ICANN aims to raise awareness of critical Internet security issue

The Internet Corporation for Assigned Names and Numbers is raising awareness of a recently discovered vulnerability in the domain name system (DNS). This includes releasing an FAQ and an online tool for domain operators to test their domains.

Due to the distributed nature of the DNS, no one organization can implement a fix for this vulnerability. It requires the cooperation of all name server operators and DNS software vendors. However, ICANN sees an important goal in spreading awareness of the need to update Internet infrastructure to cope with the threat. The organization has been undertaking significant outreach efforts to top-level domain operators to advise them on the issue. It has also prepared an FAQ and online domain testing tool to raise awareness of the problem, and to encourage network operators to rectify or update their servers.

Summary of Cache Poisoning Issue

Security researcher Dan Kaminsky recently discovered a design flaw in the fundamental DNS protocol. While it is not possible to fully fix this flaw, there are ways to improve resistance to it. This involves system administrators patching or reconfiguring their DNS servers.

The vulnerability affects what are called “recursive” name servers, typically installed at ISPs and corporate network gateways to assist DNS lookups and cache results for faster lookups, rather than the type of name servers used by domain registries which are “authoritative” name servers.

However, name servers can be configured to perform both “recursive” and “authoritative” functions from the same machine, and by doing so the susceptible recursive function can cause security risks for the authoritative function.

For domain operators

For operators of domain names, this vulnerability can be used to affect the contents of their zone if their authorities also provide recursive name service. To detect whether a particular zone is vulnerable, ICANN has produced a tool that can check a particular domain:

http://recursive.iana.org/

Domain operators should look to ensuring that all of the authoritative name servers for their domain are separated from any recursive name servers to avoid being impacted by cache poisoning attacks.

ICANN has also produced a set of question and answers on this topic for domain operators, which is available at:

http://www.iana.org/reports/2008/cross-pollination-faq.html

For Internet users

For most users it is important to ensure the DNS servers their computer uses to look up domains has been patched to enable “source port randomization”. To check if this change has been made by your Internet provider one can go to an online testing tool provided by the DNS Operations, Analysis and Research Center at:

https://www.dns-oarc.net/oarc/services/dnsentropy

To be guarded against the vulnerability, the test result should return as “Great”. If you do not get such a result your should talk to your network administrator (typically your ISP, or your company’s IT department) and advise them to update their recursive name servers.

About ICANN:

ICANN is responsible for the global coordination of the Internet’s system of unique identifiers like domain names (like .org, .museum and country codes like .uk) and the addresses used in a variety of Internet protocols that help computers reach each other over the Internet. Careful management of these resources is vital to the Internet’s operation, so ICANN’s global stakeholders meet regularly to develop policies that ensure the Internet’s ongoing security and stability. ICANN is an internationally organized, public benefit non-profit company. For more information please visit: www.icann.org .

Media Contacts:

Jason Keenan
Media Adviser, ICANN
Ph: +1 310 382 4004
E: jason.keenan@icann.org

International: Andrew Robertson
Edelman (London)
Ph: +44 7921 588 770
E: andrew.robertson@edelman.com

“We believe the huge demand for .ME reflects the public’s interest in having a personal connection with the Web,” said Predrag Lesic, the registry’s executive director. “From interesting topics, to organization names, to brands, .ME sites give personality to the content on the Web sites associated with them.”

More than 100 registrars currently offer .ME domains through their registration platform. .ME has seen its greatest interest among English speaking countries including the United States (71%), the United Kingdom (6%), Canada (4%), and Australia (2%).

