There's an interesting discussion taking place on the SSAC list in regards to the fast flux issue. Here's a recent comment from the SSAC list - Domain tasting is an optimisation of the domain name monetisation business model, where a registrant earns money from PPC ads placed on a parked webpage. For monetisation you don't actually want to change the DNS information often. Fast Flux is more associated with using a domain name for an email address or URL that has been used in SPAM email. Due to the millions of emails that are floating around there is value in ensuring that the domain name used is not shut-down prematurely. Thus those involved will try to make the WHOIS and other more visible information as legitimate looking as possible (stopping the registrar shutting down the domain), but bounce the hosting of the email or website amongst various locations to avoid a hosting company or ISP shutting down the service at the source - or blocking the offending IP address at the entry point to a service providers network. Any comments? regards, Robert --- Robert Guerra <rguerra@privaterra.ca> Managing Director, Privaterra Tel +1 416 893 0377
Any comments?
They're right, domain tasting and fast flux are both evil, but they're separate issues. The solution to domain tasting is easy, get rid of it. Fast flux is somewhat more complicated, but a good start would be to tell registrars set a rate limit to the number of DNS server changes, on the order of one or two per day. Regards, John Levine, johnl@iecc.com, Primary Perpetrator of "The Internet for Dummies", Information Superhighwayman wanna-be, http://www.johnlevine.com, ex-Mayor "More Wiener schnitzel, please", said Tom, revealingly.
Although one could imagine using fast-flux to obfuscate who is hosting a tasted monetization page, it hardly seems worth the trouble. For those who are not familiar with fast flux, there are number of interesting articles about it. http://www.theregister.com/2007/07/11/fast_flux_botnet/page2.html http://www.securityfocus.com/news/11473/2 http://www.honeynet.org/papers/ff/fast-flux.html The first two are short, the last one isn't. Alan At 10/08/2007 02:14 PM, Robert Guerra wrote:
There's an interesting discussion taking place on the SSAC list in regards to the fast flux issue.
Here's a recent comment from the SSAC list -
Domain tasting is an optimisation of the domain name monetisation business model, where a registrant earns money from PPC ads placed on a parked webpage. For monetisation you don't actually want to change the DNS information often.
Fast Flux is more associated with using a domain name for an email address or URL that has been used in SPAM email. Due to the millions of emails that are floating around there is value in ensuring that the domain name used is not shut-down prematurely. Thus those involved will try to make the WHOIS and other more visible information as legitimate looking as possible (stopping the registrar shutting down the domain), but bounce the hosting of the email or website amongst various locations to avoid a hosting company or ISP shutting down the service at the source - or blocking the offending IP address at the entry point to a service providers network.
Any comments?
regards,
Robert --- Robert Guerra <rguerra@privaterra.ca> Managing Director, Privaterra Tel +1 416 893 0377
_______________________________________________ ALAC mailing list ALAC@atlarge-lists.icann.org http://atlarge-lists.icann.org/mailman/listinfo/alac_atlarge-lists.icann.org
At-Large Official Site: http://www.alac.icann.org ALAC Independent: http://www.icannalac.org
Hiya, I just wanted to say "thank you" to those posting on this subject that gave a little "backgrounder" to what the problem is so that those of us who are newer at this can comprehend the problem. That is SO useful and I truly do appreciate the extra time and effort expended on this. Have a great weekend, Darlene Darlene A. Thompson Community Access Program Administrator Nunavut Department of Education/N-CAP c/o P.O. Box 1000, Station 910 Iqaluit, NU X0A 0H0 Phone: (867) 975-6531 Fax: (867) 979-8870 dthompson@gov.nu.ca -----Original Message----- From: alac-bounces@atlarge-lists.icann.org [mailto:alac-bounces@atlarge-lists.icann.org] On Behalf Of Alan Greenberg Sent: Friday, August 10, 2007 3:00 PM To: Robert Guerra; At-Large Worldwide Subject: Re: [At-Large] Fast Flux & Domain tasting Although one could imagine using fast-flux to obfuscate who is hosting a tasted monetization page, it hardly seems worth the trouble. For those who are not familiar with fast flux, there are number of interesting articles about it. http://www.theregister.com/2007/07/11/fast_flux_botnet/page2.html http://www.securityfocus.com/news/11473/2 http://www.honeynet.org/papers/ff/fast-flux.html The first two are short, the last one isn't. Alan At 10/08/2007 02:14 PM, Robert Guerra wrote:
There's an interesting discussion taking place on the SSAC list in regards to the fast flux issue.
