September 2010 - NA-Discuss

REMINDER: NARALO TELECONFERENCE - Monday, 09 August 2010 @ 19:00 UTC
by ICANN At-Large Staff Nov. 5, 2010

Nov. 5, 2010

Dear All, The next NARALO Teleconference is scheduled for Monday, 09 August 2010 at 1900 UTC. The agenda (to be updated) and call details can be found at: https://st.icann.org/naralo/index.cgi?09_august_2010 If you are unable to attend the call please send an email indicating your absence and we will note this information on the agenda. If you require a dial-out please contact At-Large staff at: staff(a)atlarge.icann.org. -- Regards, Heidi Ullrich, Matthias Langenegger, Seth Greene, Gisella Gruber-White, Marilyn Vernon, Kristina Nordström ICANN At-Large Staff

2 5

Re: [NA-Discuss] Policy Failure Enables Mass Malware: Part II(ICANN and OnlineNIC)
by Garth Bruen at KnujOn Sept. 30, 2010

Sept. 30, 2010

Update to the update: SECURETABS[DOT]NET replaced with SECURETABS[DOT]ORG, still at OnlineNIC! > -------- Original Message -------- > Subject: Re: [NA-Discuss] Policy Failure Enables Mass Malware: Part > II(ICANN and OnlineNIC) > From: <gbruen(a)knujon.com> > Date: Thu, September 30, 2010 8:12 am > To: <na-discuss(a)atlarge-lists.icann.org> > > > SECURETABS[DOT]NET is now finally offline after 74 days, but there are still > three other malware-redirected domains in this scheme: GENERICTAB.COM > (TUCOWS), CHEAPDRUGSNORX.COM (OnlineNIC), BESTGENERICPHARMA.COM (DIRECTNIC). > The domain that controls the rotation of these sites: PHARM-TRACKER.COM is > also sponsored by OnLineNIC. All described in the full report: > http://www.knujon.com/WDPRS_failures_malware_intrusion_securetabsDOTnet_Knu… > > -------------------------------------------------- > From: <gbruen(a)knujon.com> > Sent: Wednesday, September 29, 2010 7:21 PM > To: "Michele Neylon :: Blacknight" <michele(a)blacknight.ie> > Cc: <na-discuss(a)atlarge-lists.icann.org> > Subject: Re: [NA-Discuss] Policy Failure Enables Mass Malware: Part II(ICANN > and OnlineNIC) > > > Michele, > > > > I've made it quite clear. The unlicensed pharmacy domain promoted through > > thousands of hacked websites has false WHOIS which they failed to correct > > within the stipulated time. The sponsoring Registrar failed to investigate > > and suspend the domain within the stipulated time. ICANN failed to address > > the original complaint against the domain with the Registrar and > > completely > > botched the complaint against the Registrar. > > > > Would you still feel the same if it were your site that was hacked on > > behalf > > of a non-compliant sponsored by a non-compliant Registrar? > > > > You'll see in our follow-up next week how a Registrar was actually the > > VICTIM of such a scheme. Some might even say this was an "attack" from a > > competing domain company. > > > > -Garth > > > > -------------------------------------------------- > > From: "Michele Neylon :: Blacknight" <michele(a)blacknight.ie> > > Sent: Wednesday, September 29, 2010 4:43 PM > > To: "Garth Bruen at KnujOn" <gbruen(a)knujon.com> > > Cc: <wendy(a)seltzer.com>; <na-discuss(a)atlarge-lists.icann.org> > > Subject: Re: [NA-Discuss] Policy Failure Enables Mass Malware: Part II > > (ICANN and OnlineNIC) > > > >> And what exactly are those roles? > >> > >> I know I may live to regret asking, but I would love to know. > >> > >> Or is this one of those "let's make it ICANN's problem since registrars > >> are obviously evil"? > >> > >> > >> Mr. Michele Neylon > >> Blacknight > >> http://Blacknight.tel > >> > >> Via iPhone so excuse typos and brevity > >> > >> On 29 