August 2008 - NA-Discuss - lists.icann.org

Borrador de enmiendas propuestas al Acuerdo sobre Acreditación de Registradores
by At-Large Staff Aug. 8, 2008

Aug. 8, 2008

Borrador de enmiendas propuestas al Acuerdo sobre Acreditación de Registradores http://www.icann.org/es/announcements/announcement-18jun08-es.htm 18 de junio de 2008 Haga clic aquí para ir al periodo de presentación de comentarios públicos (abierto hasta el 31 de agosto de 2008). Esta notificación reseña quince enmiendas del borrador al Acuerdo sobre Acreditación de Registradores (AAR) de modo que sean estudiadas y debatidas por la comunidad de ICANN (Corporación para la asignación de números y nombres de Internet). Las enmiendas se elaboraron a través de un proceso de consulta de la comunidad y posteriormente un debate entre registradores e ICANN acerca de dichos comentarios. Las enmiendas del borrador se presentan aquí para facilitar el debate posterior de la comunidad con el objetivo de aplicar una serie de cambios contractuales para mejorar las medidas de protección de los registrantes. El personal de ICANN estará a su disposición para facilitar debates con grupos de unidades constitutivas en asambleas de ICANN en París y en posteriores reuniones. Estas enmiendas se constituyen en cuatro categorías generales: * Instrumentos de ejecución: estas enmiendas están diseñadas para potenciar el cumplimiento del registrador y otorgar a ICANN unas mejores herramientas de aplicación. * Protecciones de registrantes: estas enmiendas se centran en áreas para realzar la protección de los registrantes mediante la mejora de información al consumidor, gracias a la cual las decisiones y elecciones relativas a la protección de datos estarán mejor fundamentadas. * Promoción de un mercado de registradores estable y competitivo: estas enmiendas tienen como objetivo asegurar que todos los participantes cumplan los estándares mínimos en el mercado de registradores. * Modernización del acuerdo: estas enmiendas están previstas para cerciorarse de que las disposiciones del contrato satisfacen las necesidades actuales. Historial de la consulta * En un esfuerzo por abordar los asuntos suscitados por la protección de los registrantes, ICANN ha entablado un gran número de negociaciones con miembros de la comunidad relativas a potenciales enmiendas al AAR. Se han recibido contribuciones a través de foros de comentarios del público, en particular de ALAC (Comité asesor de alcance) y de la Unidad constitutiva de propiedad intelectual (IPC). De acuerdo con la dirección fijada en estas negociaciones, ICANN ha mantenido debates tanto telefónicos como personales con registradores sobre la manera de ofrecer estas medidas de protección mediante la reforma del AAR. De entre las ocho áreas sustantivas de reforma exigidas por Paul Twomey en marzo de 2007 (consulte <http://www.icann.org/announcements/announcement-21mar07.htm>) y de estas consultas a la comunidad, se han propuesto 15 enmiendas al AAR. * Se realizaron talleres en las asambleas de ICANN donde se debatieron temas de custodia de datos, migración en caso de fallos del registro, cumplimiento y enmiendas al AAR. Paralelamente, la Junta Directiva resolvió que el personal directo solicitara contribuciones a la comunidad concernientes a las enmiendas al AAR; participara en un diálogo con registradores para llegar a una serie de enmiendas propuestas del AAR que se deben someter a los comentarios del público, y solicitara consejo de ALAC, GNSO (Organización de apoyo para nombres genéricos) y demás partes interesadas con el fin de informar de la revisión de las enmiendas realizada por la Junta Directiva (consulte < http://www.icann.org/minutes/resolutions-29jun07.htm#k>). * Se redactó un conjunto inicial de enmiendas, que se sometió a comentarios del público entre julio y septiembre de 2007, con un resumen publicado en octubre de 2007. Se incluyó una página en el sitio web de ICANN para "Consulta sobre enmiendas al Acuerdo sobre Acreditación de Registradores" en <http://www.icann.org/topics/raa/>. Durante este periodo inicial se entablaron asimismo negociaciones con registradores. * Una serie actualizada de enmiendas surgió a partir de las negociaciones con los registradores y la solicitud de consejo a la comunidad. La Unidad constitutiva de registradores (RC) creó un grupo de trabajo, dirigido por el presidente de esta, Jon Nevett, para entablar un diálogo continuo con ICANN sobre los asuntos del AAR objeto de debate. Se han redactado diversas reiteraciones a medida que el diálogo entre el grupo de trabajo e ICANN ha progresado. Han tenido lugar diversas conferencias tanto personales como telefónicas. * ALAC asimismo creó un grupo de trabajo