May 2020 - Middle-East - lists.icann.org

ME Space virtual activities
by Tijani BEN JEMAA May 8, 2020

May 8, 2020

Dear all, As you all know, the ME Space can’t be convened face to face due to the Corona Virus pandemic, and this situation may last for long time. We thought we can undertake remote activities that may replace our face to face work during this period to achieve our objective which is to make the voice of our region heard for all important issues at ICANN. Therefore, Nadira and myself, with the strong support of Baher and Fahd, we propose to address the Universal Acceptance under the angle of Arabic script e-mail addresses and prepare a statement to be discussed virtually in a teleconference, modified if necessary, adopted and sent to the ICANN Board and the UASG. But before that, and to permit to our community members to better understand the UA in general and the Arabic script for e-mail addresses in particular, a webinar will be organized with 3 experts who will present all aspects of the topic. This whole process will start on 15 April at 10:00 UTC by the webinar. A detailed mail will be sent soon with all information (speakers, zoom, agenda, etc.). Best Nadira AL ARAJ & Tijani BEN JEMAA ME Space co-chairs

10 10

[Paper] Brief Overview of the Root Server System
by Fahd Batayneh May 8, 2020

May 8, 2020

Friends and Colleagues, ICANN’s Office of the CTO (OCTO) has published a new paper entitled “Brief Overview of the Root Server System”. The paper covers 4 key items: DNS Resolution Process Root-Server System Hosting a root-server instance The role of ICANN’s Root-Server System Advisory Committee (RSSAC) You can read the paper here >> https://www.icann.org/en/system/files/files/octo-010-en.pdf [PDF]. Likewise, I am attaching it to this email, too. Finally, if you are interested in hosting an instance, please write to me offlist. Thank you, Fahd Batayneh ICANN

1 0

[Webinar] ICANN's Open Data Program (ODP) | Thursday 14 May 2020 | 14.00 - 15.00 UTC
by Fahd Batayneh May 7, 2020

May 7, 2020

Friends and Colleagues, You are cordially invited to attend a webinar on ICANN’s Open Data Program (ODP). When: Thursday 14 May 2020 | 14.00 - 15.00 UTC Where: Zoom. Kindly register here >> https://icann.zoom.us/webinar/register/WN_n6-I9IE9QAitySBC75fokg More on the agenda and how to join can be found here >> https://features.icann.org/event/icann-speaking-events/webinar-icanns-open-…. Thank you, Fahd Batayneh ICANN

1 0

[TODAY] Register to Join: Special Meeting of the ICANN Board and FY20 Board Operational Priorities Webinar
by Fahd Batayneh May 7, 2020

May 7, 2020

This webinar with the ICANN Board of Directors might be of interest to some. It takes place TODAY Thursday 7 May 2020 from 18:30-19:30 UTC. If interested, please read on and register. Fahd Batayneh ICANN Date: Thursday, May 7, 2020 at 1:42 AM Subject: ICANN News Alert -- Register to Join: Special Meeting of the ICANN Board and FY20 Board Operational Priorities Webinar Register to Join: Special Meeting of the ICANN Board and FY20 Board Operational Priorities Webinar 06 May 2020 LOS ANGELES – 6 May 2020 – The Internet Corporation for Assigned Names and Numbers (ICANN) is inviting the community to join the ICANN Board for its upcoming Special Board Meeting on 7 May 2020 from 18:30-19:30 UTC. This meeting will be directly followed by an informational webinar regarding the Board's Fiscal Year 2020 operational priorities. The Board meeting agenda can be found here. Please click here to register for the Special Board Meeting and webinar; registration is required to attend. More information about the ICANN Board is available here. About ICANN ICANN's mission is to help ensure a stable, secure, and unified global Internet. To reach another person on the Internet, you need to type an address – a name or a number – into your computer or other device. That address must be unique so computers know where to find each other. ICANN helps coordinate and support these unique identifiers across the world. ICANN was formed in 1998 as a not-for-profit public-benefit corporation with a community of participants from all over the world.