Sep 2010, at 22:34, "Garth Bruen at KnujOn" <gbruen(a)knujon.com> > >> wrote: > >> > >>> That's kind of a leap in logic, we're talking about specific icann roles > >>> > >>> > >>>> -------- Original Message -------- > >>>> Subject: Re: [NA-Discuss] Policy Failure Enables Mass Malware: Part II > >>>> (ICANN and OnlineNIC) > >>>> From: Wendy Seltzer <wendy(a)seltzer.com> > >>>> Date: Wed, September 29, 2010 4:26 pm > >>>> To: Garth Bruen at KnujOn <gbruen(a)knujon.com> > >>>> Cc: Evan Leibovitch <evan(a)telly.org>, > >>>> na-discuss(a)atlarge-lists.icann.org > >>>> > >>>> And I suppose you'd support COICA, the US proposal to censor domain > >>>> names "dedicated to infringing activity" too? > >>>> > >>>> I certainly would not want to see ICANN in here. > >>>> <http://wendy.seltzer.org/blog/archives/2010/09/21/copyright-censorship-and-…> > >>>> > >>>> --Wendy > >>>> > >>>> On 09/29/2010 03:34 PM, Garth Bruen at KnujOn wrote: > >>>>> I believe there is an ATRT meeting next month here in Boston, not sure > >>>>> where yet, would be happy to participate. > >>>>> > >>>>> > >>>>> > >>>>>> -------- Original Message -------- > >>>>>> Subject: Re: [NA-Discuss] Policy Failure Enables Mass Malware: Part > >>>>>> II > >>>>>> (ICANN and OnlineNIC) > >>>>>> From: Evan Leibovitch <evan(a)telly.org> > >>>>>> Date: Wed, September 29, 2010 3:22 pm > >>>>>> To: Beau Brendler <beaubrendler(a)earthlink.net> > >>>>>> Cc: Garth Bruen at KnujOn <gbruen(a)knujon.com>, > >>>>>> na-discuss(a)atlarge-lists.icann.org > >>>>>> > >>>>>> > >>>>>> On 29 September 2010 15:11, Beau Brendler > >>>>>> <beaubrendler(a)earthlink.net>wrote: > >>>>>> > >>>>>>> > >>>>>>> "ICANN’s vice president of government affairs for the Americas, > >>>>>>> Jamie > >>>>>>> Hedlund, said the meeting was “outside the scope of our role as the > >>>>>>> technical coordinator of the Internet’s unique identifiers.” > >>>>>>> > >>>>>>> How is enforcing the provisions of the RAA outside the scope of its > >>>>>>> role? > >>>>>>> > >>>>>>> > >>>>>> I smell another ATRT submission.... > >>>>>> > >>>>>> This is worth escalating to the global At-Large lists, IMO. > >>>>>> > >>>>>> - Evan > >>>>> > >>>>> > >>>>> ------ > >>>>> NA-Discuss mailing list > >>>>> NA-Discuss(a)atlarge-lists.icann.org > >>>>> https://atlarge-lists.icann.org/mailman/listinfo/na-discuss > >>>>> > >>>>> Visit the NARALO online at http://www.naralo.org > >>>>> ------ > >>>> > >>>> > >>>> -- > >>>> Wendy Seltzer -- wendy(a)seltzer.org +1 914-374-0613 > >>>> Fellow, Princeton Center for Information Technology Policy > >>>> Fellow, Berkman Center for Internet & Society at Harvard University > >>>> http://cyber.law.harvard.edu/seltzer.html > >>>> http://www.chillingeffects.org/ > >>>> https://www.torproject.org/ > >>>> http://www.freedom-to-tinker.com/ > >>> ------ > >>> NA-Discuss mailing list > >>> NA-Discuss(a)atlarge-lists.icann.org > >>> https://atlarge-lists.icann.org/mailman/listinfo/na-discuss > >>> > >>> Visit the NARALO online at http://www.naralo.org > >>> ------ > >> > > ------ > > NA-Discuss mailing list > > NA-Discuss(a)atlarge-lists.icann.org > > https://atlarge-lists.icann.org/mailman/listinfo/na-discuss > > > > Visit the NARALO online at http://www.naralo.org > > ------ > > > ------ > NA-Discuss mailing list > NA-Discuss(a)atlarge-lists.icann.org > https://atlarge-lists.icann.org/mailman/listinfo/na-discuss > > Visit the NARALO online at http://www.naralo.org > ------

1 0

Re: [NA-Discuss] Policy Failure Enables Mass Malware: Part II (ICANN and OnlineNIC)
by Garth Bruen at KnujOn Sept. 30, 2010

