Fwd: [dns-wg] EU: DNS abuse study
For those who are not following the DNS wg list: The European Commission has published a quite comprehensive study on DNS abuse. (One could also call it enormous.) It study itself be found here: https://op.europa.eu/en/publication-detail/-/publication/7d16c267-7f1f-11ec-... There is an additional document containing the appendix: https://op.europa.eu/en/publication-detail/-/publication/d9804355-7f22-11ec-... -- Markus de Brün -------- Forwarded Message -------- Subject: Re: [dns-wg] EU: DNS abuse study Date: Fri, 4 Feb 2022 10:52:53 +0100 From: Petr Špaček <pspacek@isc.org> To: dns-wg@ripe.net On 01. 02. 22 9:32, Hank Nussbacher wrote:
The EU has published is 173 page opus on DNS abuse:
https://op.europa.eu/en/publication-detail/-/publication/7d16c267-7f1f-11ec-...
I have had a peak when waiting for other things to happen and it might be interesting read. Here is a gist from chapter Executive summary: The study adopts the following definition of DNS abuse: Domain Name System (DNS) abuse is any activity that makes use of domain names or the DNS protocol to carry out harmful or illegal activity. The main findings of the measurements are: a) In relative terms, new generic Top-Level Domains (new gTLDs), with an estimated market share of 6.6%, are the most abused group of TLDs (Appendix 1 – Technical Report, Section 5, p. 26). b) Not all new gTLDs suffer from DNS abuse to the same extent. The two most abused new gTLDs combined account for 41% of all abused new gTLD names (Appendix 1 – Technical Report, Section 9.2, p. 32). c) European Union country code TLDs (EU ccTLDs) are by far the least abused in absolute terms and relative to their overall market share (Appendix 1 – Technical Report, Section 5, p. 26). d) The vast majority of spam and botnet command-and-control domain names are maliciously registered (Appendix 1 – Technical Report, Section 10.3, p. 41). e) About 25% of phishing domain names and 41% of malware distribution domain names are presumably registered by legitimate users, but compromised at the hosting level (Appendix 1 – Technical Report, Section 10.3, p. 41). f) The top five most abused registrars account for 48% of all maliciously registered domain names (Appendix 1 – Technical Report, Section 11.2, pp. 43-44). g) Hosting providers with disproportionate concentrations of spam domains reach 3,000 abused domains per 10,000 registered domain names (Appendix 1 – Technical Report, Section 12.3, pp. 48-49). h) The overall level of DNS security extensions (DNSSEC) adoption remains low. (Appendix 1 – Technical Report, Section 15.3, pp. 62-63). i) There are 2.5 million open DNS resolvers worldwide that can be effectively used as amplifiers in distributed denial-of-service attacks (Appendix 1 – Technical Report, Section 16.4, p. 70). The numbers above sound interesting. -- Petr Špaček -- To unsubscribe from this mailing list, get a password reminder, or change your subscription options, please visit: https://lists.ripe.net/mailman/listinfo/dns-wg
In message <e3e427c8-3006-9df0-f56c-b9215fe77e52@mxdomain.de>, =?UTF-8?Q?Markus_de_Br=c3=bcn?= <markus@mxdomain.de> wrote:
f) The top five most abused registrars account for 48% of all maliciously registered domain names (Appendix 1 - Technical Report, Section 11.2, pp. 43-44).
