whether B is less than L multiplied by P: i.e., whether B is less than PL." United States v. Carroll Towing (159 F.2d 169 [2d Cir. 1947] =============================================================== Updated 1/26/04 CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. div. of Information Network Eng. INEG. INC. ABA member in good standing member ID 01257402 E-Mail jwkckid1(a)ix.netcom.com My Phone: 214-244-4827

1 0

RIAA's $222k Verdict Is Likely To Be Set Aside
by Jeffrey A. Williams Aug. 4, 2008

Aug. 4, 2008

All, Well seems that the recent RIAA legal "Big Gun" missed it's mark. So isn't it about/past time that ICANN's IPC discorge itself from the RIAA? See: http://recordingindustryvspeople.blogspot.com/ writes "Apparently the RIAA's http://news.slashdot.org/article.pl?sid=08/08/01/2251217&tid=123 'big gun' didn't fare so well this morning in Duluth, when he tried to persuade the judge in http://recordingindustryvspeople.blogspot.com/2007/01/index-of-litigation-d… Capitol v. Thomas that the part of the Copyright Act which says 'by sale or other transfer of ownership, or by rental, lease, or lending', can be disregarded. According to an http://blog.wired.com/27bstroke6/2008/08/judge-hints-at.html in-person account by Wired.com the Judge indicated that he is likely to grant a mistrial, setting aside the $222,000 jury verdict based upon his incorrect jury instruction, and that he will probably hand down his decision in September. Just yesterday some of the same lawyers http://recordingindustryvspeople.blogspot.com/2008/08/mpaa-loses-in-case-ag… got rebuffed by the US Court of Appeals for the Second Circuit in their attempt to argue that Cablevision's online storage for its customers constitutes a copyright infringement, in Cartoon Network v. CSC Holdings. There, too, the content owners had argued that the wording of the Copyright Act did not mean what it said. There, too, the Court politely but firmly disagreed." Regards, Spokesman for INEGroup LLA. - (Over 281k members/stakeholders strong!) "Obedience of the law is the greatest freedom" - Abraham Lincoln "Credit should go with the performance of duty and not with what is very often the accident of glory" - Theodore Roosevelt "If the probability be called P; the injury, L; and the burden, B; liability depends upon whether B is less than L multiplied by P: i.e., whether B is less than PL." United States v. Carroll Towing (159 F.2d 169 [2d Cir. 1947] =============================================================== Updated 1/26/04 CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. div. of Information Network Eng. INEG. INC. ABA member in good standing member ID 01257402 E-Mail jwkckid1(a)ix.netcom.com My Phone: 214-244-4827

1 0

Re: [At-Large] [ga] Comments on ICANN's approval of .info Abusive Use Policy -- contradictions
by Jeffrey A. Williams Aug. 4, 2008