Sept. 30, 2010

That's kind of a leap in logic, we're talking about specific icann roles > -------- Original Message -------- > Subject: Re: [NA-Discuss] Policy Failure Enables Mass Malware: Part II > (ICANN and OnlineNIC) > From: Wendy Seltzer <wendy(a)seltzer.com> > Date: Wed, September 29, 2010 4:26 pm > To: Garth Bruen at KnujOn <gbruen(a)knujon.com> > Cc: Evan Leibovitch <evan(a)telly.org>, > na-discuss(a)atlarge-lists.icann.org > > And I suppose you'd support COICA, the US proposal to censor domain > names "dedicated to infringing activity" too? > > I certainly would not want to see ICANN in here. > <http://wendy.seltzer.org/blog/archives/2010/09/21/copyright-censorship-and-…> > > --Wendy > > On 09/29/2010 03:34 PM, Garth Bruen at KnujOn wrote: > > I believe there is an ATRT meeting next month here in Boston, not sure > > where yet, would be happy to participate. > > > > > > > >> -------- Original Message -------- > >> Subject: Re: [NA-Discuss] Policy Failure Enables Mass Malware: Part II > >> (ICANN and OnlineNIC) > >> From: Evan Leibovitch <evan(a)telly.org> > >> Date: Wed, September 29, 2010 3:22 pm > >> To: Beau Brendler <beaubrendler(a)earthlink.net> > >> Cc: Garth Bruen at KnujOn <gbruen(a)knujon.com>, > >> na-discuss(a)atlarge-lists.icann.org > >> > >> > >> On 29 September 2010 15:11, Beau Brendler <beaubrendler(a)earthlink.net>wrote: > >> > >>> > >>> "ICANN’s vice president of government affairs for the Americas, Jamie > >>> Hedlund, said the meeting was “outside the scope of our role as the > >>> technical coordinator of the Internet’s unique identifiers.” > >>> > >>> How is enforcing the provisions of the RAA outside the scope of its role? > >>> > >>> > >> I smell another ATRT submission.... > >> > >> This is worth escalating to the global At-Large lists, IMO. > >> > >> - Evan > > > > > > ------ > > NA-Discuss mailing list > > NA-Discuss(a)atlarge-lists.icann.org > > https://atlarge-lists.icann.org/mailman/listinfo/na-discuss > > > > Visit the NARALO online at http://www.naralo.org > > ------ > > > -- > Wendy Seltzer -- wendy(a)seltzer.org +1 914-374-0613 > Fellow, Princeton Center for Information Technology Policy > Fellow, Berkman Center for Internet & Society at Harvard University > http://cyber.law.harvard.edu/seltzer.html > http://www.chillingeffects.org/ > https://www.torproject.org/ > http://www.freedom-to-tinker.com/

3 3

Policy Failure Enables Mass Malware: Part II (ICANN and OnlineNIC)
by Garth Bruen at KnujOn Sept. 29, 2010