Hey! I have an idea! What if we created one global organization to accredit and monitor literall all domain name registrar companies, and what if we allowed that organization to actually *disipline* domain name registrars which have proven by their actions that they are purely profit-oriented anti-social assholes? Now I know what you are thinking. "Impossible!", right? But I can dream, can't I? Regards, rfg P.S. Namecheap, Inc., whose name comes up repeatedly in this study, has at various times claimed to have its headquarters in California and then, subsequently, in Arizona. as far as I have been been able to determnine it has never been properly registered in either state. It is, I believe, logical to infer from that fact that it has never filed a state-level tax return in either California or Arizona, quite possibly violating the law in either or both states. Not that ICANN would give a shit. Aa long as no officers of any accredited registrar have murdered anybody lately, or been convicted of robbing any banks lately, I think that ICANN is OK with pretty much anything else, as long as they keep on getting their checks regularly. I am reminded of that old saying... "Fish rots from the head down." https://opencorporates.com/companies?q=Namecheap&utf8=%E2%9C%93
Ronald, All, I honestly can't believe that I have to say this again, but please do not use language/phrasing like this on the list. I'm not telling you what opinion you have to have of ICANN or any other organisation, nor am I saying that we cannot criticise others, but there is a way to do that and, on a community list, this is not the way. Thanks, Brian Co-Chair, RIPE AA-WG Brian Nisbet (he/him) Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet@heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270 ________________________________ From: anti-abuse-wg <anti-abuse-wg-bounces@ripe.net> on behalf of Ronald F. Guilmette <rfg@tristatelogic.com> Sent: Tuesday 8 February 2022 10:01 To: anti-abuse-wg@ripe.net <anti-abuse-wg@ripe.net> Subject: Re: [anti-abuse-wg] Fwd: [dns-wg] EU: DNS abuse study CAUTION[External]: This email originated from outside of the organisation. Do not click on links or open the attachments unless you recognise the sender and know the content is safe. In message <e3e427c8-3006-9df0-f56c-b9215fe77e52@mxdomain.de>, =?UTF-8?Q?Markus_de_Br=c3=bcn?= <markus@mxdomain.de> wrote:
f) The top five most abused registrars account for 48% of all maliciously registered domain names (Appendix 1 - Technical Report, Section 11.2, pp. 43-44).
Hey! I have an idea! What if we created one global organization to accredit and monitor literall all domain name registrar companies, and what if we allowed that organization to actually *disipline* domain name registrars which have proven by their actions that they are purely profit-oriented anti-social assholes? Now I know what you are thinking. "Impossible!", right? But I can dream, can't I? Regards, rfg P.S. Namecheap, Inc., whose name comes up repeatedly in this study, has at various times claimed to have its headquarters in California and then, subsequently, in Arizona. as far as I have been been able to determnine it has never been properly registered in either state. It is, I believe, logical to infer from that fact that it has never filed a state-level tax return in either California or Arizona, quite possibly violating the law in either or both states. Not that ICANN would give a shit. Aa long as no officers of any accredited registrar have murdered anybody lately, or been convicted of robbing any banks lately, I think that ICANN is OK with pretty much anything else, as long as they keep on getting their checks regularly. I am reminded of that old saying... "Fish rots from the head down." https://opencorporates.com/companies?q=Namecheap&utf8=%E2%9C%93 -- To unsubscribe from this mailing list, get a password reminder, or change your subscription options, please visit: https://lists.ripe.net/mailman/listinfo/anti-abuse-wg
I probably should say this on the DNS mailing list but I find it quite curious that the study surveyed such limited stakeholders, and mainly the intellectual property crowd. "We gathered the data and inputs from stakeholders with two questionnaires: 1) the first one surveyed registries, registrars, hosting providers, other DNS operators, and 2) the second one surveyed intellectual property rightholders, practitioners, associations, business intelligence, and brand protection companies. The study also collected data from third parties and publicly available reports (secondary research), as well as evaluated the impact of DNS abuse." (Page 7) Intellectual property is not the best way to combat abuse and it will lead to protectionism and intellectual property overreach. Same applies to this space. They use "illegal" and "harmful" in their definition of DNS abuse which are ambiguous at best and expand the definition of DNS abuse so much that of course can result in concluding that we are all drowning in harmful activities online and it's all the DNS fault. On Sun, Feb 6, 2022 at 10:50 AM Markus de Brün <markus@mxdomain.de> wrote:
For those who are not following the DNS wg list:
The European Commission has published a quite comprehensive study on DNS abuse. (One could also call it enormous.)
It study itself be found here:
https://op.europa.eu/en/publication-detail/-/publication/7d16c267-7f1f-11ec-...
There is an additional document containing the appendix:
https://op.europa.eu/en/publication-detail/-/publication/d9804355-7f22-11ec-...