Rank  Country Code    Country     Percentage
——————————————————-
1     US     United States     71%
——————————————————-
2     GB     United Kingdom     6%
——————————————————-
3     CA       Canada       4%
——————————————————-
4     AU      Australia      2%
——————————————————-
5     IL       Israel       1%
——————————————————-
6     DE      Germany       1%
——————————————————-
7     FI      Finland       1%
——————————————————-
8     AE   United Arab Emirates   1%
——————————————————-
9     SE       Sweden       1%
——————————————————-
10     NL     Netherlands      1%

More than a thousand auctions are currently open for popular .ME domains, with the highest bid over $32,000. Auctions for .ME have been extremely popular, with some of the top completed auctions to date being:

Name               Final Bid
——————————————————————
lasvegas.me             $15,105
————————————————————–
chatwith.me             $15,035
————————————————————–
picture.me              $10,240
————————————————————–
baidu.me              $10,005
————————————————————–
onlinecasino.me            $10,005
————————————————————–
tag.me               $10,005
————————————————————–
secure.me              $10,005
————————————————————–

There are still many active Land Rush auctions(1) taking place at http://Auctions.Domain.Me, including:

Name              Current Bid
——————————————————————
insure.me              $33,505
————————————————————–
hug.me               $14,505
————————————————————–
surprise.me              $8,455
—————————————————————
brand.me               $8,115
—————————————————————
entertain.me              $7,600
—————————————————————

“The number of individuals participating in .ME auctions, combined with the high values of the sales indicates brand owners and investors clearly understand the domain’s potential,” added Lesic. “We are pleased by this success since proceeds from the auctions go to further Internet development in Montenegro.”

Information on the release of premium .ME names via auction is expected in the coming months.

The registration process for .ME began in May with the Sunrise period for trademark holders. Land Rush for the general public to register names began in June. In total more than 30,000 applications were received in the Sunrise and Land Rush periods.

A list of registrars offering .ME domains is available at www.Domain.ME.

About the .ME Registry:

.ME Registry (the d.b.a of doMEn, d.o.o.) was chosen by the government of Montenegro to operate the new .ME domain name extension..ME Registry partners include ME-net, GoDaddy.com and Afilias Limited. Me-Net is located in Montenegro and its principals have been leaders in the ICT sector in Montenegro, including the privatization of its largest ISP. GoDaddy.com is located in the USA and is the world’s largest domain name registrar and the largest paid hostname provider in the world, according to Netcraft Ltd. Afilias Limited is headquartered in Ireland and is a leading registry services provider, supporting more than 13 million domains worldwide.

(1) The rules for Land Rush domains with multiple applications can be found www.domain.me/index.php?page=21.

This news release was sourced from the Nic.ME website at www.nic.me/index.php?page=12&news=94.

The case may lead to damages being paid to Verizon and may force domainers to change their practices. Goldman outlines the practices Navigation Catalyst engaged in some common domainer practices and kept 126 domains Verizon alleged infringe its trademark. “Navigation Catalyst also tasted nearly 1300 other challenged domains, and as the court points out, made some money from those domains during the tasting period.”

Navigation Catalyst claimed it “merely reserved the domains during the tasting period instead of ‘registering’ them … because they hadn’t paid for the domains,” a claim, among others, that didn’t impress the court. “While this is a big loss for the domainer, it’s a shocking ruling against the registrar.”

“There is absolutely no good news for [the domaining industry] in this ruling. This court rejected the standard risk-management that domainers claim protect them from cybersquatting liability.”

To read this article by Eric Goldman in full, see www.circleid.com/posts/88214_court_decision_detrimental_to_domaining/.

It remains to the ICANN Board and staff to accept and implement this proposal, but the Board is expected to follow the consensus of the working group. (If it does not, you will hear about it here!)” Mueller says the “proposed solution is a victory for civil society representation.” He also says “This new structure eliminates an old injustice in the ICANN” as “public interest/noncommercial voices were constantly marginalized and the IPR/trademark interests became a dominant force in domain name policy. … It represents all stakeholder groups evenly and requires balanced support across both user and supplier houses before any proposal can go through.”

To read this posting by Milton Mueller in full, see blog.internetgovernance.org/blog/_archives/2008/7/31/3817694.html.

“The plan, such as it is now, defines who at ICANN and the registry are relevant to the process and what they shall do. It defines how communications with the public will be handled. The ICANN crisis management team will be tested at least once per year.”

The article concludes: “ICANN has been thinking about these matters a lot more lately than it had in the past, and this is a good thing. I can’t imagine what it was spending its time on before this, but it wasn’t as important.”