1 0

[Blog] Reporting Potential Pandemic-Related Domains
by Fahd Batayneh May 5, 2020

May 5, 2020

Friends and Colleagues, ICANN’s Security, Stability, and Resiliency Team (SSR) are doing a commendable job on domain names registered around the COVID-19 pandemic for abusive/misused purposes. You can learn about these efforts in the following piece >> https://go.icann.org/2A2RDiY. Thank you, Fahd Batayneh ICANN Introduction Any significant event attracts a number of interested parties. Both offline and online, some parties will have good intentions and, unfortunately, others will not. During newsworthy events in particular, domain registrations containing terms related to those events inevitably increase. The global COVID-19 pandemic is no different. We see people registering sites to raise money or provide help to those affected either directly or indirectly. We also see people creating domains that use the pandemic as a hook to gain traffic and draw victims in, subjecting end users to phishing, malware, and scams. In response to the latter, a number of groups are creating and making available "threat intelligence," that is, information and data on reported or observed security threats related to these domains. Some groups, like the COVID-19 Cyber Threat Intelligence League and the COVID-19 Cyber Threat Coalition, are taking action to counter these malicious actors. ICANN organization (org) is contributing to this COVID-19 anti-abuse effort, using our knowledge and expertise to put actionable intelligence into the hands of those able to disrupt malicious campaigns. We are filtering lists created from zone files and enriching them with data from external sources to identify domain names that may be malicious from the majority that are not. However, we must be careful not to add more noise to those already swamped with information. In other words, while we aim to provide data that allows a rapid assessment of a domain's status, we also need a high level of confidence in that assessment. Without both of these, we may end up doing more harm than good. We are now producing reports on recent domain registrations that we believe to be using the COVID-19 pandemic for phishing or malware campaigns. These reports, which are shared with the responsible parties (primarily registrars or registries), contain the evidence that leads ICANN org to believe the domains are being used maliciously, along with other background information to help the responsible parties determine the correct course of action. Process Detail To generate the reports, we examine available generic top-level domain (gTLD) zone files. These files allow us to see newly delegated registrations (although our report generation process can actually receive input from any source of domains or hostnames). Specifically, we look for new zone file entries that contain words like "COVID," "corona," "pandemic," and other related terms. The resulting list of domain names is not yet actionable, as it will include both benign and malicious domains. We need to further refine the list before we would have high confidence in the contents. The next step is to look across a number of threat intelligence sources for indications of the domain being used for phishing or malware distribution. We start by using Virus Total, AlienVault OTX, Phishtank, and Google Safe Browsing; however, our report generation process is designed to be extensible so threat intelligence sources can be added or removed. The data provided by these sources can suggest a domain is malicious, although in most cases we find little to no evidence. Lack of evidence can be ascribed to: Many of the domains we see are "parked," e.g., registered with the intent to sell at a profit or generate revenue via advertising. Others are young domains that have not yet been used maliciously or the behavior has not yet been observed. Therefore, it is possible that over time the reputation of a domain will change. In order to allow for this, we periodically retest domains. It is worth noting that the sources we use focus on malware and phishing, so the malicious activity that we see is largely within these two categories. We do also pick up domains involved in spam or other undesirable behaviors. In order for us to consider those domains, they must also be listed in the malware or phishing sources. It is not uncommon for domains to exist in multiple categories, because different collection methods employed by threat intelligence providers detect different aspects of a malicious campaign. Also, categorization is not an exact science and can be open to interpretation. Therefore, when we use the term "malicious" here we are referring to phishing or malware; however, that does not preclude a domain from appearing on a spam or other undesirable behavior list. When credible evidence of malicious activity is found, we proceed to gather more information about the domains in line with the reporting requirements specified by registrars in the Guide to Registrar Abuse Reporting. This reporting information includes the registrar (and abuse contact in particular), hosting information, etc. This information is gathered to help those receiving our reports make the decision on whether or not to take action (such as suspension) against the domain. The report generation process as described can be summarized in the following flowchart: The output of this process is gathered into two different formats: Comma Separated Values (CSV) summary which contains the name, resolved IP, and name server records plus the basic score from each threat intelligence source and a total. Markdown file per domain that contains more detail about that domain, including links to external evidence when available and appropriate. Statistics Since we began this effort at the end of March, we have seen an average of approximately 3,250 new domain names per day that match our search terms. This has resulted, at the time of writing, in more than 82,000 names. Of these, we have found evidence to link approximately 7,000 names to malicious behavior and have been able to resolve the domains (e.g., the domain names had not already been suspended). For any given day, the number of domains that have threat intelligence associated with them increases simply because there has been more opportunity for the behavior associated with the domains to be observed. As such, the proportion of older domain names with reports will be higher than younger domains. On the flip side, the malicious domains are starting to be noticed and suspended. You may notice that the numbers shared about are lower than other public reports. There are two primary reasons for this: We start with sources that contain domain names found in zone files only. We are not feeding in lists of full hosts seen in passive DNS sources or some other equivalent starting point. We only list domains that have sufficient evidence of malicious activity and still resolve. Our approach rules out domains that have been bought by speculators and parked. While blocking access to these domains may not be disruptive to an end user, we could not confidently claim that these domains are malicious. Summary It is a sad fact of life that there will always be malicious actors willing to turn any situation, even a pandemic, to their advantage. Our response to the misuse of domain names has been to put the evidence of which domains we believe to be malicious into the hands of those best placed to take appropriate action. We also believe that the bar to providing this evidence must be high enough so we do not contribute more noise than signal. The report generation process we've implemented goes to significant effort to avoid false positives. We look forward to working with our community and others to improve our processes.