Sept. 29, 2010

Folks, On Wednesday September 29th at 1PM there will be a meeting in the Old Executive Building in Washington D.C. with Registries and domain Registrars to discuss illegal Internet sales of prescription drugs (http://techdailydose.nationaljournal.com/2010/09/white-house-to-meet-with-i…) ICANN was originally invited but declined citing “inappropriateness” (http://domainincite.com/icann-will-not-attend-white-house-drugs-meeting/) One “U.S.” Registrar who definitely will not be in attendance is OnlineNIC. It has been known for some time that OnlineNIC’s purported Oakland California address is false (http://dotsnews.com/domain-name-news/184) and that they have been caught directly involved in cyber-squatting and counterfeiting schemes that cost them millions in out-of-court settlements (http://www.thedomains.com/2009/03/12/onlinenic-settles-with-microsoft-appea…) However, the core issue relates to an illicit pharmacy domain sponsored by OnlineNIC which has been found in thousands of hacked websites infected with a PHP redirection. KnujOn first found this malicious redirection in July, 2010 and discovered the target domain, SECURETABS[DOT]NET, had a false WHOIS record and we appropriately filed a complaint with ICANN on July 18, 2010. Under the ICANN Registrar Accreditation Agreement the domain owner has 15 days to correct WHOIS inaccuracies and the Registrar has 45 days to investigate the complaint (http://www.icann.org/en/registrars/ra-agreement-21may09-en.htm#3) If the registrant fails to respond their domain must be deleted. The Registrar is required to investigate and if they fail to it could be considered a material breach of their contract with ICANN. In this case both deadlines have passed without correction or deletion. OnlineNIC has yet to respond to multiple inquires about this. The Malicious Intrusions Continue As with our last report on Malware and Policy Failure (http://www.circleid.com/posts/20100922_policy_failure_enables_mass_malware_…) single illegal pharmacy shop sites that somehow evade detection and policy enforcement impact thousands or even millions of innocent websites. It provides motivation and opportunity to keep spreading the malware that drives Internet users to illegal transaction sites without their consent. This particular malicious code has been found at Earlham College, the University of Illinois, the University of Delaware, Lord Fairfax Community College, the University of Alaska, and Toccoa Falls College. While public institutions are frequent targets of these attacks because of their typically large networks, multiple access points, and constantly changing student populations private sites are just as vulnerable. We even found one infection on a local Fox News affiliate in Houston. KnujOn currently estimates the number of websites infected with some kind of illicit pharmacy-related redirect to be in the millions. Policy Enforcement from ICANN While ICANN has continuously stated they have no enforcement powers, this type of domain abuse is actually within their mandate. Because OnlineNIC is itself a rogue Registrar they cannot be counted on to follow policy, it is ICANN’s role to hold the Registrar responsible. In the case of OnlineNIC it should be an easy call considering their history, but ICANN recently renewed OnlineNIC’s contract for another five years even though they have failed to comply with RAA 3.16 (http://www.icann.org/en/registrars/ra-agreement-21may09-en.htm#3) and may be de-accredited under RAA 5.3.2 (http://www.icann.org/en/registrars/ra-agreement-21may09-en.htm#5) because of a judgment against them in a suit filed by Louis Vuitton (http://docs.justia.com/cases/federal/district-courts/california/candce/3:20…) Because OnlineNIC is allowed to exist SECURETABS[DOT]NET exists. Because SECURETABS[DOT]NET exists the Internet is being flooded with silent intrusions and malicious code injections. Rejection of Registrar Complaint by ICANN ICANN has a secondary process for filing complaints against Registrars but in this case it failed. KnujOn followed ICANN’s instructions (http://www.icann.org/en/compliance/faq.html) for filing a complaint against a Registrar. On September 16, 2010 after OnlineNIC failed to comply with the contracted obligations concerning SECURETABS[DOT]NET. Instead of seeing SECURETABS[DOT]NET suspended and OnlineNIC admonished, our complaint was rejected with the claim we had filed the wrong form. It has now been 73 days since our initial complaint about SECURETABS[DOT]NET, and the site is still active and continues to appear in new website intrusions. Until ICANN fully grasps the nature of this threat and their ability to thwart it through their normal duties, the problem will grow. In Part III we reveal a notorious intrusion and malware download traced right to another policy failure at another troubled Registrar. -Garth More information: http://www.circleid.com/posts/20100929_policy_failure_enables_mass_malware_… http://www.knujon.com/blog.html ------------------------------------- Garth Bruen gbruen(a)knujon.com http://www.knujon.com http://www.linkedin.com/pub/4/149/724 Linkedin Group: http://www.linkedin.com/groups?gid=1870205 Blog: http://www.circleid.com/members/3296/ Twitter: @Knujon

3 2

Re: [NA-Discuss] Policy Failure Enables Mass Malware: Part II (ICANN and OnlineNIC)
by Beau Brendler Sept. 29, 2010