-- Markus de Brün
-------- Forwarded Message -------- Subject: Re: [dns-wg] EU: DNS abuse study Date: Fri, 4 Feb 2022 10:52:53 +0100 From: Petr Špaček <pspacek@isc.org> To: dns-wg@ripe.net
On 01. 02. 22 9:32, Hank Nussbacher wrote:
The EU has published is 173 page opus on DNS abuse:
https://op.europa.eu/en/publication-detail/-/publication/7d16c267-7f1f-11ec-...
I have had a peak when waiting for other things to happen and it might be interesting read. Here is a gist from chapter Executive summary:
The study adopts the following definition of DNS abuse: Domain Name System (DNS) abuse is any activity that makes use of domain names or the DNS protocol to carry out harmful or illegal activity.
The main findings of the measurements are: a) In relative terms, new generic Top-Level Domains (new gTLDs), with an estimated market share of 6.6%, are the most abused group of TLDs (Appendix 1 – Technical Report, Section 5, p. 26). b) Not all new gTLDs suffer from DNS abuse to the same extent. The two most abused new gTLDs combined account for 41% of all abused new gTLD names (Appendix 1 – Technical Report, Section 9.2, p. 32). c) European Union country code TLDs (EU ccTLDs) are by far the least abused in absolute terms and relative to their overall market share (Appendix 1 – Technical Report, Section 5, p. 26). d) The vast majority of spam and botnet command-and-control domain names are maliciously registered (Appendix 1 – Technical Report, Section 10.3, p. 41). e) About 25% of phishing domain names and 41% of malware distribution domain names are presumably registered by legitimate users, but compromised at the hosting level (Appendix 1 – Technical Report, Section 10.3, p. 41). f) The top five most abused registrars account for 48% of all maliciously registered domain names (Appendix 1 – Technical Report, Section 11.2, pp. 43-44). g) Hosting providers with disproportionate concentrations of spam domains reach 3,000 abused domains per 10,000 registered domain names (Appendix 1 – Technical Report, Section 12.3, pp. 48-49). h) The overall level of DNS security extensions (DNSSEC) adoption remains low. (Appendix 1 – Technical Report, Section 15.3, pp. 62-63). i) There are 2.5 million open DNS resolvers worldwide that can be effectively used as amplifiers in distributed denial-of-service attacks (Appendix 1 – Technical Report, Section 16.4, p. 70).
The numbers above sound interesting.
-- Petr Špaček
--
To unsubscribe from this mailing list, get a password reminder, or change your subscription options, please visit: https://lists.ripe.net/mailman/listinfo/dns-wg
--
To unsubscribe from this mailing list, get a password reminder, or change your subscription options, please visit: https://lists.ripe.net/mailman/listinfo/anti-abuse-wg
Exactly And unfortunately this is a trend with a lot of the EC’s activities that push towards more and more regulation of digital I also find the ridiculously broad definition of abuse so broad that it renders any output without much merit. -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ https://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 From: anti-abuse-wg <anti-abuse-wg-bounces@ripe.net> on behalf of Farzaneh Badiei <farzaneh@digitalmedusa.org> Date: Wednesday, 9 February 2022 at 15:16 To: Markus de Brün <markus@mxdomain.de>, anti-abuse-wg@ripe.net <anti-abuse-wg@ripe.net> Subject: Re: [anti-abuse-wg] Fwd: [dns-wg] EU: DNS abuse study [EXTERNAL EMAIL] Please use caution when opening attachments from unrecognised sources. I probably should say this on the DNS mailing list but I find it quite curious that the study surveyed such limited stakeholders, and mainly the intellectual property crowd. "We gathered the data and inputs from stakeholders with two questionnaires: 1) the first one surveyed registries, registrars, hosting providers, other DNS operators, and 2) the second one surveyed intellectual property rightholders, practitioners, associations, business intelligence, and brand protection companies. The study also collected data from third parties and publicly available reports (secondary research), as well as evaluated the impact of DNS abuse." (Page 7) Intellectual property is not the best way to combat abuse and it will lead to protectionism and intellectual property overreach. Same applies to this space. They use "illegal" and "harmful" in their definition of DNS abuse which are ambiguous at best and expand the definition of DNS abuse so much that of course can result in concluding that we are all drowning in harmful activities online and it's all the DNS fault. On Sun, Feb 6, 2022 at 10:50 AM Markus de Brün <markus@mxdomain.de<mailto:markus@mxdomain.de>> wrote: For those who are not following the DNS wg list: The European Commission has published a quite comprehensive study on DNS abuse. (One could also call it enormous.) It study itself be found here: https://op.europa.eu/en/publication-detail/-/publication/7d16c267-7f1f-11ec-... There is an additional document containing the appendix: https://op.europa.eu/en/publication-detail/-/publication/d9804355-7f22-11ec-... -- Markus de Brün -------- Forwarded Message -------- Subject: Re: [dns-wg] EU: DNS abuse study Date: Fri, 4 Feb 2022 10:52:53 +0100 From: Petr Špaček <pspacek@isc.org<mailto:pspacek@isc.org>> To: dns-wg@ripe.net<mailto:dns-wg@ripe.net> On 01. 02. 22 9:32, Hank Nussbacher wrote:
The EU has published is 173 page opus on DNS abuse:
https://op.europa.eu/en/publication-detail/-/publication/7d16c267-7f1f-11ec-...