1 0

[Blog] Identifying Phishing Scams, DNSSEC Signing, and Other Tips to Protect Your Domain Name
by Fahd Batayneh May 5, 2020

May 5, 2020

https://www.icann.org/news/blog/do-you-have-a-domain-name-here-s-what-you-n… This piece by ICANN’s Registrant Program may be of interest to domain name registrants. Fahd Batayneh ICANN As a domain name registrant, it's important to always understand and adhere to your rights and responsibilities and to educate yourself about how to best securely and responsibly manage your domain name(s). Beware of Phishing Scams and Emails that Appear to Be From ICANN Phishing attacks are a type of fraud that cybercriminals utilize to lure others online, including registrants, into doing what the criminals want them to do. Phishing may result in others voluntarily giving away their username and password or clicking a link that will lead to their devices being infected with malware, which is software that, when installed, performs unwanted or malicious activity. If an attacker can gain access to a registrant's private domain name registration information and passwords, they can potentially redirect the domain to wherever they like. As such, it's immensely important that you take note of any suspicious or unsolicited emails. Phishing emails may claim that your domain name registration needs to be renewed and that you must pay some sort of fee to get it back. These malicious campaigns typically use deceptive techniques such as forging a trusted sender's address or domain, or using a similar or lookalike domain. Phishing messages typically ask for the reader to reply, call a phone number, click a link, or open an attached file, which results in stealing personal information or gaining some other advantage over the victim. Sometimes phishing emails aimed at registrants may appear to come from ICANN (even using ICANN's branding and logo or sender email addresses containing the name "ICANN"). It is important to know that ICANN does not send emails directly to registrants about managing their domain names, and never requests payment of fees from registrants. Protecting Yourself and Your Domain Name Ensuring a stable and secure Domain Name System (DNS) for all Internet users is one of ICANN's key priorities. We recommend that you take the following steps to protect your domain name and personal information related to your domain name registration: Be suspicious of any email that offers domain name management services from ICANN. As noted above, ICANN does not offer domain name management services or process domain registrations and will never collect fees from registrants directly. ICANN will never send registrants a WHOIS Data Reminder Policy (WDRP) notice, registration data verification request, domain name expiration reminder, or domain name renewal request message. If you receive an email about your domain that purports to come from ICANN, contact your sponsoring registrar directly to enquire about the validity of that message. Please read the blog "What You Should Do If You Receive A Suspected Fraudulent ICANN Email" and remember to report suspicious emails that appear to come from ICANN to globalsupport(a)icann.org. Our team can take a look to determine if it's fraudulent. If it is, we'll work with appropriate parties, including law enforcement, to address the source of the email. Contact your sponsoring registrar directly for any concerns about the status of your domain name. Measures for Additional Protection In addition to being vigilant about watching for phishing attacks, here are some additional proactive measures you can take to protect yourself from those trying to gain unauthorized access to your domain name account: Always keep your domain name registrant account information private, secure, and recoverable. Enable multi-factor authentication if your registrar supports it. Use ICANN-accredited registrars to register and manage your domain name(s) and always research the reputation and service record of registrars before selecting one. If you're not entirely comfortable with a registrar after you register a domain name with them, you can and should consider transferring your domain name to a registrar you trust. Ask your registrar to apply a "registrar lock" on your domain names, which can help prevent changes to your domain name registration information and block attempts to transfer or delete your domain names. Use Transport Layer Security (TLS) HTTPS when you access your domain name registration account to prevent someone intercepting your communication with your registrar. Use a different email address for your registrar account than your domain name registration information. If your domain name is hijacked by someone who has gained access to your account with the registrar, that person will likely alter the registration information to remove you as the registered holder of the domain name. If you used an email address that is not associated with your domain name for your registration information, you will be able to provide that email address as evidence to the registrar that you were the registered holder of the domain name before it was altered by unauthorized access to your account. On your local machines, use a password manager, create strong passwords, and safeguard them. Sign Your DNS Zones With DNSSEC Another step you can take to protect your domain name and contribute to the overall security of the Domain Name System (DNS) is by DNSSEC-signing all the data associated with each of your domain names. DNSSEC (Domain Name System Security Extensions) reduces the chances an attacker will be able to substitute their answers in response to DNS queries. By creating digital signatures over your domain's zone data, clients looking up your domain names can verify the information they receive is what you had placed in the zone. Many DNS software packages and registration systems have tools that automate DNSSEC-signing. Check to ensure that DNSSEC-signing is enabled in your DNS software and at your registrar and that your registrar has the necessary information (your Delegation Signer record or your DNSKEY) to help establish trust in the information they just signed. Learn more about DNSSEC, why it's important, and how to put it into action with our DNSSEC Explainer, published by ICANN's Office of the Chief Technology Officer (OCTO) and available in all UN languages. Always Be Proactive Domain name registrants are important players in combating DNS abuse. We encourage you to always be vigilant and proactive in securely and responsibly managing your domain name(s). We hope you found these suggestions useful, and always encourage registrants to play an active role in the ICANN community. You can find more information on ICANN.org for domain name registrants here.

