<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: paris]]></title>
    <link>http://securityratty.com/tag/paris</link>
    <description></description>
    <pubDate>Wed, 14 May 2008 11:50:22 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA['Paris for President' Parody Strikes Viral Gold]]></title>
      <link>http://securityratty.com/article/c1dcff1c78a97408875146e9aad4f22a</link>
      <guid>http://securityratty.com/article/c1dcff1c78a97408875146e9aad4f22a</guid>
      <description><![CDATA[Socialite turned political spoofer Paris Hilton hits web gold with her faux bid for presidency. The mock campaign video has been viewed more than 6.2 million...]]></description>
      <content:encoded><![CDATA[Socialite turned political spoofer Paris Hilton hits web gold with her faux bid for presidency.
The mock campaign video has been viewed more than 6.2 million times.<br style="clear: both;"/>
  <img alt="" style="border: 0; height:1px; width:1px;" border="0" src="http://www.pheedo.com/img.phdo?i=b26c16651e6b7b4d786f6798f0322652" height="1" width="1"/>
<img src="http://www.pheedo.com/feeds/tracker.php?i=b26c16651e6b7b4d786f6798f0322652" style="display: none;" border="0" height="1" width="1" alt=""/><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=pZqUbK"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=pZqUbK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=Xvz0Ok"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=Xvz0Ok" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=0xO8zk"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=0xO8zk" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=vmRodK"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=vmRodK" border="0"></img></a>
 <a href="http://feeds.wired.com/~f/wired/politics/security?a=jO4iSK"><img src="http://feeds.wired.com/~f/wired/politics/security?i=jO4iSK" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=cISwwk"><img src="http://feeds.wired.com/~f/wired/politics/security?i=cISwwk" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=TjmC4k"><img src="http://feeds.wired.com/~f/wired/politics/security?i=TjmC4k" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=G7uvBK"><img src="http://feeds.wired.com/~f/wired/politics/security?i=G7uvBK" border="0"></img></a> </div><img src="http://feeds.feedburner.com/~r/wired/politics/privacy/~4/361310521" height="1" width="1"/><img src="http://feeds.wired.com/~r/wired/politics/security/~4/361310522" height="1" width="1"/>]]></content:encoded>
      <pubDate>Sun, 10 Aug 2008 15:30:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/mock campaign video">mock campaign video</category>
      <category domain="http://securityratty.com/tag/faux bid">faux bid</category>
      <category domain="http://securityratty.com/tag/million times">million times</category>
      <category domain="http://securityratty.com/tag/socialite">socialite</category>
      <category domain="http://securityratty.com/tag/presidency">presidency</category>
      <source url="http://feeds.wired.com/~r/wired/politics/security/~3/361310522/paris-for-presi.html">'Paris for President' Parody Strikes Viral Gold</source>
    </item>
    <item>
      <title><![CDATA[Indictments Against Largest ID Theft Ring Ever]]></title>
      <link>http://securityratty.com/article/159412d8049db4c0dd6a8e114a645515</link>
      <guid>http://securityratty.com/article/159412d8049db4c0dd6a8e114a645515</guid>
      <description><![CDATA[It was really big news yesterday , but I don't think it's that much of a big deal. These crimes are still easy to commit and it's still too hard to catch the criminals. Catching one gang, even a large...]]></description>
      <content:encoded><![CDATA[<p><a href="http://www.washingtonpost.com/wp-dyn/content/article/2008/08/05/AR2008080501859.html?hpid=moreheadlines">It</a> <a href="http://money.cnn.com/2008/08/05/news/companies/card_fraud/?postversion=2008080604">was</a> <a href="http://technology.timesonline.co.uk/tol/news/world/us_and_americas/article4468114.ece">really</a> <a href="http://www.iht.com/articles/ap/2008/08/06/business/NA-US-Retailer-Fraud-Indictment.php">big</a> <a href="http://www.theregister.co.uk/2008/08/06/id_fraud_hacking_case/">news</a> <a href="http://ap.google.com/article/ALeqM5hlC-7Qgf2_9ytmu5kKBpnEf5XzeQD92D20KG0">yesterday</a>, but I don't think it's that much of a big deal.  These crimes are still easy to commit and it's still too hard to catch the criminals.  Catching one gang, even a large one, isn't going to make us any safer.</p>

<p>If we want to <a href="http://www.schneier.com/blog/archives/2005/04/mitigating_iden.html">mitigate identity theft</a>, we have to make it harder for people to get credit, make transactions, and generally do financial business remotely:</p>

<blockquote>The crime involves two very separate issues. The first is the privacy of personal data. Personal privacy is important for many reasons, one of which is impersonation and fraud. As more information about us is collected, correlated, and sold, it becomes easier for criminals to get their hands on the data they need to commit fraud. This is what's been in the news recently: ChoicePoint, LexisNexis, Bank of America, and so on. But data privacy is more than just fraud. Whether it is the books we take out of the library, the websites we visit, or the contents of our text messages, most of us have personal data on third-party computers that we don't want made public. The posting of Paris Hilton's phone book on the Internet is a celebrity example of this.