para revisar el AAR y ha contribuido al diálogo. Las comunicaciones entre los registradores y ALAC han mejorado, en parte como resultado del continuo diálogo. * A la finalización de este periodo de contribuciones del público, se preparará un informe con los pormenores de los comentarios para que la Junta Directiva los tenga en consideración en su revisión. Enmiendas propuestas A continuación se muestra un resumen de las enmiendas que se han publicado para la presentación de comentarios públicos. (Si desea obtener información sobre la propuesta de idioma del contrato para poner en práctica cada una de estas, consulte http://www.icann.org/es/topics/raa/raa-provisions-comparision-18jun08-es.pdf (Comparación de disposiciones de AAR) [PDF, 49 K] y http://www.icann.org/es/topics/raa/redline-2001-raa-18jun08-es.pdf (Modificaciones propuestas del ARR pendientes de estudio) [PDF, 86 K].): 1. Instrumentos de ejecución 1. Auditorías de registradores: permiten a ICANN realizar visitas a sitios web y auditorías de registradores previa notificación de al menos 15 días de antelación. 2. Sanciones y suspensiones: disponen herramientas de aplicación del cumplimiento incrementado, tales como sanciones económicas y suspensión del acceso al registro. 3. Responsabilidad de grupo: previene "conductas impropias en serie" por parte de registradores cuando se rescinde el AAR de otro registrador afiliado (mediante control común). 4. Honorarios del registrador: revisión de la disposición de honorarios del registrador para que se adecue a los presupuestos recientes y actuales de ICANN; cálculo del interés sobre los pagos de honorarios en mora. 5. Registros por parte de registradores: creación de responsabilidad de los registradores para con ICANN por cuenta de cualquier registro efectuado por los primeros que se use en la provisión de servicios de registro. 6. Suspensión arbitral: eliminación de la suspensión automática de rescisión de 30 días que los registradores reciben en la actualidad mediante el inicio del procedimiento arbitral o el litigio para presentar una demanda contra la rescisión de un AAR. 2. Medidas de protección de registrantes 1. Registro privado y requisitos de custodia de datos de los registradores: se exige a los registradores que custodien los datos del cliente al efecto en el caso de registros privados o de proxy, o bien que presenten una notificación destacada en que se indique que dichos datos no serán custodiados. 2. Derechos y responsabilidades del registrante: se exige a los registradores que incluyan en sus sitios web un enlace a un documento de "derechos y responsabilidades del registrador", que se deberá crear previa consulta con la comunidad de ICANN. 3. Relaciones contractuales con los distribuidores: protección a los registrantes que son clientes de distribuidores obligando a los distribuidores a seguir las políticas de ICANN y exigiendo bien la custodia de los datos de privacidad o proxy de los clientes, o bien la publicación de una notificación destacada en que se indique que dichos datos no serán custodiados. 3. Fomento de un mercado estable y competitivo de registradores 1. Acreditación mediante compra: se exige a los registradores notificar a ICANN cualquier cambio de titularidad y volver a certificar el cumplimiento con el AAR. 2. Formación y pruebas de conocimientos de operadores: disponen formación obligatoria para representantes de registradores con el fin de asegurar la mejor comprensión por parte del registrador de las políticas de ICANN y de los requisitos del AAR. 3. Uso de registradores acreditados por el ICANN: mantenimiento de la política general de ICANN de exigir que los registros utilicen registradores acreditados del ICANN (salvo excepción razonable e indicada). 4. Modernización del acuerdo 1. Disposición de notificaciones: se agiliza la obligación de ICANN de notificar a los registradores las nuevas políticas de consenso que son de aplicación a los registradores. 2. Referencias al Departamento de Comercio de Estados Unidos: reconocimiento de la deriva de ICANN hacia posiciones independientes de dicho departamento mediante la eliminación de determinadas referencias dentro del AAR que aluden al requisito de aprobación por parte del Departamento de Comercio. 3. Requisitos de retención de datos del registrador: clarificación del requisito de retención de datos para los registradores con el fin de contar con prácticas más uniformes. Envíe comentarios sobre los cambios propuestos a raa-consultation(a)icann.org. Vea los comentarios en http://forum.icann.org/lists/raa-consultation. -- Regards, Nick Ashton-Hart, Matthias Langenegger, Frederic Teboul ICANN At-Large Staff email: staff(a)atlarge.icann.org