To read this article in full in eWeek, see www.eweek.com/c/a/Security/ICANN-Plans-For-Disaster-A-Registry-Failure/.

Dr. Paul Twomey, President and Chief Executive Officer of ICANN, and Graeme Wood, Founder and Executive Director of Wotif.com, will be keynote speakers at the event. Wood founded the accommodation booking website Wotif.com and developed it into a multi-national company that attracts more than 3.2 million visits, and processes over 200,000 accommodation bookings each month.

“I’m delighted to have the opportunity to address the domain name community,” said Dr. Twomey. “I have great respect and admiration for its pioneering members; forever evolving the robust domain name market that exists today.”

In a boon to the Internet Commerce Association, all attendees can be pleased that all profits from attendees and event sponsorships will be donated to the ICA, meaning they will be better able to work for the betterment of the rights of domainers and domain name holders in general.

The ICA is a grass roots organisation formed to ensure domain services and owners are robustly represented in areas of great risk and importance to the global domain community. The ICA utilises dues and contributions to enable activities related to legislative lobbying, regulatory representation, industry public relations, legal test case support, industry publication of statistics and reports, revenue research, and market intelligence. In order for the association to continue and expand its activities, it requires the support and participation from current members, and also from the entire professional domain name community.

The explosive growth in online advertising (in the first half of 2007 alone, advertisers in the US spent more than $10 billion website advertising) has seen Internet entrepreneurs earn millions of dollars each year by buying, selling, developing and monetising domain names. There are now over 1,000 so-called “domainers”, over 162 million registered domains around the world, and a thriving aftermarket for domain names, with reported sales exceeding US$700M in 2007.

At the recent T.R.A.F.F.I.C. East show in the US, Steve Forbes, CEO of Forbes, Editor-in-Chief of Forbes Magazine and former U.S. presidential candidate was enthusiastic about the industry. “Internet traffic and domains are the prime real estate of the 21st century. This market has matured, and individuals, brands, investors and organizations who do not grasp their importance or value are missing out on numerous levels.”

Rick Schwartz, T.R.A.F.F.I.C. founder, feels a conference in Australia is long overdue, “Australians are a major force in the domain industry, representing some of the largest domain portfolio owners in the world. This show will be a truly global event and those that attend will be enriched forever.”

“Australia is a great conduit and sounding board to the Asian continent,” notes one of the world’s most successful domain investors, Frank Schilling from Name Admin Inc. “I genuinely look forward to exploring that hemisphere’s views and influence on domain development and monetization strategies when I meet the many fine commercial registrants of the region this autumn.”

Ticket prices are US$1,295 until July 31st, and then US$1,595 until the conference opening day on 18th November.

For more information and registration, please visit the official TRAFFIC Down Under website, TrafficDownUnder.com.

“We believe the huge demand for .ME reflects the public’s interest in having a personal connection with the Web,” said Predrag Lesic, the registry’s executive director. “From interesting topics, to organization names, to brands, .ME sites give personality to the content on the Web sites associated with them.”

More than 100 registrars currently offer .ME domains through their registration platform. .ME has seen its greatest interest among English speaking countries including the United States (71%), the United Kingdom (6%), Canada (4%), and Australia (2%).

More than a thousand auctions are currently open for popular .ME domains, with the highest bid over $32,000. Auctions for .ME have been extremely popular, with some of the top completed auctions to date being:

Original article : http://www.businesswire.com/portal/site/google/?ndmViewId=news_view&newsId=20080805005776&newsLang=en

“We love to invest in domains and we’re excited to add these Colorado domains to our Domain Portfolio. These URLs represent both geo-domains and product/service domains that fit our investment strategy of buying high-quality generic keyword and geo domains. Per our business model, some of these domain names will be developed, a few we’ll keep as long-term investments, and other domains will be for sale to local businesses in Colorado and investors,” says owner Jay Lohmann.