<p>The second issue is the ease with which a criminal can use personal data to commit fraud. It doesn't take much personal information to apply for a credit card in someone else's name. It doesn't take much to submit fraudulent bank transactions in someone else's name. It's surprisingly easy to get an identification card in someone else's name. Our current culture, where identity is verified simply and sloppily, makes it easier for a criminal to impersonate his victim.</p>

<p>Proposed fixes tend to concentrate on the first issue -- making personal data harder to steal -- whereas the real problem is the second. If we're ever going to manage the risks and effects of electronic impersonation, we must concentrate on preventing and detecting fraudulent transactions.</blockquote></p>

<p>I am, however, impressed that we managed to pull together the police forces from several countries to prosecute this case.</p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=DF8G3K"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=DF8G3K" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=aICGEK"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=aICGEK" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Thu, 07 Aug 2008 08:45:29 +0000</pubDate>
      <category domain="http://securityratty.com/tag/personal data harder">personal data harder</category>
      <category domain="http://securityratty.com/tag/harder">harder</category>
      <category domain="http://securityratty.com/tag/data">data</category>
      <category domain="http://securityratty.com/tag/personal data">personal data</category>
      <category domain="http://securityratty.com/tag/commit fraud">commit fraud</category>
      <category domain="http://securityratty.com/tag/fraud">fraud</category>
      <category domain="http://securityratty.com/tag/commit">commit</category>
      <category domain="http://securityratty.com/tag/privacy">privacy</category>
      <category domain="http://securityratty.com/tag/personal privacy">personal privacy</category>
      <source url="http://www.schneier.com/blog/archives/2008/08/indictments_aga.html">Indictments Against Largest ID Theft Ring Ever</source>
    </item>
    <item>
      <title><![CDATA[When the shoe is on the other foot]]></title>
      <link>http://securityratty.com/article/70ffaafe90e77eabd152a83a018b3487</link>
      <guid>http://securityratty.com/article/70ffaafe90e77eabd152a83a018b3487</guid>
      <description><![CDATA[About to head over to morning sessions of Black Hat (OK, it started at 8am, but that is just an uncivil time for Las Vegas). Before I do, let me give you a quick recap of my first night on Black Hat....]]></description>
      <content:encoded><![CDATA[<p>About to head over to morning sessions of Black Hat (OK, it started at 8am, but that is just an uncivil time for Las Vegas).  Before I do, let me give you a quick recap of my first night on Black Hat. I didn’t get in until 10pm and got to my hotel about 11.  Looked up a few security twits and saw that Mitchell Ashley, Martin McKeay, JJ and Ryan Russell were at the Cleopatra Barge at Caesars.  I headed over there and met up.  The night was on!</p>  <p><a href="http://www.stillsecureafteralltheseyears.com/ashimmy/WindowsLiveWriter/pussycat-dolls-lounge.jpg"><img title="pussycat-dolls-lounge" style="border-right: 0px; border-top: 0px; margin: 5px 5px 5px 10px; border-left: 0px; border-bottom: 0px" height="192" alt="pussycat-dolls-lounge" src="http://www.stillsecureafteralltheseyears.com/ashimmy/WindowsLiveWriter/pussycat-dolls-lounge_thumb.jpg" width="240" align="right" border="0"></img></a> We had a quick drink and then headed over to the club Pure, where Fortify was having a party.  Some how or another JJ, Ryan and I got to the VIP entrance and were headed in.  Martin had to go upstairs and change out of his shorts.  Mitchell that Colorado country bumpkin was not allowed in because he was wearing sandals.  What to do?  Leave Mitchell outside, all of us not go in? I went back to my old club hopping days for the answer. I went  in with JJ.  Went to the bar, took off my shoes and gave them to JJ.  While I stood there in socks, she brought the shoes out to Mitchell, who put them on and got in the club.  Watching JJ sneak out the shoes and Mitchell walk in holding his sandals was pretty funny.   But it worked.  We got away from the Fortify party as it was way too crowded.  We found ourselves in my favorite part of Pure, the Pussycat Doll Lounge.  Five minutes later out came the Pussycats.  They put on a very hot show that had us all dancing and shouting.  </p>  <p>After that we went to my usual late night spot at Black Hat, the Augustus cafe for breakfast.  We met up with the Mogul and Hoff, who joined us.  By now it was like 2:30am Vegas time (5:30 east coast time) and it was time for bed.  I am staying at Paris, so had a nice walk but they did give me a LeMans suite which is very nice.  I still get a little confused by rooms with bidets, but it is fun.</p>  <p>Well off to Black Hat for some learning!</p>