1 0

Reminder: Next NARALO Teleconference: Tuesday, 11th August 1900 UTC
by At-Large Staff Aug. 8, 2008

Aug. 8, 2008

Dear all, This is to remind you that the next NARALO teleconference is scheduled on Tuesday, 11 August at 1900 UTC. Please find further details for this meeting on the meeting page. An agenda will be uploaded shortly. https://st.icann.org/naralo/index.cgi?11_august_2008 -- Regards, Nick Ashton-Hart, Matthias Langenegger, Frederic Teboul ICANN At-Large Staff email: staff(a)atlarge.icann.org

1 0

[Fwd: Beware: nicir.ir DNS is grossly misconfigured]
by Jeffrey A. Williams Aug. 8, 2008

Aug. 8, 2008

FYI -------- Original Message -------- Subject: Beware: nicir.ir DNS is grossly misconfigured Date: Fri, 08 Aug 2008 03:20:31 -0700 From: "Jeffrey A. Williams" <jwkckid1(a)ix.netcom.com> Organization: IDNS and Spokesman for INEGroup To: Siavash Shahshahani <shahshah(a)irnic.ir>,ICANN SSAC Dave Piscitello <dave.piscitello(a)icann.org>,ICANN SSAC <ssac(a)icann.org>, Steve Crocker <steve(a)shinkuro.com>,"matthias.langenegger(a)icann.org" <matthias.langenegger(a)icann.org>,"ICANN Admin supp. Manager Karen Lettner" <karen.lettner(a)icann.org>,Ga <ga(a)gnso.icann.org>,DOC/NTIA ICANN Rep <aheineman(a)ntia.doc.gov>,Nick Ashton-Hart <Nick.Ashton-Hart(a)icann.org> CC: Bill Silverstein <icann-list(a)sorehands.com>,"Brendler, Beau" <Brenbe(a)consumer.org>,Carl Wallace <CWallace(a)cygnacom.com>,Carlton Samuels <carlton.samuels(a)uwimona.edu.jm>,Cheryl Langdon-Orr <cheryl(a)hovtek.com.au>,Chuck Gomes <cgomes(a)verisign.com>,"Darlene Thompson," <DThompson(a)GOV.NU.CA>,ICANN Kim Davies <kim.davies(a)icann.org>,icann legal <jeffrey(a)icann.org>,ICANN Marc Salvatierra <marc.salvatierra(a)icann.org>,ICANN Policy Staff <policy(a)icann.org>,JFC Morfin <jefsey(a)jefsey.com>,John Levine <icggov(a)johnlevine.com>, GAC Rep <ssene(a)ntia.doc.gov>,Kieren McCarthy <kieren.mccarthy(a)icann.org>,Roberto Gaetano <roberto(a)icann.org> All, Beware: Nicir.ir is grossly misconfigured and will expose you to serious danger if traffic received from any transmission from any IT protocol or application is sent to you. See: http://member.dnsstuff.com/tools/dnslite.php?domain=nicir.ir http://private.dnsstuff.com/tools/dnsreport.ch?domain=nicir.ir&token=104056… Regards, Spokesman for INEGroup LLA. - (Over 281k members/stakeholders strong!) "Obedience of the law is the greatest freedom" - Abraham Lincoln "Credit should go with the performance of duty and not with what is very often the accident of glory" - Theodore Roosevelt "If the probability be called P; the injury, L; and the burden, B; liability depends upon whether B is less than L multiplied by P: i.e., whether B is less than PL." United States v. Carroll Towing (159 F.2d 169 [2d Cir. 1947] =============================================================== Updated 1/26/04 CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. div. of Information Network Eng. INEG. INC. ABA member in good standing member ID 01257402 E-Mail jwkckid1(a)ix.netcom.com My Phone: 214-244-4827

1 0

[Fwd: Re: [ga] Kaminsky on dns bugs - Bernstein responds]
by Jeffrey A. Williams Aug. 8, 2008