Lohmann added “The value of Generic Keyword and Geo domains is becoming more obvious to mainstream investors, and these Colorado domain names will add significant value to our investment strategy. Colorado real estate is hot and so is the Internet real estate tied to it. This state is one of the premier living and working environments in the United States. We look forward to working with local businesses to build high-quality virtual properties their customers can experience.”

For additional information on the news that is the subject of this release, contact Will Morgan or visit Incite Public Relations and Promotions in Dallas at IncitePrP.com.

About InvestInURLs.com:
InvestInURLs.com is an Internet Real Estate Investment Firm specializing in generic keyword and geographic domains. They are partnered with domain development agency TagTeam Creative Advertising and Website Design in Dallas and Colorado Springs.

The article says more sophisticated botnets are to blame according to data gathered from the Click Fraud Network, consisting of more than 4,000 online advertisers and agencies.

Click Forensics report for the second quarter of 2008 indicates botnets continue to be used for click fraud being the preferred and more efficient approach compared to hiring human clickers on a revenue sharing basis.

Some of the key findings from data reported for Q2 2008 are available from blogs.zdnet.com/security/?p=1555.

A big part of Google’s rise to search engine leadership was an algorithm called PageRank that assesses a specific page’s importance by how many other Web pages link to it and by the importance of those linking pages.

This story appeared in CNet. The full version of this story is available from news.cnet.com/8301-1023_3-9999038-93.html.

After Domain Name Wire posted a story about the Fired.com UDRP case and contacted World2Work Corporation, the complainant, World2Work and its attorney released a statement about the case reports DomainNameWire.

The company claims that it should have rights to the domain name based on its 2004 trademark filing and the fact that the current owner of the domain hasn’t used it since it was registered in 1999 the report continues.

To read the full report from DomainNameWire and the statement, see domainnamewire.com/2008/07/25/world2work-releases-statement-about-firedcom-udrp-case/.

From 1 August till 31 August 2008, registration fees for domain names under the “.sg” and “.per.sg” extensions will be capped at a maximum price of SGD$5.00!! This promotion will be available at all participating registrars.

More information on the promotion is available from nic.net.sg/newsroom/20080801104848.html.

Instra is pleased to be one of the participating registries, and to take advantage of this promotion, check instra.com.sg/domains/sg-domains.htm.

Patrick Vande Walle was the first to announce his interest in the gTLD back in June following Domain Pulse’s discovery of a registered trademark application to the EU’s Office for Harmonization in the Internal Market. Click here for more information.

To gain support for his proposal, Andruff has opened dialogue with the International Olympic Committee (IOC), the Association of Summer Olympic International Sports Federations (ASOIF), the General Association of International Sports Federations (GAISF), numerous members of the Association of the IOC Recognized International Sports Federations (ARISF), and International World Games Association (IWGA) federations, as well as professional sports institutions such as the English Premier League.

“In light of ICANN adding what many believe could be 200 to 2,000 new top-level domains to the A-root of the Internet domain name system in the coming years, .sport - the new, exclusive space on the Internet for the global sporting world - will take on significant importance both in the near-term and in the decades to come,” said Andruff.

More information on Andruff’s .sport proposal is available from dotsportllc.com/index.php?pageId=8 while Patrick van de Walle’s proposal is outlined at patrick.vande-walle.eu/internet/icann/discover-sport-at-egeni-paris-20th-june/.

APNIC 26 is being held in Christchurch from 25 to 29 August 2008. The five-day meeting will continue the ongoing policy development process for the allocation of Internet resources, such as IP addresses in the Asia Pacific region. It also gives members of the Internet technical community the opportunity to continue to contribute to the ongoing development of the Internet, the importance of which is recognised by both the Internet Governance Forum (IGF) and the OECD.

InternetNZ (the Internet Society of New Zealand Inc) Executive Director Keith Davidson says APNIC members range from the tiniest of Pacific Islands to large, populous countries like China and India so the meeting will be a golden opportunity for New Zealand’s Internet community to network with their global counterparts.

“We are very pleased to be working with APNIC (the Asia Pacific Network Information Centre) to bring another exciting international-calibre event to New Zealand. The meeting is very timely considering the increasing recognition that IPv6 deployment will be a business-critical issue for network operators in the next two years. Some projections have IPv4 exhaustion within as little as two years.”