<p><a href="http://feeds.feedburner.com/~a/StillsecureAfterAllTheseYears?a=27Z8hl"><img src="http://feeds.feedburner.com/~a/StillsecureAfterAllTheseYears?i=27Z8hl" border="0"></img></a></p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=jgRz8K"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=jgRz8K" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=5ikxYK"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=5ikxYK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=EuLGtK"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=EuLGtK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=Se9E4K"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=Se9E4K" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=jXFKVk"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=jXFKVk" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=Y2sUOk"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=Y2sUOk" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/StillsecureAfterAllTheseYears/~4/357490562" height="1" width="1"/>]]></content:encoded>
      <pubDate>Wed, 06 Aug 2008 06:16:46 +0000</pubDate>
      <category domain="http://securityratty.com/tag/time">time</category>
      <category domain="http://securityratty.com/tag/uncivil time">uncivil time</category>
      <category domain="http://securityratty.com/tag/black hat">black hat</category>
      <category domain="http://securityratty.com/tag/mitchell">mitchell</category>
      <category domain="http://securityratty.com/tag/east coast time">east coast time</category>
      <category domain="http://securityratty.com/tag/mitchell walk">mitchell walk</category>
      <category domain="http://securityratty.com/tag/mitchell ashley">mitchell ashley</category>
      <category domain="http://securityratty.com/tag/pure">pure</category>
      <category domain="http://securityratty.com/tag/club pure">club pure</category>
      <source url="http://feeds.feedburner.com/~r/StillsecureAfterAllTheseYears/~3/357490562/when-the-shoe-i.html">When the shoe is on the other foot</source>
    </item>
    <item>
      <title><![CDATA[ICANN's Announcement Of Anti-Domain Tasting Measures To Registrars]]></title>
      <link>http://securityratty.com/article/913d52903ceaedff758808be4b11d5bf</link>
      <guid>http://securityratty.com/article/913d52903ceaedff758808be4b11d5bf</guid>
      <description><![CDATA[The recent new that ICANN had taken measures to combat Domain Tasting came out in blogs, such as this one , based on second-hand news. ICANN had sent an e-mail to registrars announcing the policy...]]></description>
      <content:encoded><![CDATA[The recent new that ICANN had taken measures to combat Domain Tasting came out in blogs, <a href="http://www.domainnamenews.com/miscellaneous/icann-board-resolution-kills-domain-tasting/1689">such as this one</a>, based on second-hand news. ICANN had sent an e-mail to registrars announcing the policy change. But there was confusion over exactly what the policy was; most people just assumed it followed the recommendations of the GNSO council from April.  The incomplete information caused some confused analysis such as <a href="http://www.cadna.org/en/newsroom/press-releases/icann-tasting-solution">this from CADNA (the Coalition Against Domain Name Abuse)</a>.

I asked ICANN and they sent me the actual e-mail that they sent out to registrars. It is published below. My analysis of it is in <a href="http://www.eweek.com/c/a/Security/Yes-Domain-Tasting-Will-End/">a column on eWEEK</a>.

<blockquote>
Dear Registrar,

This message is intended to explain how certain decisions that were made by the ICANN Board of Directors at its meeting in Paris last week may affect your registrar.

Specifically, the Board adopted GNSO recommendations on domain tasting that included both budget and non-budget provisions designed to restrict the applicability of the Add Grace Period (AGP).  Please note that this message is a summary of changes that affect registrars.  You should refer to the adopted budget document and adopted motions for further information.