Aug. 8, 2008

FYI -------- Original Message -------- Subject: Re: [ga] Kaminsky on dns bugs - Bernstein responds Date: Fri, 08 Aug 2008 02:28:30 -0700 From: "Jeffrey A. Williams" <jwkckid1(a)ix.netcom.com> Organization: IDNS and Spokesman for INEGroup To: Joe Baptista <baptista(a)publicroot.org>,DOC/NTIA ICANN Rep <aheineman(a)ntia.doc.gov>,ICANN SSAC Dave Piscitello <dave.piscitello(a)icann.org>,"matthias.langenegger(a)icann.org" <matthias.langenegger(a)icann.org>,"Nevett, Jonathon" <jnevett(a)networksolutions.com> CC: Ga <ga(a)gnso.icann.org>, icann board <icann-board(a)icann.org>,Kieren McCarthy <kieren.mccarthy(a)icann.org>,Wendy Seltzer <wendy(a)seltzer.com>,"twomey(a)icann.org" <twomey(a)icann.org>,Peter Dengate Thrush <barrister(a)chambers.gen.nz>,GAC Rep <ssene(a)ntia.doc.gov>,Cheryl Langdon-Orr <cheryl(a)hovtek.com.au>,Nick Ashton-Hart <nick.ashton-hart(a)icann.org>,"Brendler, Beau" <Brenbe(a)consumer.org>,Carl Wallace <CWallace(a)cygnacom.com>,Carlton Samuels <carlton.samuels(a)uwimona.edu.jm>,Chuck Gomes <cgomes(a)verisign.com>,"Darlene Thompson," <DThompson(a)GOV.NU.CA>,Evan Leibovitch <evan(a)telly.org>,ICANN Marc Salvatierra <marc.salvatierra(a)icann.org>,ietf-nomcom Mailing List <ietf-nomcom(a)ietf.org>,"Jacqueline A. Morris" <jam(a)jacquelinemorris.com>,Jeff Neuman <Jeff.Neuman(a)neustar.us>,"Nevett, Jonathon" <jnevett(a)networksolutions.com>,Robert Guerra <robert(a)privaterra.org>,Roland Perry <roland(a)internetpolicyagency.com>,Siavash Shahshahani <shahshah(a)irnic.ir> References: <874c02a20808081918x7955ea24yc13506a6e7dfa915(a)mail.gmail.com> Dr.Joe and all, Yes of course, some of have known for years and stated such years ago right here on the GA when the old DNSO was still in existance, myself and yourself Joe, included. It's all in the archives, which I am sure by now Kent Crispin or someone at ICANN is scowering in case "Creative" editing can be deployed or "Artistically" utilized as has been done before and also reported accordingly. But not to worry, I have two other seperately archived copies of all those archives! >:) Joe Baptista wrote: > > Well the long-awaited description of Dan Kaminsky's regarding the dns > vulnerabilities was released as a 104-slide Powerpoint presentation: > > http://www.doxpara.com/DMK_BO2K8.ppt > > On slide 34 it claims that DJB (Dr. Bernstein) WAS RIGHT. This is > something we all have known for years. But then Kaminsky went on to > hang himself by saying that DJB was "NOT PERFECT, we're seeing (and > patching, don't ask)". Kaminsky offers as an example that the > birthday attack protection was not implemented by Bernstein because he > believed port randomization was enough, and goes on to say that DJBDNS > has other known issues too. > > People this claim by Kaminsky is a load of crap and once again > furthers my claim that the recent security issues are nothing more > then the rehashing of old security problem that Bernstein addressed > years ago. > > In any case there was a response to this by Bernstein - the response > is below. As you can see Bernstein supports what I have been going on > about concerning these recent dns securities issues. The problems > have been known for years and this is nothing more then a rehash of > existing security issues to exploit user hysteria in the hope the > world can be tricked into accepting yet another useless insecure > protocol - being DNSSEC. > > I agree with Bernstein that the recent patches don't fix the problem. > In any case here is Bernsteins reply for the record. > > regards > joe baptista > > ---------- Forwarded message ---------- > From: D. J. Bernstein<djb(a)cr.yp.to> > Date: Thu, Aug 7, 2008 at 11:42 PM > Subject: Re: Kaminsky on djbdns bugs > To: dns(a)list.cr.yp.to > > Kyle Wheeler writes: > > That makes it easier for an attacker to guess the right number, but > > only somewhat (your chances per-guess go from one in four billion > to, > > say, thirty in four billion). This criticism of djbdns seems > > somewhat... well, specious. > http://cr.yp.to/djbdns/forgery.html has, for several years, stated > the > results of exactly this attack: > > The dnscache program uses a cryptographic generator for the ID and > query port to make them extremely difficult to predict. However, > > * an attacker who makes a few billion random guesses is likely to > succeed at least once; > * tens of millions of guesses are adequate with a colliding attack; > > etc. The same page also states bilateral and unilateral workarounds > that > would raise the number of guesses to "practically impossible"; but > then > focuses on the real problem, namely that "attackers with access to the > > network would still be able to forge DNS responses." > > I suppose I should be happy to see public awareness almost catching up > > to the nastiest DNS attacks I considered in 1999. However, people are > deluding themselves if they think they're protected by the current > series of patches. UIC is issuing a press release today on this topic; > > see below. > > ---D. J. Bernstein, Professor, Mathematics, Statistics, > and Computer Science, University of Illinois at Chicago > > > DNS still vulnerable, Bernstein says > > CHICAGO, Thursday 7 August 2008 - Do you bank over the Internet? If > so, > beware: recent Internet patches don't stop determined attackers. > > Network administrators have been rushing to deploy DNS source-port > randomization patches in response to an attack announced by security > researcher Dan Kaminsky last month. But the inventor of source-port > randomization said today that new security solutions are needed to > protect the Internet infrastructure. > > "Anyone who knows what he's doing can easily steal your email and > insert > fake web pages into your browser, even after you've patched," said > cryptographer Daniel J. Bernstein, a professor in the Center for > Research and Instruction in Technologies for Electronic Security > (RITES) > at the University of Illinois at Chicago. > > Bernstein's DJBDNS software introduced source-port randomization in > 1999 and is now estimated to have tens of millions of users. Bernstein > > released the DJBDNS copyright at the end of last year. > > Kaminsky said at the Black Hat conference yesterday that 120,000,000 > Internet users were now protected by patches using Bernstein's > randomization idea. But Bernstein criticized this idea, saying that it > > was "at best a speed bump for blind attackers" and "an extremely poor > substitute for proper cryptographic protection." > > DNSSEC, a cryptographic version of DNS, has been in development since > 1993 but is still not operational. Bernstein said that DNSSEC offers > "a > surprisingly low level of security" while causing severe problems for > DNS reliability and performance. > > "We need to stop wasting time on breakable patches," Bernstein said. > He > called for development of DNSSEC alternatives that quickly and > securely > reject every forged DNS packet. > > Press contact: Daniel J. Bernstein <press-20080807(a)box.cr.yp.to> > > -30- > > > -- > Joe Baptista > www.publicroot.org > PublicRoot Consortium > ---------------------------------------------------------------- > The future of the Internet is Open, Transparent, Inclusive, > Representative & Accountable to the Internet community @large. > ---------------------------------------------------------------- > Office: +1 (360) 526-6077 (extension 052) > Fax: +1 (509) 479-0084 > > Regards, Spokesman for INEGroup LLA. - (Over 281k members/stakeholders strong!) "Obedience of the law is the greatest freedom" - Abraham Lincoln "Credit should go with the performance of duty and not with what is very often the accident of glory" - Theodore Roosevelt "If the probability be called P; the injury, L; and the burden, B; liability depends upon whether B is less than L multiplied by P: i.e., whether B is less than PL." United States v. Carroll Towing (159 F.2d 169 [2d Cir. 1947] =============================================================== Updated 1/26/04 CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. div. of Information Network Eng. INEG. INC. ABA member in good standing member ID 01257402 E-Mail jwkckid1(a)ix.netcom.com My Phone: 214-244-4827