Sept. 29, 2010

We're talking about the RAA, and Oakland-based, uh, excuse me, Xiamen-based [http://www.icann.org/en/tlds/pro1/pdf/rop_exhibit_a5.pdf] OnlineNIC. Is someone going to tell me with a straight face that RAA compliance is outside ICANN's scope? Is ICANN now some sort of compact of free association among the 195-odd countries of the world with the GAC as suzerain? And no, I don't support COICA, in much the same way as my opinion on ICANN's role in contractual compliance doesn't mean that I listen to Barry Manilow or won't eat green curry. -----Original Message----- >From: "Michele Neylon :: Blacknight" <michele(a)blacknight.ie> >Sent: Sep 29, 2010 4:43 PM >To: Garth Bruen at KnujOn <gbruen(a)knujon.com> >Cc: "na-discuss(a)atlarge-lists.icann.org" <na-discuss(a)atlarge-lists.icann.org> >Subject: Re: [NA-Discuss] Policy Failure Enables Mass Malware: Part II (ICANN and OnlineNIC) > >And what exactly are those roles? > >I know I may live to regret asking, but I would love to know. > >Or is this one of those "let's make it ICANN's problem since registrars are obviously evil"? > > >Mr. Michele Neylon >Blacknight >http://Blacknight.tel > >Via iPhone so excuse typos and brevity > >On 29 Sep 2010, at 22:34, "Garth Bruen at KnujOn" <gbruen(a)knujon.com> wrote: > >> That's kind of a leap in logic, we're talking about specific icann roles >> >> >>> -------- Original Message -------- >>> Subject: Re: [NA-Discuss] Policy Failure Enables Mass Malware: Part II >>> (ICANN and OnlineNIC) >>> From: Wendy Seltzer <wendy(a)seltzer.com> >>> Date: Wed, September 29, 2010 4:26 pm >>> To: Garth Bruen at KnujOn <gbruen(a)knujon.com> >>> Cc: Evan Leibovitch <evan(a)telly.org>, >>> na-discuss(a)atlarge-lists.icann.org >>> >>> And I suppose you'd support COICA, the US proposal to censor domain >>> names "dedicated to infringing activity" too? >>> >>> I certainly would not want to see ICANN in here. >>> <http://wendy.seltzer.org/blog/archives/2010/09/21/copyright-censorship-and-…> >>> >>> --Wendy >>> >>> On 09/29/2010 03:34 PM, Garth Bruen at KnujOn wrote: >>>> I believe there is an ATRT meeting next month here in Boston, not sure >>>> where yet, would be happy to participate. >>>> >>>> >>>> >>>>> -------- Original Message -------- >>>>> Subject: Re: [NA-Discuss] Policy Failure Enables Mass Malware: Part II >>>>> (ICANN and OnlineNIC) >>>>> From: Evan Leibovitch <evan(a)telly.org> >>>>> Date: Wed, September 29, 2010 3:22 pm >>>>> To: Beau Brendler <beaubrendler(a)earthlink.net> >>>>> Cc: Garth Bruen at KnujOn <gbruen(a)knujon.com>, >>>>> na-discuss(a)atlarge-lists.icann.org >>>>> >>>>> >>>>> On 29 September 2010 15:11, Beau Brendler <beaubrendler(a)earthlink.net>wrote: >>>>> >>>>>> >>>>>> "ICANN’s vice president of government affairs for the Americas, Jamie >>>>>> Hedlund, said the meeting was “outside the scope of our role as the >>>>>> technical coordinator of the Internet’s unique identifiers.” >>>>>> >>>>>> How is enforcing the provisions of the RAA outside the scope of its role? >>>>>> >>>>>> >>>>> I smell another ATRT submission.... >>>>> >>>>> This is worth escalating to the global At-Large lists, IMO. >>>>> >>>>> - Evan >>>> >>>> >>>> ------ >>>> NA-Discuss mailing list >>>> NA-Discuss(a)atlarge-lists.icann.org >>>> https://atlarge-lists.icann.org/mailman/listinfo/na-discuss >>>> >>>> Visit the NARALO online at http://www.naralo.org >>>> ------ >>> >>> >>> -- >>> Wendy Seltzer -- wendy(a)seltzer.org +1 914-374-0613 >>> Fellow, Princeton Center for Information Technology Policy >>> Fellow, Berkman Center for Internet & Society at Harvard University >>> http://cyber.law.harvard.edu/seltzer.html >>> http://www.chillingeffects.org/ >>> https://www.torproject.org/ >>> http://www.freedom-to-tinker.com/ >> ------ >> NA-Discuss mailing list >> NA-Discuss(a)atlarge-lists.icann.org >> https://atlarge-lists.icann.org/mailman/listinfo/na-discuss >> >> Visit the NARALO online at http://www.naralo.org >> ------ > >------ >NA-Discuss mailing list >NA-Discuss(a)atlarge-lists.icann.org >https://atlarge-lists.icann.org/mailman/listinfo/na-discuss > >Visit the NARALO online at http://www.naralo.org >------

1 0

Re: [NA-Discuss] Policy Failure Enables Mass Malware: Part II (ICANN and OnlineNIC)
by Garth Bruen at KnujOn Sept. 29, 2010