Summary of Important Timing Issues

After several months of discussion and public comment on both the budget and the GNSO recommendations, the Board has approved the proposed budget containing a provision for collecting transaction fees above a threshold during the AGP.  Effective 1 July 2008, the registrar-level transaction fee will be collected on transactions, including names added on or after 1 July
2008 and deleted during the Add Grace Period above a certain minimum threshold.  Each "transaction" will continue to be defined as a one-year domain registration increment caused by a successful add, renewal or transfer command, but this year any domain names deleted during the AGP (if
offered)
will be included as transactions if they exceed the maximum of (i) 10% of that registrar's net new registrations in that month (defined as total new registrations less domains deleted during AGP), or (ii) fifty (50) domain names, whichever is greater.  The budget assumes the transaction fee rate will remain at US ./send.20.

The second change prohibits registries from issuing refunds above a similar threshold for names registered and deleted during the AGP (although some registries have made plans to charge for such transactions independent of this motion).  The implementation timing of this change has not been set, but should be expected to take place over a period of some months.  ICANN staff will solicit public comments and post a registrar advisory prior to implementation of this aspect of the GNSO recommendation.


Budget - Registrar Fees Effective 1 July 2008

The Operating Plan and Budget details for 2008-2009 fiscal year can be found at:

http://www.icann.org/en/financials/proposed-opplan-budget-v3-fy09-25jun0
8-en.pdf

Relevant section from the approved budget:

* Registrar-Level Transaction Fees

In FY08 the per transaction-year rate was ./send.20 (or a 5 cent discount from the established ./send.25 rate).  The draft FY09 budget assumes that the ./send.20 rate will continue for registrar transaction fees.  As in past years, each transaction will be defined as one-year domain registration increment caused by a successful add renewal or transfer command.  FY09 revenue is estimated to be .4 million for registrar-level transaction fees.  Each "transaction"
will continue to be defined as a one-year domain registration increment caused by a successful add, renewal or transfer command, but this year any domain names deleted during the AGP (if offered) will be included as transactions if they exceed the maximum of (i) 10% of that registrar's net new registrations in that month (defined as total new registrations less domains deleted during AGP), or (ii) fifty (50) domain names, whichever is greater.  Therefore per-transaction fee will continue to be charged for each one-year increment of every transaction (e.g.  at a ./send.20 fee level, the fee for a three-year renewal will be US ./send.60), and registrars will continue to have the option to "defer" payment of the fees for the years beyond one for each transaction.  n

Note, as in previous years, ICANN can collect such fees directly from the registrars only if they are "expressly approved by registrars who account, in the aggregate, for payment of two-thirds of all registrar-level fees collected by ICANN." ICANN will shortly undertake the process of requesting such approval for the 2008-09 fiscal year.  While ICANN is grateful for consistent approval by registrars of fee levels in prior years, and is optimistic about such approval this year, if for some reason the necessary approval is not achieved, the fees will be collected by ICANN, as permitted under the registry agreements through the registries.  (Note that the amount of such fees varies by registry, but in no case exceeds US ./send.25.) Registries will then be able to collect those payments from registrars to the extent permitted under the relevant contracts.  It is expected that the same transaction increments (including AGP) will be covered, whether collected directly by ICANN or in! directly by the registries, so registrars should anticipate this liability under either scenario.


ICANN Board Resolution

Whereas, ICANN community stakeholders are increasingly concerned about domain tasting, which is the practice of using the add grace period (AGP) to register domain names in bulk in order to test their profitability.

Whereas, on 17 April 2008, the GNSO Council approved, by a Supermajority vote, a motion to prohibit any gTLD operator that has implemented an AGP from offering a refund for any domain name deleted during the AGP that exceeds 10% of its net new registrations in that month, or fifty domain names, whichever is greater.  <http://gnso.icann.org/meetings/minutes-gnso-17apr08.shtml>

Whereas, on 25 April 2008, the GNSO Council forwarded its formal "Report to the ICANN Board - Recommendation for Domain Tasting"
<http://gnso.icann.org/issues/domain-tasting/domain-tasting-board-report
-gnso-council-25apr08.pdf>,
which outlines the full text of the motion and the full context and procedural history of this proceeding.

Whereas, the Board is also considering the Proposed FY 09 Operating Plan and Budget <http://www.icann.org/financials/fiscal-30jun09.htm>, which includes (at the encouragement of the GNSO Council) a proposal similar to the GNSO policy recommendation to expand the applicability of the ICANN transaction fee in order to limit domain tasting.

Resolved (2008.06.26.06), the Board adopts the GNSO policy recommendation on domain tasting, and directs staff to implement the policy following appropriate comment and notice periods on the implementation documents.