Aug. 4, 2008

George and all, Thank you George, very much! So to sum up, Afilias the .Info registry takes no responsibility for whatever it's registrar may or may not have done in it's determination of what any .Info domain name may or may not be "Involved" in or with. So that means that there essentially is no means by which, other than a UDRP provider, that abusive or accused abusive DN's as to take down, ect. So they, Afilias, ICANN, essentially punted. Just lovely! George Kirikos wrote: > Hi folks, > > I just wanted to share a few tidbits, so it's on the record. Does > anyone here find it interesting that in their proposal, they cite > 3.6.5: > > http://www.icann.org/en/registries/rsep/afilias-request-20jun08.pdf > > But according to their own staff, in the Fast Flux working group: > > http://forum.icann.org/lists/gnso-ff-pdp-may08/msg00333.html > http://forum.icann.org/lists/gnso-ff-pdp-may08/msg00036.html > > about section 3.6.5. :) > > "Language you cite from the .info RRA does not permit "de-registration > in the event of criminal activity, and/or to protect the interests of > the registry/registrar." The "integrity and stability of the > registry" refers > to operational stability and accuracy, which is not threatened by a > phish, > or fast-flux domains, etc. Such threats to the stability of the > registry > itself are quite rare. "Integrity" does not means the interests of the > TLD. > As far as I am aware, there are no blanket laws or government rules > that > allow gTLD registries to suspend domains etc whenever they like. Court > orders etc. are specific to particular cases, of course. " > > Not just any staff, though, but "Greg Aaron is Director, Key Account > Management and Domain Security at Afilias." "Greg manages registry > services for .INFO, and oversees Afilias' security programs, designed > to address domain name abuses such as phishing, spam, and malware in > .INFO." > > Also, - Afilias quotes the example of .biz for precedent in order to > get Fast Track approval from Staff: > > "For example, ICANN's contract with the .BIZ registry operator includes > a prohibition against registrants "Using the domain name for the > submission of unsolicited bulk e-mail, phishing, pharming or other > abusive or fraudulent purposes." > > http://www.icann.org/tlds/agreements/biz/appendix-08-08dec06.htm > > Afilias failed to mention that in that same agreement, 5 or 10 lines > below what they quoted, it says: (Exhibit D, point II) > > "The RDRP sets forth the terms under which any allegation that a domain > name is not used primarily for business or commercial purposes shall be > enforced on a case-by-case, fact specific basis by an independent > ICANN-accredited dispute provider. ******None of the violations of the > Restrictions will be enforced directly by or through Registry > Operator.****** Registry Operator will not review, monitor, or > otherwise verify that any particular domain name is being used > primarily for business or commercial purposes or that a domain name is > being used in compliance with the UDRP processes." > > In other words, the precedent they cited was flawed, and was actually > about the registry operator explicitly NOT reviewing it, but only > acting on a ruling from an ICANN-accredited dispute provider. > > Just thought some folks might want this information. > > Enjoy! > > Sincerely, > > George Kirikos > http://www.kirikos.com/ Regards, Spokesman for INEGroup LLA. - (Over 281k members/stakeholders strong!) "Obedience of the law is the greatest freedom" - Abraham Lincoln "Credit should go with the performance of duty and not with what is very often the accident of glory" - Theodore Roosevelt "If the probability be called P; the injury, L; and the burden, B; liability depends upon whether B is less than L multiplied by P: i.e., whether B is less than PL." United States v. Carroll Towing (159 F.2d 169 [2d Cir. 1947] =============================================================== Updated 1/26/04 CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. div. of Information Network Eng. INEG. INC. ABA member in good standing member ID 01257402 E-Mail jwkckid1(a)ix.netcom.com My Phone: 214-244-4827

1 0

FBI Seizes Library Computers Without Warrant
by Jeffrey A. Williams Aug. 3, 2008

Aug. 3, 2008

All, What's up with this? I can't see how this was necessary and seemingly is abusive. For all you NA folks, this is something you can write you local FBI office about. IMHO, this is deplorable and is a significant user issue as many users use library computers to do thei research and other educational related activities. Antrax case my A$$! Looks like a CYA operation to me... What's next, is the FBI going to search little kids lunch boxes for P2P devices and cell phones and confiscate them too? See: Two FBI agents walked into a public library in Maryland, without a warrant, and http://wtopnews.com/?nid=598&sid=1452848 walked out with two computers. The library director agreed to release the machines to these smooth-talking feds. According to the article, the director of Frederick County Public Libraries indicated that this was the third time in his 10 years there that the FBI had requested records, but the first time they had come without a court order. The director seemed to indicate no regrets, stating 'It was a decision I made on my experience and the information given to me.' He further justified his actions, noting that the agents indicated specific computers they needed (of the several dozen in the library) and further that they 'had an awful lot of information.'" The library director speculated whether the raid may have involved the http://news.slashdot.org/article.pl?sid=08/08/01/1532217&tid=266 Bruce Ivins / anthrax case, musing "Obviously it coincided with the events everyone is talking about," but he said the agents hadn't mentioned it. Regards, Spokesman for INEGroup LLA. - (Over 281k members/stakeholders strong!) "Obedience of the law is the greatest freedom" - Abraham Lincoln "Credit should go with the performance of duty and not with what is very often the accident of glory" - Theodore Roosevelt "If the probability be called P; the injury, L; and the burden, B; liability depends upon whether B is less than L multiplied by P: i.e., whether B is less than PL." United States v. Carroll Towing (159 F.2d 169 [2d Cir. 1947] =============================================================== Updated 1/26/04 CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. div. of Information Network Eng. INEG. INC. ABA member in good standing member ID 01257402 E-Mail jwkckid1(a)ix.netcom.com My Phone: 214-244-4827

1 0