Here's a recent comment from the SSAC list -
Domain tasting is an optimisation of the domain name monetisation business model, where a registrant earns money from PPC ads placed on a parked webpage. For monetisation you don't actually want to change the DNS information often.
Fast Flux is more associated with using a domain name for an email address or URL that has been used in SPAM email. Due to the millions of emails that are floating around there is value in ensuring that the domain name used is not shut-down prematurely. Thus those involved will try to make the WHOIS and other more visible information as legitimate looking as possible (stopping the registrar shutting down the domain), but bounce the hosting of the email or website amongst various locations to avoid a hosting company or ISP shutting down the service at the source - or blocking the offending IP address at the entry point to a service providers network.
Any comments?
regards,
Robert --- Robert Guerra <rguerra@privaterra.ca> Managing Director, Privaterra Tel +1 416 893 0377
_______________________________________________ ALAC mailing list ALAC@atlarge-lists.icann.org http://atlarge-lists.icann.org/mailman/listinfo/alac_atlarge-lists.ican n.org
At-Large Official Site: http://www.alac.icann.org ALAC Independent: http://www.icannalac.org
_______________________________________________ ALAC mailing list ALAC@atlarge-lists.icann.org http://atlarge-lists.icann.org/mailman/listinfo/alac_atlarge-lists.icann .org At-Large Official Site: http://www.alac.icann.org ALAC Independent: http://www.icannalac.org
This is the first I've heard of Fast Flux, but just read the articles Allen attached. Very interesting. It seems like what we're talking about over and over are servers located in overseas locations that are constantly providing scams (phishing, farming, etc.). They'll do this because they know they can get away with it. In one of the articles I noticed a constant reference to a co.hk extension, and another article mentioned China. We all know of scams originating from Africa and Europe and Russia. I wouldn't suggest that it doesn't happen in the US, but I think ISPs in the US are much more eager to shut them down. But, what if the scammers are the ISP? I truly believe that 90% of all our problems are due to the mafia-style collusion between the crooks and ISPs in countries like China, the Balkans, and Central Africa. I also think that it would be easy as cake to identify the culprits, should we actually take it seriously. At some point, I think there needs to be an ICANN-level task force that can go in an repatriate IP#s that are causing serious problems, working through the ccTLD managers and numbering authorities. Some type of enforcement is inevitable and logical. In reality, there's not much we can do except make it more difficult for people to operate that are up to no good. Giving unlimited access to WHOIS data and letting the traditional legal process play out is obviously not the antidote. Similarly, having faith that Yahoo's spam filter will save the day is preposterous. I've been against the tasting issue from the beginning just because it doesn't make sense, but I'm not sure that it's the cause of the problem. I'm fairly sure it's a contributor to the problem but not the cause. Remember though, as we issue more TLDs and make it easier for these guys to operate by having the Add-Grace Period, the problem will continually get worse until the Internet is irreversibly destabilized. Randy Glass A@L On 8/10/07, Robert Guerra <lists@privaterra.info> wrote:
There's an interesting discussion taking place on the SSAC list in regards to the fast flux issue.
Here's a recent comment from the SSAC list -
Domain tasting is an optimisation of the domain name monetisation business model, where a registrant earns money from PPC ads placed on a parked webpage. For monetisation you don't actually want to change the DNS information often.