Domain tasting motion approved by the GNSO Council 17 April 2008

<http://gnso.icann.org/issues/domain-tasting/domain-tasting-board-report
-gnso-council-25apr08.pdf>

Whereas, the GNSO Council has discussed the Issues Report on Domain Tasting and the Final Outcomes Report of the ad hoc group on Domain Tasting;

Whereas, the GNSO Council resolved on 31 October 2007 to launch a PDP on Domain Tasting;

Whereas, the GNSO Council authorized on 17 January 2008 the formation of a small design team to develop a plan for the deliberations on the Domain Tasting PDP (the "Design Team"), the principal volunteers to which had been members of the Ad Hoc Group on Domain Tasting and were well-informed of both the Final Outcomes Report of the Ad Hoc Group on Domain Tasting and the GNSO Initial Report on Domain Tasting (collectively with the Issues Report, the "Reports on Domain Tasting");

Whereas, the GNSO Council has received the Draft Final Report on Domain Tasting;

Whereas, PIR, the .org registry operator, has amended its Registry Agreement to charge an Excess Deletion Fee; and both NeuStar, the .biz registry operator, and Afilias, the .info registry operator, are seeking amendments to their respective Registry Agreements to modify the existing AGP;

The GNSO Council recommends to the ICANN Board of Directors that:

1.  The applicability of the Add Grace Period shall be restricted for any gTLD which has implemented an AGP ("Applicable gTLD Operator").
Specifically, for each Applicable gTLD Operator:

  a.  During any given month, an Applicable gTLD Operator may not offer any
  refund to a registrar for any domain names deleted during the AGP that
  exceed (i) 10% of that registrar's net new registrations in that month
  (defined as total new registrations less domains deleted during AGP), or
  (ii) fifty (50) domain names, whichever is greater.

  b.  A Registrar may seek an exemption from the application of such
  restriction in a specific month, upon the documented showing of
  extraordinary circumstances.  For any Registrar requesting such an
  exemption, the Registrar must confirm in writing to the Registry Operator
  how, at the time the names were deleted, these extraordinary circumstances
  were not known, reasonably could not have been known, and were outside of
  the Registrar's control.  Acceptance of any exemption will be at the sole
  reasonable discretion of the Registry Operator, however "extraordinary
  circumstances" which reoccur regularly will not be deemed extraordinary.

  c.  In addition to all other reporting requirements to ICANN, each
  Applicable gTLD Operator shall identify each Registrar that has sought an
  exemption, along with a brief descriptive identification of the type of
  extraordinary circumstance and the action (if any) that was taken by the
  Applicable gTLD Operator.

2.  Implementation and execution of these recommendations shall be monitored by the GNSO.  Specifically;

  a.  ICANN Staff shall analyze and report to the GNSO at six month intervals
  for two years after implementation, until such time as the GNSO resolves
  otherwise, with the goal of determining;

    i.  How effectively and to what extent the policies have been implemented
    and followed by Registries and Registrars, and

    ii.  Whether or not modifications to these policies should be considered
    by the GNSO as a result of the experiences gained during the
    implementation and monitoring stages,

  b.  The purpose of these monitoring and reporting requirements are to allow
  the GNSO to determine when, if ever, these recommendations and any ensuing
  policy require additional clarification or attention based on the results
  of the reports prepared by ICANN Staff.

