ICANN ponders ways to stop scammy Web sites

The overseer of the Internet's addressing system is soliciting ideas for how to fix a problem that is enabling spam and fraudulent Web sites to flourish.

The overseer of the Internet's addressing system is soliciting ideas for how to fix a problem that is enabling spammers and fraudulent Web sites to flourish.

The Internet Corporation for Assigned Names and Numbers (ICANN) has issued an initial report on fast flux, a technique that allows a Web site's domain name to resolve to multiple IP (Internet protocol) addresses.

Fast flux allows an administrator to quickly point a domain name to a new IP address, for example if the server at the first address fails or comes under a denial-of-service attack. It is legitimately used by content distribution networks such as Akamai to balance loads, improving performance and lowering data transmission costs.

But the technique has also been embraced by hackers and cybercriminals, who use it to make it harder for ISPs (Internet service providers) and law enforcement officials to close down phishing Web sites and other sites illegally hawking goods such as pharmaceuticals.

"Those engaged in these activities can frustrate the efforts of investigators to locate and shut down their operations by using fast-flux service networks to rapidly and continuously change the topology of the network on which their content is hosted," according to the report.

The main aim of cybercriminals is to keep their fraudulent Web sites up and running longer. Fast flux "is not an attack itself -- it is a way for an attacker to avoid detection and frustrate the response to the attack," the report said.

That's done in part by modifying how long name servers around the Internet cache the IP address corresponding to the domain name. When a person visits a Web site, a local name server caches the IP address of the domain name. How long the local name server refers to its cached record for a Web site is controlled by the "time-to-live" setting in the official DNS (Domain Name System) record for a site, set by Web site's operator.

While "time-to-live" is typically set to hours or even days, a Web site's IP address can be change as often as every few minutes, redirecting to countless servers belonging to different ISPs, all of which would have to be taken down. In combination with the use of proxy servers and redirect commands, antiphishing efforts can turn into endless game of chase.

Consumers can be defrauded, as cybercriminals try to hack into Web hosting accounts in order to set up new nodes on their fast-flux networks, the report said.

The security community is faced with the challenge of trying to mitigate criminal use of fast flux but also not inadvertently restricting its legitimate uses.

One solution is quicker identification and shut down of domain names identified with abusive activity. Domain names could be revoked by a registrar, which in most cases would stop the site from working. Another solution would be to limit the ability of a registrant to repeatedly change name servers or eliminate automated name-server hopping, the report said.

The 121-page report, written by ICANN's Generic Names Supporting Organization (GNSO) lays out a series of other methods that could be used to mitigate the problem. GNSO will accept comments for 20 days and then do a final redraft of the report.

Tags ICANN

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jeremy Kirk

IDG News Service

Comments

Comments are now closed.

Latest News Articles

Most Popular Articles

Follow Us

GGG Evaluation Team

Kathy Cassidy

STYLISTIC Q702

First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni

STYLISTIC Q572

For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Steph Mundell

LIFEBOOK UH574

The Fujitsu LifeBook UH574 allowed for great mobility without being obnoxiously heavy or clunky. Its twelve hours of battery life did not disappoint.

Andrew Mitsi

STYLISTIC Q702

The screen was particularly good. It is bright and visible from most angles, however heat is an issue, particularly around the Windows button on the front, and on the back where the battery housing is located.

Simon Harriott

STYLISTIC Q702

My first impression after unboxing the Q702 is that it is a nice looking unit. Styling is somewhat minimalist but very effective. The tablet part, once detached, has a nice weight, and no buttons or switches are located in awkward or intrusive positions.

Resources

Best Deals on GoodGearGuide

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?