Fast Flux is more associated with using a domain name for an email address or URL that has been used in SPAM email. Due to the millions of emails that are floating around there is value in ensuring that the domain name used is not shut-down prematurely. Thus those involved will try to make the WHOIS and other more visible information as legitimate looking as possible (stopping the registrar shutting down the domain), but bounce the hosting of the email or website amongst various locations to avoid a hosting company or ISP shutting down the service at the source - or blocking the offending IP address at the entry point to a service providers network.
Any comments?
regards,
Robert --- Robert Guerra <rguerra@privaterra.ca> Managing Director, Privaterra Tel +1 416 893 0377
_______________________________________________ ALAC mailing list ALAC@atlarge-lists.icann.org
http://atlarge-lists.icann.org/mailman/listinfo/alac_atlarge-lists.icann.org
At-Large Official Site: http://www.alac.icann.org ALAC Independent: http://www.icannalac.org
-- ------------------------- AmericaAtLarge.org RJPacific.com DDMF.org
It seems like what we're talking about over and over are servers located in overseas locations that are constantly providing scams (phishing, farming, etc.)
The scam servers are typically located on virus-controlled zombies that can be anywhere, as often as not right here in the US.
I wouldn't suggest that it doesn't happen in the US, but I think ISPs in the US are much more eager to shut them down.
If only. A few do, but the lack of action cleaning up zombied PCs is a global scandal. Also, if you look at Spamhaus' list of the worst problem ISPs, the worst one has for a long time been Verizon, which absorbed but did not fix the equally bad MCI.
But, what if the scammers are the ISP? I truly believe that 90% of all our problems are due to the mafia-style collusion between the crooks and ISPs in countries like China, the Balkans, and Central Africa.
Nope. There may be some of that, but that's not a major issue. The worst is ISPs like Verizon that turn a blind eye to their sleazy customers.
At some point, I think there needs to be an ICANN-level task force that can go in an repatriate IP#s that are causing serious problems
That's not how Internet routing works. There is no practical way to take IP space away from one party and give it to another if the first party isn't inclined to cooperate. It's possible to blacklist IPs so nobody can use them, but then the space is gone, and given the diminishing amount of available IPv4 address space, that's going to be a very hard sell. R's, John
RJGlass | America@Large wrote:
I wouldn't suggest that it doesn't happen in the US, but I think ISPs in the US are much more eager to shut them down.
If spam statistics are anything to go by, most of the junk we block emanates from the US Botnets etc., don't respect international boundaries and unfortunately a lot of ISPs in ALL countries either don't care or don't have the resources to do much about it. regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting & Colocation, Brand Protection http://www.blacknight.ie/ http://blog.blacknight.ie/ Tel. 1850 929 929 Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Fax. +353 (0) 1 4811 763 ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,Ireland Company No.: 370845
Step one is being aware of the issues. Step two is trying to determine what we, as ICANN At-Large, are able to do about them. Do existing contracts with gTLDs give ICANN the ability to demand action on these issues from their registries? Does ICANN even have the right to demand to know what policies exist? I'm new to the process and still trying to determine what leverage ICANN has on these issues beyond addressing them in future registry agreements. I'm not even sure if ICANN is capable of imposing such policy positions in renewals of existing contracts, or will it get sued. At the SJ meeting I was made very aware of debate regarding actual limits of ICANN's power and influence, especially over existing registries. While these issues are indeed very important, it is also critical to know what role ICANN can play in fixing the problem, so that we can best understand how within At-Large to move forward. At very least there is an education role to play in making sure the public (via existing ALSs to start) is made aware of the issue. But it's important that, if At-Large take any actual policy-study initiatives, there is at least a forum in which the results of thus study can have an effect. Spending a lot of volunteer resources on policy, only to find that ICANN couldn't do anything even were the Board to agree with our position, strikes me as a very ineffective use of community energy. It' s one thing to take a position, even an unpopular one, with the intent of influencing policy and direction. It's quite different to take a strong stand on something that ICANN is unable to act upon. - Evan
participants (7)
-
Alan Greenberg -
Evan Leibovitch -
John L -
Michele Neylon :: Blacknight -
RJGlass | America＠Large -
Robert Guerra -
Thompson, Darlene