1 0

[Fwd: Re: [At-Large] Moderation of Jeff Williams]
by Jeffrey A. Williams Aug. 7, 2008

Aug. 7, 2008

-------- Original Message -------- Subject: Re: [At-Large] Moderation of Jeff Williams Date: Wed, 06 Aug 2008 21:11:18 -0700 From: "Jeffrey A. Williams" <jwkckid1(a)ix.netcom.com> Organization: IDNS and Spokesman for INEGroup To: At-Large Staff <staff(a)atlarge.icann.org>,GAC Rep <ssene(a)ntia.doc.gov>,DOC/NTIA ICANN Rep <aheineman(a)ntia.doc.gov>,Nick Ashton-Hart <nick.ashton-hart(a)icann.org>,"matthias.langenegger(a)icann.org" <matthias.langenegger(a)icann.org>,"ICANN Admin supp. Manager Karen Lettner" <karen.lettner(a)icann.org> CC: at-large(a)atlarge-lists.icann.org,Cheryl Langdon-Orr <cheryl(a)hovtek.com.au>,Dominik Filipp <dominik.filipp(a)dsoft.sk>,ICANN Kim Davies <kim.davies(a)icann.org> References: <C4C0E5D7.9DA1%staff(a)atlarge.icann.org> Nick and all, How was the post to which you refer, off topic? This is a Users organization and that post to which your refer is a user issue. Ergo it cannot by definition be "Off-Topic". At-Large Staff wrote: > Dear List Members: > > On Tuesday 5th August, Jeff Williams was notified by the Chair of the ALAC > that further off-topic postings such as that entitled ³How to carjack a top > Google exec, according to Google² would result in his posting privileges on > the public At-Large list being revoked, for a time to be decided by the > ALAC. > > Since that notification, further off-topic postings have been sent, and as a > consequence we have been asked to suspend his posting privileges. > > He will continue to receive messages from the list, however, posts sent to > the list will be bounced back to him automatically. > -- > Regards, > > Nick Ashton-Hart, Matthias Langenegger, Frederic Teboul > ICANN At-Large Staff > email: staff(a)atlarge.icann.org > > _______________________________________________ > At-Large mailing list > At-Large(a)atlarge-lists.icann.org > http://atlarge-lists.icann.org/mailman/listinfo/at-large_atlarge-lists.ican… > > At-Large Official Site: http://atlarge.icann.org Regards, Spokesman for INEGroup LLA. - (Over 281k members/stakeholders strong!) "Obedience of the law is the greatest freedom" - Abraham Lincoln "Credit should go with the performance of duty and not with what is very often the accident of glory" - Theodore Roosevelt "If the probability be called P; the injury, L; and the burden, B; liability depends upon whether B is less than L multiplied by P: i.e., whether B is less than PL." United States v. Carroll Towing (159 F.2d 169 [2d Cir. 1947] =============================================================== Updated 1/26/04 CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. div. of Information Network Eng. INEG. INC. ABA member in good standing member ID 01257402 E-Mail jwkckid1(a)ix.netcom.com My Phone: 214-244-4827

1 0

Re: [NA-Discuss] [ga] What are ICANN and VeriSign doing regarding CERT Advisory #800113 / DNS Cache Poisoning?
by Jeffrey A. Williams Aug. 6, 2008