</blockquote>

<br style="clear: both;"/>
  <img alt="" style="border: 0; height:1px; width:1px;" border="0" src="http://www.pheedo.com/img.phdo?i=152f487f101abbcdd9c900fc3eb46268" height="1" width="1"/>
<img src="http://www.pheedo.com/feeds/tracker.php?i=152f487f101abbcdd9c900fc3eb46268" style="display: none;" border="0" height="1" width="1" alt=""/><img src="http://feeds.ziffdavisenterprise.com/~r/RSS/cheap_hack/~4/330098895" height="1" width="1"/>]]></content:encoded>
      <pubDate>Tue, 08 Jul 2008 11:42:32 +0000</pubDate>
      <category domain="http://securityratty.com/tag/icann">icann</category>
      <category domain="http://securityratty.com/tag/directly">directly</category>
      <category domain="http://securityratty.com/tag/fees directly">fees directly</category>
      <category domain="http://securityratty.com/tag/fees">fees</category>
      <category domain="http://securityratty.com/tag/registrar fees effective">registrar fees effective</category>
      <category domain="http://securityratty.com/tag/effective">effective</category>
      <category domain="http://securityratty.com/tag/registrar-level fees">registrar-level fees</category>
      <category domain="http://securityratty.com/tag/fee">fee</category>
      <category domain="http://securityratty.com/tag/per-transaction fee">per-transaction fee</category>
      <source url="http://feeds.ziffdavisenterprise.com/~r/RSS/cheap_hack/~3/330098895/ch_icanns_announcement_of_antidomain_tasting_measures_to_registrars.html">ICANN's Announcement Of Anti-Domain Tasting Measures To Registrars</source>
    </item>
    <item>
      <title><![CDATA[ICANN's Announcement Of Anti-Domain Tasting Measures To Registrars]]></title>
      <link>http://securityratty.com/article/1438af7a2605c2bbe5326444d5bd9d27</link>
      <guid>http://securityratty.com/article/1438af7a2605c2bbe5326444d5bd9d27</guid>
      <description><![CDATA[The recent new that ICANN had taken measures to combat Domain Tasting came out in blogs, such as this one , based on second-hand news. ICANN had sent an e-mail to registrars announcing the policy...]]></description>
      <content:encoded><![CDATA[The recent new that ICANN had taken measures to combat Domain Tasting came out in blogs, <a href="http://www.domainnamenews.com/miscellaneous/icann-board-resolution-kills-domain-tasting/1689">such as this one</a>, based on second-hand news. ICANN had sent an e-mail to registrars announcing the policy change. But there was confusion over exactly what the policy was; most people just assumed it followed the recommendations of the GNSO council from April.  The incomplete information caused some confused analysis such as <a href="http://www.cadna.org/en/newsroom/press-releases/icann-tasting-solution">this from CADNA (the Coalition Against Domain Name Abuse)</a>.

I asked ICANN and they sent me the actual e-mail that they sent out to registrars. It is published below. My analysis of it is in <a href="http://www.eweek.com/c/a/Security/Yes-Domain-Tasting-Will-End/">a column on eWEEK</a>.

<blockquote>
Dear Registrar,

This message is intended to explain how certain decisions that were made by the ICANN Board of Directors at its meeting in Paris last week may affect your registrar.

Specifically, the Board adopted GNSO recommendations on domain tasting that included both budget and non-budget provisions designed to restrict the applicability of the Add Grace Period (AGP).  Please note that this message is a summary of changes that affect registrars.  You should refer to the adopted budget document and adopted motions for further information.


Summary of Important Timing Issues

After several months of discussion and public comment on both the budget and the GNSO recommendations, the Board has approved the proposed budget containing a provision for collecting transaction fees above a threshold during the AGP.  Effective 1 July 2008, the registrar-level transaction fee will be collected on transactions, including names added on or after 1 July
2008 and deleted during the Add Grace Period above a certain minimum threshold.  Each "transaction" will continue to be defined as a one-year domain registration increment caused by a successful add, renewal or transfer command, but this year any domain names deleted during the AGP (if
offered)
will be included as transactions if they exceed the maximum of (i) 10% of that registrar's net new registrations in that month (defined as total new registrations less domains deleted during AGP), or (ii) fifty (50) domain names, whichever is greater.  The budget assumes the transaction fee rate will remain at US ./send.20.

The second change prohibits registries from issuing refunds above a similar threshold for names registered and deleted during the AGP (although some registries have made plans to charge for such transactions independent of this motion).  The implementation timing of this change has not been set, but should be expected to take place over a period of some months.  ICANN staff will solicit public comments and post a registrar advisory prior to implementation of this aspect of the GNSO recommendation.


Budget - Registrar Fees Effective 1 July 2008

The Operating Plan and Budget details for 2008-2009 fiscal year can be found at:

http://www.icann.org/en/financials/proposed-opplan-budget-v3-fy09-25jun0
8-en.pdf

Relevant section from the approved budget:

* Registrar-Level Transaction Fees

In FY08 the per transaction-year rate was ./send.20 (or a 5 cent discount from the established ./send.25 rate).  The draft FY09 budget assumes that the ./send.20 rate will continue for registrar transaction fees.  As in past years, each transaction will be defined as one-year domain registration increment caused by a successful add renewal or transfer command.  FY09 revenue is estimated to be .4 million for registrar-level transaction fees.  Each "transaction"
will continue to be defined as a one-year domain registration increment caused by a successful add, renewal or transfer command, but this year any domain names deleted during the AGP (if offered) will be included as transactions if they exceed the maximum of (i) 10% of that registrar's net new registrations in that month (defined as total new registrations less domains deleted during AGP), or (ii) fifty (50) domain names, whichever is greater.  Therefore per-transaction fee will continue to be charged for each one-year increment of every transaction (e.g.  at a ./send.20 fee level, the fee for a three-year renewal will be US ./send.60), and registrars will continue to have the option to "defer" payment of the fees for the years beyond one for each transaction.  n