I have had a peak when waiting for other things to happen and it might be interesting read. Here is a gist from chapter Executive summary: The study adopts the following definition of DNS abuse: Domain Name System (DNS) abuse is any activity that makes use of domain names or the DNS protocol to carry out harmful or illegal activity. The main findings of the measurements are: a) In relative terms, new generic Top-Level Domains (new gTLDs), with an estimated market share of 6.6%, are the most abused group of TLDs (Appendix 1 – Technical Report, Section 5, p. 26). b) Not all new gTLDs suffer from DNS abuse to the same extent. The two most abused new gTLDs combined account for 41% of all abused new gTLD names (Appendix 1 – Technical Report, Section 9.2, p. 32). c) European Union country code TLDs (EU ccTLDs) are by far the least abused in absolute terms and relative to their overall market share (Appendix 1 – Technical Report, Section 5, p. 26). d) The vast majority of spam and botnet command-and-control domain names are maliciously registered (Appendix 1 – Technical Report, Section 10.3, p. 41). e) About 25% of phishing domain names and 41% of malware distribution domain names are presumably registered by legitimate users, but compromised at the hosting level (Appendix 1 – Technical Report, Section 10.3, p. 41). f) The top five most abused registrars account for 48% of all maliciously registered domain names (Appendix 1 – Technical Report, Section 11.2, pp. 43-44). g) Hosting providers with disproportionate concentrations of spam domains reach 3,000 abused domains per 10,000 registered domain names (Appendix 1 – Technical Report, Section 12.3, pp. 48-49). h) The overall level of DNS security extensions (DNSSEC) adoption remains low. (Appendix 1 – Technical Report, Section 15.3, pp. 62-63). i) There are 2.5 million open DNS resolvers worldwide that can be effectively used as amplifiers in distributed denial-of-service attacks (Appendix 1 – Technical Report, Section 16.4, p. 70). The numbers above sound interesting. -- Petr Špaček -- To unsubscribe from this mailing list, get a password reminder, or change your subscription options, please visit: https://lists.ripe.net/mailman/listinfo/dns-wg -- To unsubscribe from this mailing list, get a password reminder, or change your subscription options, please visit: https://lists.ripe.net/mailman/listinfo/anti-abuse-wg
Michele Neylon - Blacknight via anti-abuse-wg wrote on 10/02/2022 10:49:
I also find the ridiculously broad definition of abuse so broad that it renders any output without much merit.
"It's always DNS!" A comparable style of analysis could find that TCP was a good root cause candidate for abuse because almost all of this abuse happens over TCP. Plenty of the recommendations are sensible, mostly for reasons unrelated to abuse. Otherwise, the supporting document would be dramatically improved by reducing the page count by an order of magnitude, and focusing on real life threats which relate directly to DNS. Nick
participants (6)
-
Brian Nisbet -
Farzaneh Badiei -
Markus de Brün -
Michele Neylon - Blacknight -
Nick Hilliard -
Ronald F. Guilmette