Aug. 6, 2008

Joe and all, First, IMO, Joe is correct that DNSSEC will not save or fix any problems that are software related to DNS/BIND or client interfaces that are OS specific but were based upon what was known about Bind at the time of their creation. Second, Burnsteins DNS/BIND is only ONE version of DNS/BIND that is very secure. Our BindPlus is also very secure as well, no reported security problems reported in 49 months, and never a serious security hole found or reported sense it's release. Third, I respectfully disagree that ICANN can't do anything. They could have done allot over 6 years ago, and scoffed at anyone other than Paul Vixies Bind 8 at that time. That was a mistake, and many knew it but were silent publically. Forth, Joe is right, that with a little software Eng. forsight and expermintation most of the DNS/BIND security Holes are fixable and customizably so. What is missing is that there are very few GOOD software Eng., and even fewer that have an in depth understanding of DNS. Fifth, it is huge security problems like this that are bound to occur as long as social Eng. are making software decisions or managment decisions that are grounded in security and/or software. That's a leadership problem, and in this instance it is a ICANN leadership problem. Joe Baptista wrote: > > > On Wed, Aug 6, 2008 at 10:46 PM, George Kirikos <gkirikos(a)yahoo.com> > wrote: > > > Hello, > > Just to followup, ICANN sent out a news release earlier: > > http://www.icann.org/en/announcements/announcement-06aug > 8-en.htm > > It's a step in the right direction, to help educate folks. > However, > there's no true "fix", as the protocol itself is broken. A > move towards > DNSSEC or other secure DNS would be the only appropriate > long-term > solution. > > > There is nothing wrong with the protocol. Its the software thats the > issue. And this is easy to fix. I've run some tests and with a > little DNS magic you can make you DNS very secure. > > Another big help would be to update your software including any NAT > devices. > > The whole DNSSEC thing is another red herring in the making. > > Also there is nothing ICANN nor anyone else can do about this. The > world is running a lot of insecure servers. BIND has always been > buggy and true to form it will continue to be buggy. Have you any > idea how many buggy systems are out there. i.e. almost all of them. > Unless of course your running burnsteins DNS which already fixed this > problem a long time ago. > > It bother me that people who have no idea what the technical issues > are get so easily baited by this issue. George - let go the ICANN red > herring. Its just another smoke screen. > > The real issue here is what sort of out reach programs is ICANN > involved in to get people to upgrade and fix their buggy dns servers. > DNSSEC is not going to save them. > > cheers > joe baptista > > > > > If there's ever a cyber 9/11, as Lessig discussed at: > > http://news.slashdot.org/article.pl?sid=08/08/05/220229 > > widespread DNS cache poisoning might be one of the root > causes. > > I'd like to hear from VeriSign as to whether they're > planning to > implement DNSSEC or a secure DNS alternative for .com/net, > as PIR > intends for .org. > > Sincerely, > > George Kirikos > http://www.kirikos.com/ > > --- George Kirikos <gkirikos(a)yahoo.com> wrote: > > > > > Hello, > > > > ICANN and VeriSign have been oddly quiet over the entire > DNS cache > > poisoning issue: > > > > http://www.kb.cert.org/vuls/id/800113 > > > http://www.circleid.com/posts/87143_dns_not_a_guessing_game/ > > > > http://it.slashdot.org/article.pl?sid=08/07/08/195225&tid=172 > > > > > PIR has a pending proposal to implement DNSSEC for .org: > > > > http://www.icann.org/registries/rsep/ > > > > Is that something that VeriSign has plans to accelerate > for the > > important .com and .net registries, in order to prevent a > long-term > > meltdown in DNS confidence/trust should DNS cache > poisoning become > > widespread in August and beyond? > > > > No need for a "formal" press release, but I think the > community > > deserves to know that people are working on the long-term > solution to > > this problem, and making it a higher priority relative to > other > > lesser > > issues. > > > > Point #14 in the latest policy newsletter appears to be > the only > > "hint" > > that a few people are working on things: > > > > http://www.icann.org/topics/policy/update-jul08.htm#14 > > > > Hopefully something will happen before Cairo, as by then > there might > > be > > widespread disruptions to the internet. Perhaps the Board > might want > > to > > consider an early special meeting this week or next: > > > > http://www.icann.org/minutes/ > > > > instead of waiting until July 31st, in conjunction with > the SSAC. > > > > Sincerely, > > > > George Kirikos > > http://www.kirikos.com/ > > > > > > -- > Joe Baptista > www.publicroot.org > PublicRoot Consortium > ---------------------------------------------------------------- > The future of the Internet is Open, Transparent, Inclusive, > Representative & Accountable to the Internet community @large. > ---------------------------------------------------------------- > Office: +1 (360) 526-6077 (extension 052) > Fax: +1 (509) 479-0084 > > Regards, Spokesman for INEGroup LLA. - (Over 281k members/stakeholders strong!) "Obedience of the law is the greatest freedom" - Abraham Lincoln "Credit should go with the performance of duty and not with what is very often the accident of glory" - Theodore Roosevelt "If the probability be called P; the injury, L; and the burden, B; liability depends upon whether B is less than L multiplied by P: i.e., whether B is less than PL." United States v. Carroll Towing (159 F.2d 169 [2d Cir. 1947] =============================================================== Updated 1/26/04 CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. div. of Information Network Eng. INEG. INC. ABA member in good standing member ID 01257402 E-Mail jwkckid1(a)ix.netcom.com My Phone: 214-244-4827

1 0

Re: [NA-Discuss] [ga] What are ICANN and VeriSign doing regarding CERT Advisory #800113 / DNS Cache Poisoning?
by Jeffrey A. Williams Aug. 6, 2008