1 0

[TODAY] [Webinar] DNS Abuse: An End User Perspective | Monday 4 May 2020 | 15:00 - 16.30 UTC
by Fahd Batayneh May 4, 2020

May 4, 2020

For those interested in DNS Abuse, the below webinar may be of interest. It takes place today Monday 4 May at 15.00 UTC. Fahd Batayneh ICANN Date: Monday, May 4, 2020 at 12:18 AM Subject: [APAC-Discuss] Important Webinar Invitation with participation details| 2020 - Second Capacity Building Webinar | Monday 4 May at 15:00 UTC Dear All, On behalf of Joanna Kulesza and Alfredo Calderon, Co-Chairs of the Capacity Building Working Group, we would like to invite you to join the second webinar of the NEW At-Large Capacity Building Program – 2020 on the Topic of DNS Abuse: An End User Perspective. The Guest Speakers will be Jonathan Zuck and Drew Bagley. In this webinar, Jonathan Zuck, Vice Chair of the ALAC for Policy, will present an overview of the different types of DNS Abuse (a particular class of Cybercrime) and some of the efforts by ICANN and the At-Large to combat it. Jonathan will be joined by Drew Bagley, Director of Operations, The Secure Domain Foundation, who will discuss the recent surge in DNS Abuse related to the COVID-19 pandemic and what you can do to protect yourself. We will have an interactive quiz during the presentation and an opportunity for Q&A at the end of the presentation. Staff will end the webinar with an Evaluation Survey to allow us to continue to improve these webinars. The webinar is scheduled on Monday 4 May 2020 at 15:00 UTC for 90 minutes. For other times: https://tinyurl.com/y9gh957u The draft agenda and call details are available at: https://community.icann.org/x/C4rsBw French and Spanish interpretation will be provided. Zoom room: https://icann.zoom.us/j/97787172859 Password: #dnsabuse1 ADIGO Conference ID’s: EN: 1638 ES: 1738 FR: 1838 Real time transcription (RTT) available at: https://www.streamtext.net/player?event=ICANN If you require a dial-out, please contact At-Large Staff at staff(a)atlarge.icann.org with your preferred number. Thank you. Kind regards, At-Large Staff ICANN Policy Staff in support of the At-Large Community Website: atlarge.icann.org Facebook: facebook.com/icann [facebook.com]atlarge Twitter: @ [twitter.com]ICANNAtLarge

1 0