Sept. 29, 2010

I believe there is an ATRT meeting next month here in Boston, not sure where yet, would be happy to participate. > -------- Original Message -------- > Subject: Re: [NA-Discuss] Policy Failure Enables Mass Malware: Part II > (ICANN and OnlineNIC) > From: Evan Leibovitch <evan(a)telly.org> > Date: Wed, September 29, 2010 3:22 pm > To: Beau Brendler <beaubrendler(a)earthlink.net> > Cc: Garth Bruen at KnujOn <gbruen(a)knujon.com>, > na-discuss(a)atlarge-lists.icann.org > > > On 29 September 2010 15:11, Beau Brendler <beaubrendler(a)earthlink.net>wrote: > > > > > "ICANN’s vice president of government affairs for the Americas, Jamie > > Hedlund, said the meeting was “outside the scope of our role as the > > technical coordinator of the Internet’s unique identifiers.” > > > > How is enforcing the provisions of the RAA outside the scope of its role? > > > > > I smell another ATRT submission.... > > This is worth escalating to the global At-Large lists, IMO. > > - Evan

2 1

Re: [NA-Discuss] Policy Failure Enables Mass Malware: Part II (ICANN and OnlineNIC)
by Beau Brendler Sept. 29, 2010

Sept. 29, 2010

"ICANN’s vice president of government affairs for the Americas, Jamie Hedlund, said the meeting was “outside the scope of our role as the technical coordinator of the Internet’s unique identifiers.” How is enforcing the provisions of the RAA outside the scope of its role? This is nonsensical, and an embarrassment. Obviously there was some other political conversation that was had high up about -- something -- that we're not being told. Oh, that and the fact ICANN has a dys(non)functional compliance section. -----Original Message----- >From: Garth Bruen at KnujOn <gbruen(a)knujon.com> >Sent: Sep 29, 2010 2:21 PM >To: na-discuss(a)atlarge-lists.icann.org >Subject: [NA-Discuss] Policy Failure Enables Mass Malware: Part II (ICANN and OnlineNIC) > >Folks, > >On Wednesday September 29th at 1PM there will be a meeting in the Old >Executive Building in Washington D.C. with Registries and domain >Registrars to discuss illegal Internet sales of prescription drugs >(http://techdailydose.nationaljournal.com/2010/09/white-house-to-meet-with-i…) >ICANN was originally invited but declined citing “inappropriateness” >(http://domainincite.com/icann-will-not-attend-white-house-drugs-meeting/) >One “U.S.” Registrar who definitely will not be in attendance is >OnlineNIC. It has been known for some time that OnlineNIC’s purported >Oakland California address is false >(http://dotsnews.com/domain-name-news/184) and that they have been >caught directly involved in cyber-squatting and counterfeiting schemes >that cost them millions in out-of-court settlements >(http://www.thedomains.com/2009/03/12/onlinenic-settles-with-microsoft-appea…) >However, the core issue relates to an illicit pharmacy domain sponsored >by OnlineNIC which has been found in thousands of hacked websites >infected with a PHP redirection. KnujOn first found this malicious >redirection in July, 2010 and discovered the target domain, >SECURETABS[DOT]NET, had a false WHOIS record and we appropriately filed >a complaint with ICANN on July 18, 2010. Under the ICANN Registrar >Accreditation Agreement the domain owner has 15 days to correct WHOIS >inaccuracies and the Registrar has 45 days to investigate the complaint >(http://www.icann.org/en/registrars/ra-agreement-21may09-en.htm#3) If >the registrant fails to respond their domain must be deleted. The >Registrar is required to investigate and if they fail to it could be >considered a material breach of their contract with ICANN. In this case >both deadlines have passed without correction or deletion. OnlineNIC has >yet to respond to multiple inquires about this. > > >The Malicious Intrusions Continue > >As with our last report on Malware and Policy Failure >(http://www.circleid.com/posts/20100922_policy_failure_enables_mass_malware_…) >single illegal pharmacy shop sites that somehow evade detection and >policy enforcement impact thousands or even millions of innocent >websites. It provides motivation and opportunity to keep spreading the >malware that drives Internet users to illegal transaction sites without >their consent. This particular malicious code has been found at Earlham >College, the University of Illinois, the University of Delaware, Lord >Fairfax Community College, the University of Alaska, and Toccoa Falls >College. While public institutions are frequent targets of these attacks >because of their typically large networks, multiple access points, and >constantly changing student populations private sites are just as >vulnerable. We even found one infection on a local Fox News affiliate in >Houston. KnujOn currently estimates the number of websites infected with >some kind of illicit pharmacy-related redirect to be in the millions. > > >Policy Enforcement from ICANN > >While ICANN has continuously stated they have no enforcement powers, >this type of domain abuse is actually within their mandate. Because >OnlineNIC is itself a rogue Registrar they cannot be counted on to >follow policy, it is ICANN’s role to hold the Registrar responsible. >In the case of OnlineNIC it should be an easy call considering their >history, but ICANN recently renewed OnlineNIC’s contract for another >five years even though they have failed to comply with RAA 3.16 >(http://www.icann.org/en/registrars/ra-agreement-21may09-en.htm#3) and >may be de-accredited under RAA 5.3.2 >(http://www.icann.org/en/registrars/ra-agreement-21may09-en.htm#5) >because of a judgment against them in a suit filed by Louis Vuitton >(http://docs.justia.com/cases/federal/district-courts/california/candce/3:20…) >Because OnlineNIC is allowed to exist SECURETABS[DOT]NET exists. Because >SECURETABS[DOT]NET exists the Internet is being flooded with silent >intrusions and malicious code injections. > > >Rejection of Registrar Complaint by ICANN > >ICANN has a secondary process for filing complaints against Registrars >but in this case it failed. KnujOn followed ICANN’s instructions >(http://www.icann.org/en/compliance/faq.html) for filing a complaint >against a Registrar. On September 16, 2010 after OnlineNIC failed to >comply with the contracted obligations concerning SECURETABS[DOT]NET. >Instead of seeing SECURETABS[DOT]NET suspended and OnlineNIC admonished, >our complaint was rejected with the claim we had filed the wrong form. >It has now been 73 days since our initial complaint about >SECURETABS[DOT]NET, and the site is still active and continues to appear >in new website intrusions. > >Until ICANN fully grasps the nature of this threat and their ability to >thwart it through their normal duties, the problem will grow. In Part >III we reveal a notorious intrusion and malware download traced right to >another policy failure at another troubled Registrar. > >-Garth > > >More information: >http://www.circleid.com/posts/20100929_policy_failure_enables_mass_malware_… >http://www.knujon.com/blog.html > > >------------------------------------- >Garth Bruen >gbruen(a)knujon.com >http://www.knujon.com >http://www.linkedin.com/pub/4/149/724 >Linkedin Group: http://www.linkedin.com/groups?gid=1870205 >Blog: http://www.circleid.com/members/3296/ >Twitter: @Knujon > > > >------ >NA-Discuss mailing list >NA-Discuss(a)atlarge-lists.icann.org >https://atlarge-lists.icann.org/mailman/listinfo/na-discuss > >Visit the NARALO online at http://www.naralo.org >------