Aug. 6, 2008

George and all, Well yes this is a move in the right direction. But it is far too little and perhaps far too late as we have seen with Apple. See: See: (August 1, 2008) Apple released a patch for the recently disclosed and exploited DNS vulnerability, but while it fixes Mac OS X systems used as DNS servers, it does not protect Macs being used as client systems. Fully patched versions of both Tiger (version 10.4.11) and Leopard (version 10.5.4) do not adequately randomize DNS source ports. Apple released Security Update 2008-005 on Thursday, July 31 to address 17 flaws in its OS X operating system. - From Internet Storm Center: http://isc.sans.org/diary.html?storyid=4810 A quick packet dump of my fully patched Leopard machine (OS X 10.5.4) shows it is - as a DNS client - still using incrementing ports. http://www.theregister.co.uk/2008/08/01/osx_still_vulnerable/print.html http://www.informationweek.com/news/hardware/mac/showArticle.jhtml?articleI… http://www.computerworld.com/action/article.do?command=viewArticleBasic&art… Secondly, it wasn't Dan k. that origanally made note of this and many other DNS security holes that can expose users to serious danger. That was done back in 2001 on the old DNSO GA mailing list. George Kirikos wrote: > Hello, > > Just to followup, ICANN sent out a news release earlier: > > http://www.icann.org/en/announcements/announcement-06aug08-en.htm > > It's a step in the right direction, to help educate folks. However, > there's no true "fix", as the protocol itself is broken. A move towards > DNSSEC or other secure DNS would be the only appropriate long-term > solution. > > If there's ever a cyber 9/11, as Lessig discussed at: > > http://news.slashdot.org/article.pl?sid=08/08/05/220229 > > widespread DNS cache poisoning might be one of the root causes. > > I'd like to hear from VeriSign as to whether they're planning to > implement DNSSEC or a secure DNS alternative for .com/net, as PIR > intends for .org. > > Sincerely, > > George Kirikos > http://www.kirikos.com/ > > --- George Kirikos <gkirikos(a)yahoo.com> wrote: > > > > > Hello, > > > > ICANN and VeriSign have been oddly quiet over the entire DNS cache > > poisoning issue: > > > > http://www.kb.cert.org/vuls/id/800113 > > http://www.circleid.com/posts/87143_dns_not_a_guessing_game/ > > http://it.slashdot.org/article.pl?sid=08/07/08/195225&tid=172 > > > > PIR has a pending proposal to implement DNSSEC for .org: > > > > http://www.icann.org/registries/rsep/ > > > > Is that something that VeriSign has plans to accelerate for the > > important .com and .net registries, in order to prevent a long-term > > meltdown in DNS confidence/trust should DNS cache poisoning become > > widespread in August and beyond? > > > > No need for a "formal" press release, but I think the community > > deserves to know that people are working on the long-term solution to > > this problem, and making it a higher priority relative to other > > lesser > > issues. > > > > Point #14 in the latest policy newsletter appears to be the only > > "hint" > > that a few people are working on things: > > > > http://www.icann.org/topics/policy/update-jul08.htm#14 > > > > Hopefully something will happen before Cairo, as by then there might > > be > > widespread disruptions to the internet. Perhaps the Board might want > > to > > consider an early special meeting this week or next: > > > > http://www.icann.org/minutes/ > > > > instead of waiting until July 31st, in conjunction with the SSAC. > > > > Sincerely, > > > > George Kirikos > > http://www.kirikos.com/ Regards, Spokesman for INEGroup LLA. - (Over 281k members/stakeholders strong!) "Obedience of the law is the greatest freedom" - Abraham Lincoln "Credit should go with the performance of duty and not with what is very often the accident of glory" - Theodore Roosevelt "If the probability be called P; the injury, L; and the burden, B; liability depends upon whether B is less than L multiplied by P: i.e., whether B is less than PL." United States v. Carroll Towing (159 F.2d 169 [2d Cir. 1947] =============================================================== Updated 1/26/04 CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. div. of Information Network Eng. INEG. INC. ABA member in good standing member ID 01257402 E-Mail jwkckid1(a)ix.netcom.com My Phone: 214-244-4827

1 0

Re: [NA-Discuss] [At-Large] Rogue pharmacy sites -- outrageous
by Jeffrey A. Williams Aug. 6, 2008

Aug. 6, 2008

Beau and all, Currently this is an ICANN responsibility that ICANN cannot clearly manage properly, and is reluctant to take responsibility for. Yet it is ICANN that "Created" these registrars and the RAA contracts for. So we will continue to see these sorts of abuse unless or until ICANN takes action in a reasonable amount of time, or DOC/NTIA intervenes. At this juncture, I prefer the latter. "Brendler, Beau" wrote: > http://www.knujon.com/news.html#08052008 > > This was passed on to me by a friend at Berkman affiliated with the > StopBadware.org project (http://www.stopbadware.org) > > >From the text: "This is an example of a practice we have seen all too > frequently where Internet companies will remove sites temporarily for > reported policy violations only to restore them shortly afterwards. In > some cases the domains move from one Registrar to another (occasionally > two Registrars with the same parent company, however), but this is a > situation where the domains went right back where they were before. > DIRECT INFO/PUBLICDOMAINREGISTRY was rated the 9th Worst Registrar in > terms of sponsoring spam sites previously." > > What provisions in the revised RAA address this sort of issue from a > consumer perspective? Or is this considered "outside ICANN's scope"? > > **************************************************************************** > ******** > SCANNED > > **************************************************************************** > ******** > > _______________________________________________ > At-Large mailing list > At-Large(a)atlarge-lists.icann.org > http://atlarge-lists.icann.org/mailman/listinfo/at-large_atlarge-lists.ican… > > At-Large Official Site: http://atlarge.icann.org All, Yet another too soon.knee jerk claim by Apple. See: (August 1, 2008) Apple released a patch for the recently disclosed and exploited DNS vulnerability, but while it fixes Mac OS X systems used as DNS servers, it does not protect Macs being used as client systems. Fully patched versions of both Tiger (version 10.4.11) and Leopard (version 10.5.4) do not adequately randomize DNS source ports. Apple released Security Update 2008-005 on Thursday, July 31 to address 17 flaws in its OS X operating system. - From Internet Storm Center: http://isc.sans.org/diary.html?storyid=4810 A quick packet dump of my fully patched Leopard machine (OS X 10.5.4) shows it is - as a DNS client - still using incrementing ports. http://www.theregister.co.uk/2008/08/01/osx_still_vulnerable/print.html http://www.informationweek.com/news/hardware/mac/showArticle.jhtml?articleI… http://www.computerworld.com/action/article.do?command=viewArticleBasic&art… Regards, Spokesman for INEGroup LLA. - (Over 281k members/stakeholders strong!) "Obedience of the law is the greatest freedom" - Abraham Lincoln "Credit should go with the performance of duty and not with what is very often the accident of glory" - Theodore Roosevelt "If the probability be called P; the injury, L; and the burden, B; liability depends upon whether B is less than L multiplied by P: i.e., whether B is less than PL." United States v. Carroll Towing (159 F.2d 169 [2d Cir. 1947] =============================================================== Updated 1/26/04 CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. div. of Information Network Eng. INEG. INC. ABA member in good standing member ID 01257402 E-Mail jwkckid1(a)ix.netcom.com My Phone: 214-244-4827