Discussions on how to manage the remaining unallocated IPv4 address space will be prominent on the agenda, as will planning on how the community can facilitate the migration of the world’s networks to IPv6 technology.

Internet governance will also feature prominently with the following issues being featured:

• what are the challenges facing Internet operators in developing countries?
• how can the Internet community, together with business, civil society, and government work to overcome the challenges?

This hui (”gathering” in Maori) features key Internet community figures including Peter Dengate-Thrush - Chair of ICANN, Raúl Echeberría - Executive Director/CEO of LACNIC and Rajnesh Singh - ISOC Regional Manager for South and Southeast Asia.

The five-day event also includes:

• practical, hands-on training specific to Internet resource management and IPv6 deployment
• a seminar program showcasing world class speakers discussing the latest technical developments from across the globe
• a policy development and discussion program tackling the addressesgrowing challenge of managing the remaining unallocated pool of IPv4

The event will bring together Internet and networking experts, government representatives, industry leaders, and other interested parties from around the region to network with colleagues, attend workshops and tutorials, and discuss policies.

“We encourage the New Zealand Internet community to actively take part in APNIC 26. The opportunity to participate in this high quality training and seminar program as well as having first-hand access to the policy development process may not come again for several years,” says Davidson.

Early registration is being encouraged and registration online and more information is available from www.apnic.net/meetings/26/register.

DotAsia Organisation announced today that auction proceeds for the .Asia Sunrise and Landrush auctions reached US$7 Million after surpassing the US$6 Million mark 2 weeks ago. The top 10 list also continues to experience constant changes and exciting developments.  Four new domains entered into the Top 10, including “homes.asia” (US$32,000) and “gold.asia” (US$34,125 and ongoing), while “buy.asia” (US$72,000 and ongoing) jumped into 3rd position.  Making way for these were “vodka.asia” (US$25,000), “diamond.asia” (US$28,000) and “spa.asia” (US$23,200).  Into the final week of the auctions, “discover.asia” remains at the top having closed at US$112,111. Live auction ticker and commentary can be found on think.asia, as the .Asia Hot-or-Not Domains Appraisal Contest awaits its Grand Prize winner of US$10,000.

“We have seen growing excitement for the .Asia Auctions as the Hot-or-Not Contest reaches its final stage. Contestants and auction participants alike are logging on each day to think.asia to check out the latest development. We believe that the .Asia auction process has been a great success not only in providing a fairer process to compete for domain names, but also in building a solid foundation for adoption, investment and growth value of .Asia domains,” says Edmon Chung, CEO of DotAsia Organisation.

A quick search on the Internet revealed great headway .Asia is making to attract businesses and initiatives alike to utilize the domain. Examples include businesses in the region such as “pingo.asia”, “isup.asia” and “webit.asia”; multinationals and media groups such as “ing.asia”, “adversus.asia” and “honda.asia”; as well as events and regional initiatives such as “gnome.asia”, “childlearn.asia”, “aibcs.asia”, “bringitalltogether.asia” and “cantonese.asia”, etc.

“We are energized by the adoption of the .Asia domains exemplifying our philosophy: ‘From Asia, For Asia’. Businesses and initiatives embracing the .Asia domain are coming from Asia as well as from around the world who are targeting services for Asia – the Asia market and the Asian audience,” adds Edmon. “The usage of .Asia domain names by small and large companies alike demonstrates the value of an Asia centric Internet web address.”

About DotAsia Organisation:
DotAsia Organisation is the Sponsoring Organisation and Registry Operator for the .Asia Sponsored Generic Top Level Domain. DotAsia is a not-for-profit, community-based organisation incorporated in Hong Kong. Asia has developed into a global force in the international commercial, political and cultural network. The .Asia domain aspires to embrace this dynamism in the Asia Century to become a nucleus, intersection and breeding ground for Internet activity and development in the region. To learn more about DotAsia, please visit: registry.asia.

To register your .asia domain name, check out Europe Registry here.