2 1

"Rough Consensus"
by Evan Leibovitch Sept. 27, 2010

Sept. 27, 2010

Hi Gordon, Thanks for your comments on the Draft proposal for revising the NARALO Operating Principles<https://st.icann.org/alac-docs/index.cgi?na_2007_1_1rev1_draft_naralo_opera…>. I'd like to address the issue you raised, The one thing I find worrisome, though, is this use of "rough consensus". > Since I cannot think of a better process right now, I will simply ask if > there is a precedent for this in ICANN and, if so, how was it defined. > > As far as I can tell, "rough consensus" has been used in quite a few of the ICANN working groups in which I've participated. First used by the IEFT, "rough consensus" has been a term used to reflect when the collective opinion of a group is overwhelmingly -- but not unanimously -- in favour or opposed to a particular point. While "full consensus" -- unanimity -- is desired, it isn't always possible. In these cases, "Rough consensus" is used to reflect the decision-making sense of the group even though some minimal opposition may exist. Rough consensus has been the decision-making standard in NARALO since its inception, though in the vast majority of situations we have achieved unanimity after ensuring that the points of view of all participants have been taken into account. Using this process in our meetings -- as opposed to having formal votes -- has saved us substantial amounts of time in our decision-making process. This in turn has allowed us to react quickly at times when speed has been a factor in being properly heard. Still, we also have formal procedures in place -- some of which are part of the proposed changes -- to have formal votes on important issues such as elections. Although we have not yet had serious (and un-reconcilable) divergence of opinion on any specific issue or motion, we must be ready with a formal voting process should this happen. As always, the preference is for full consensus. Rough consensus (which I personally would consider to be less than 10% opposition) is usable but far less desirable than unanimity. If there is greater divergence than that on an issue and if such divergence is impossible to reconcile, a formal vote would be called for. That's at least my interpretation as Chair. I hope this addresses your concerns. This process is indeed used elsewhere within ICANN; a Google search for "ICANN 'rough consensus' " produces more than 7,000 hits. Please don't hesitate to let me know if you still consider our use of this technique "worrisome". I hope you will vote to support the new bylaw changes. - Evan