1 0

[Fwd: [Fwd 9th false reason given to: Request to mailing list NA-Discuss rejected]]
by Jeffrey A. Williams Aug. 6, 2008

Aug. 6, 2008

-------- Original Message -------- Subject: [Fwd 9th false reason given to: Request to mailing list NA-Discuss rejected] Date: Tue, 05 Aug 2008 20:14:19 -0700 From: "Jeffrey A. Williams" <jwkckid1(a)ix.netcom.com> Organization: IDNS and Spokesman for INEGroup To: "matthias.langenegger(a)icann.org" <matthias.langenegger(a)icann.org>,Nick Ashton-Hart <nick.ashton-hart(a)icann.org>,GAC Rep <ssene(a)ntia.doc.gov> CC: DOC/NTIA ICANN Rep <aheineman(a)ntia.doc.gov>,na-discuss-owner(a)atlarge-lists.icann.org,Wendy Seltzer <wendy(a)seltzer.com> Mattias and all, Yet again this is a false reason given. There were only 4 recipients which last I checked is less than 5, which is the max number of recipients according to Nicks most recent announcment. -------- Original Message -------- Subject: Request to mailing list NA-Discuss rejected Date: Wed, 06 Aug 2008 08:08:34 -0400 From: na-discuss-bounces(a)atlarge-lists.icann.org To: jwkckid1(a)ix.netcom.com Your request to the NA-Discuss mailing list Posting of your message titled "How to carjack a top Google exec, according to Google" has been rejected by the list moderator. The moderator gave the following reason for rejecting your request: "Too many recipients to the message" Any questions or comments should be directed to the list administrator at: na-discuss-owner(a)atlarge-lists.icann.org Regards, Spokesman for INEGroup LLA. - (Over 281k members/stakeholders strong!) "Obedience of the law is the greatest freedom" - Abraham Lincoln "Credit should go with the performance of duty and not with what is very often the accident of glory" - Theodore Roosevelt "If the probability be called P; the injury, L; and the burden, B; liability depends upon whether B is less than L multiplied by P: i.e., whether B is less than PL." United States v. Carroll Towing (159 F.2d 169 [2d Cir. 1947] =============================================================== Updated 1/26/04 CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. div. of Information Network Eng. INEG. INC. ABA member in good standing member ID 01257402 E-Mail jwkckid1(a)ix.netcom.com My Phone: 214-244-4827

1 0

Resend of:Apple DNS Patch Doesn't Fix Client Versions of OS X
by Jeffrey A. Williams Aug. 6, 2008

Aug. 6, 2008

All, Sorry that the list moderator/admin. has trouble counting to 5. So I have resent the below Email... Yet another too soon.knee jerk claim by Apple. See: (August 1, 2008) Apple released a patch for the recently disclosed and exploited DNS vulnerability, but while it fixes Mac OS X systems used as DNS servers, it does not protect Macs being used as client systems. Fully patched versions of both Tiger (version 10.4.11) and Leopard (version 10.5.4) do not adequately randomize DNS source ports. Apple released Security Update 2008-005 on Thursday, July 31 to address 17 flaws in its OS X operating system. - From Internet Storm Center: http://isc.sans.org/diary.html?storyid=4810 A quick packet dump of my fully patched Leopard machine (OS X 10.5.4) shows it is - as a DNS client - still using incrementing ports. http://www.theregister.co.uk/2008/08/01/osx_still_vulnerable/print.html http://www.informationweek.com/news/hardware/mac/showArticle.jhtml?articleI… http://www.computerworld.com/action/article.do?command=viewArticleBasic&art… Regards, Spokesman for INEGroup LLA. - (Over 281k members/stakeholders strong!) "Obedience of the law is the greatest freedom" - Abraham Lincoln "Credit should go with the performance of duty and not with what is very often the accident of glory" - Theodore Roosevelt "If the probability be called P; the injury, L; and the burden, B; liability depends upon whether B is less than L multiplied by P: i.e., whether B is less than PL." United States v. Carroll Towing (159 F.2d 169 [2d Cir. 1947] =============================================================== Updated 1/26/04 CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. div. of Information Network Eng. INEG. INC. ABA member in good standing member ID 01257402 E-Mail jwkckid1(a)ix.netcom.com My Phone: 214-244-4827

1 0