Note, as in previous years, ICANN can collect such fees directly from the registrars only if they are "expressly approved by registrars who account, in the aggregate, for payment of two-thirds of all registrar-level fees collected by ICANN." ICANN will shortly undertake the process of requesting such approval for the 2008-09 fiscal year.  While ICANN is grateful for consistent approval by registrars of fee levels in prior years, and is optimistic about such approval this year, if for some reason the necessary approval is not achieved, the fees will be collected by ICANN, as permitted under the registry agreements through the registries.  (Note that the amount of such fees varies by registry, but in no case exceeds US ./send.25.) Registries will then be able to collect those payments from registrars to the extent permitted under the relevant contracts.  It is expected that the same transaction increments (including AGP) will be covered, whether collected directly by ICANN or in! directly by the registries, so registrars should anticipate this liability under either scenario.


ICANN Board Resolution

Whereas, ICANN community stakeholders are increasingly concerned about domain tasting, which is the practice of using the add grace period (AGP) to register domain names in bulk in order to test their profitability.

Whereas, on 17 April 2008, the GNSO Council approved, by a Supermajority vote, a motion to prohibit any gTLD operator that has implemented an AGP from offering a refund for any domain name deleted during the AGP that exceeds 10% of its net new registrations in that month, or fifty domain names, whichever is greater.  <http://gnso.icann.org/meetings/minutes-gnso-17apr08.shtml>

Whereas, on 25 April 2008, the GNSO Council forwarded its formal "Report to the ICANN Board - Recommendation for Domain Tasting"
<http://gnso.icann.org/issues/domain-tasting/domain-tasting-board-report
-gnso-council-25apr08.pdf>,
which outlines the full text of the motion and the full context and procedural history of this proceeding.

Whereas, the Board is also considering the Proposed FY 09 Operating Plan and Budget <http://www.icann.org/financials/fiscal-30jun09.htm>, which includes (at the encouragement of the GNSO Council) a proposal similar to the GNSO policy recommendation to expand the applicability of the ICANN transaction fee in order to limit domain tasting.

Resolved (2008.06.26.06), the Board adopts the GNSO policy recommendation on domain tasting, and directs staff to implement the policy following appropriate comment and notice periods on the implementation documents.


Domain tasting motion approved by the GNSO Council 17 April 2008

<http://gnso.icann.org/issues/domain-tasting/domain-tasting-board-report
-gnso-council-25apr08.pdf>

Whereas, the GNSO Council has discussed the Issues Report on Domain Tasting and the Final Outcomes Report of the ad hoc group on Domain Tasting;

Whereas, the GNSO Council resolved on 31 October 2007 to launch a PDP on Domain Tasting;

Whereas, the GNSO Council authorized on 17 January 2008 the formation of a small design team to develop a plan for the deliberations on the Domain Tasting PDP (the "Design Team"), the principal volunteers to which had been members of the Ad Hoc Group on Domain Tasting and were well-informed of both the Final Outcomes Report of the Ad Hoc Group on Domain Tasting and the GNSO Initial Report on Domain Tasting (collectively with the Issues Report, the "Reports on Domain Tasting");

Whereas, the GNSO Council has received the Draft Final Report on Domain Tasting;

Whereas, PIR, the .org registry operator, has amended its Registry Agreement to charge an Excess Deletion Fee; and both NeuStar, the .biz registry operator, and Afilias, the .info registry operator, are seeking amendments to their respective Registry Agreements to modify the existing AGP;

The GNSO Council recommends to the ICANN Board of Directors that:

1.  The applicability of the Add Grace Period shall be restricted for any gTLD which has implemented an AGP ("Applicable gTLD Operator").
Specifically, for each Applicable gTLD Operator:

  a.  During any given month, an Applicable gTLD Operator may not offer any
  refund to a registrar for any domain names deleted during the AGP that
  exceed (i) 10% of that registrar's net new registrations in that month
  (defined as total new registrations less domains deleted during AGP), or
  (ii) fifty (50) domain names, whichever is greater.