4 3

At-Large wiki migration to Confluence - update
by ICANN At-Large Staff Sept. 25, 2010

Sept. 25, 2010

Dear All, The migration of the At-Large wiki pages from Social Text to Confluence is nearly complete. Staff have been working closely with the ALAC Chair, Cheryl Langdon-Orr, over the last several weeks to ensure that the migration meets all of the requested elements in terms of content and format. To allow IT to staff to fully migrate all At-Large pages as well as to give all members of the At-Large community the opportunity to participate in two At-Large Confluence training sessions scheduled for Wednesday, 29 September and Thursday, 30 September, the official go-live date of the At-Large Confluence wiki will now be Friday, 1 October. During the next week, we encourage you to browse the At-Large Confluence site. To access this page, log in to your Confluence account by going to: http://community.icann.org <http://community.icann.org/> and clicking on the Log In link on the right hand side of the page. If you need a log-in, please send your request to Naveed Tahir-Kheli (naveed(a)icann.org) Once you have logged-in, the At-Large Community tab is located on the upper left hand side of the page. We look forward to your comments! Please feel free to write to At-Large staff at staff(a)atlarge.icann.org if you have any questions regarding the migration of the At-Large wiki pages to Confluence. Regards, Heidi Ullrich, Matthias Langenegger, Seth Greene, Gisella Gruber-White, Marilyn Vernon, Kristina Nordström ICANN At-Large Staff

1 0

NOW OPEN: NARALO Vote on Revised Operating Principles
by ICANN At-Large Staff Sept. 24, 2010

Sept. 24, 2010

Dear All, The NARALO Vote on the Revised Operating Principles has recently started and will remain open until Friday, 1 October at 2359 UTC. A separate email with their voting credentials has been sent to the representatives of the ALSes and the Unaffiliated Users (see list attached below). The question to be put will be the following: Should the NARALO Operating Principles be amended according to the first draft revision ? With possible options: Yes No Abstain You can review the draft revision 1 of the NARALO Operating Principles under: https://st.icann.org/alac-docs/index.cgi?na_2007_1_1rev1_draft_naralo_opera… Modifications to the current version are either highlighted using bold text (additional text) or strikethrough (deleted text). Please note that according to clause 15 of the current Operating Principles, the document will need the endorsement of 70% of the active ALSes to take effect. -- Regards, Heidi Ullrich, Matthias Langenegger, Seth Greene, Gisella Gruber-White, Marilyn Vernon, Kristina Nordström ICANN At-Large Staff email: staff[at]atlarge.icann.org website: www.atlarge.icann.org ******* Unaffiliated User Representative: Beau Brendler ALS Representatives: 22 (1 ALS currently without representation) America@Large Randy Glass Association for Community Networking (AFCN) Michael Maranda Canadian Association for Open Sorce (CLUE) Evan Leibovitch Coalition Against Unsolicited Commercial E-mail (CAUCE North America) John Levine Communautique Monique Chartrand Foundation for Building Sustainable Communities (FBSC) Glenn McKnight Greater Toronto Area Linux User Group (GTALug) Myles Braithwaite ISOC Colorado Chris Grundemann ISOC New York David Solomonoff ISOC Puerto Rico Eduardo Diaz ISOC Quebec Louis Houle Knujon Garth Bruen N-CAP Darlene Thompson Pacific Community Networks Association Alan Skuce People Who Sylvia Caras Privatera Robert Guerra San Franciso Bay ISOC Annalisa Roger Telecommunities Canada Gareth Shearman The Alberta Community Network Association Stephen Soucy The Intellectual Property & Technology Section of the Hawaii State Bar Association Seth Reiss Web405 Dennis Wilen Youth Helping Youth Inc dba: Emerging Futures Network Ted Ernst

1 0