  b.  A Registrar may seek an exemption from the application of such
  restriction in a specific month, upon the documented showing of
  extraordinary circumstances.  For any Registrar requesting such an
  exemption, the Registrar must confirm in writing to the Registry Operator
  how, at the time the names were deleted, these extraordinary circumstances
  were not known, reasonably could not have been known, and were outside of
  the Registrar's control.  Acceptance of any exemption will be at the sole
  reasonable discretion of the Registry Operator, however "extraordinary
  circumstances" which reoccur regularly will not be deemed extraordinary.

  c.  In addition to all other reporting requirements to ICANN, each
  Applicable gTLD Operator shall identify each Registrar that has sought an
  exemption, along with a brief descriptive identification of the type of
  extraordinary circumstance and the action (if any) that was taken by the
  Applicable gTLD Operator.

2.  Implementation and execution of these recommendations shall be monitored by the GNSO.  Specifically;

  a.  ICANN Staff shall analyze and report to the GNSO at six month intervals
  for two years after implementation, until such time as the GNSO resolves
  otherwise, with the goal of determining;

    i.  How effectively and to what extent the policies have been implemented
    and followed by Registries and Registrars, and

    ii.  Whether or not modifications to these policies should be considered
    by the GNSO as a result of the experiences gained during the
    implementation and monitoring stages,

  b.  The purpose of these monitoring and reporting requirements are to allow
  the GNSO to determine when, if ever, these recommendations and any ensuing
  policy require additional clarification or attention based on the results
  of the reports prepared by ICANN Staff.

</blockquote>

<br style="clear: both;"/>
      <a href="http://www.pheedo.com/click.phdo?s=8eea0eb864e902bc67c9b814b1af0256"><img alt="" style="border: 0;" border="0" src="http://www.pheedo.com/img.phdo?s=8eea0eb864e902bc67c9b814b1af0256"/></a>
  <img src="http://www.pheedo.com/feeds/tracker.php?i=8eea0eb864e902bc67c9b814b1af0256" style="display: none;" border="0" height="1" width="1" alt=""/><img src="http://feeds.ziffdavisenterprise.com/~r/RSS/cheap_hack/~4/338277687" height="1" width="1"/>]]></content:encoded>
      <pubDate>Tue, 08 Jul 2008 11:42:32 +0000</pubDate>
      <category domain="http://securityratty.com/tag/icann">icann</category>
      <category domain="http://securityratty.com/tag/directly">directly</category>
      <category domain="http://securityratty.com/tag/fees directly">fees directly</category>
      <category domain="http://securityratty.com/tag/fees">fees</category>
      <category domain="http://securityratty.com/tag/registrar fees effective">registrar fees effective</category>
      <category domain="http://securityratty.com/tag/effective">effective</category>
      <category domain="http://securityratty.com/tag/registrar-level fees">registrar-level fees</category>
      <category domain="http://securityratty.com/tag/fee">fee</category>
      <category domain="http://securityratty.com/tag/per-transaction fee">per-transaction fee</category>
      <source url="http://feeds.ziffdavisenterprise.com/~r/RSS/cheap_hack/~3/338277687/ch_icanns_announcement_of_antidomain_tasting_measures_to_registrars.html">ICANN's Announcement Of Anti-Domain Tasting Measures To Registrars</source>
    </item>
    <item>
      <title><![CDATA[ICANN's Announcement Of Anti-Domain Tasting Measures To Registrars]]></title>
      <link>http://securityratty.com/article/266456c2c42bc5e4cf836f3ca19af1c2</link>
      <guid>http://securityratty.com/article/266456c2c42bc5e4cf836f3ca19af1c2</guid>
      <description><![CDATA[The recent new that ICANN had taken measures to combat Domain Tasting came out in blogs, such as this one , based on second-hand news. ICANN had sent an e-mail to registrars announcing the policy...]]></description>
      <content:encoded><![CDATA[The recent new that ICANN had taken measures to combat Domain Tasting came out in blogs, <a href="http://www.domainnamenews.com/miscellaneous/icann-board-resolution-kills-domain-tasting/1689">such as this one</a>, based on second-hand news. ICANN had sent an e-mail to registrars announcing the policy change. But there was confusion over exactly what the policy was; most people just assumed it followed the recommendations of the GNSO council from April.  The incomplete information caused some confused analysis such as <a href="http://www.cadna.org/en/newsroom/press-releases/icann-tasting-solution">this from CADNA (the Coalition Against Domain Name Abuse)</a>.

I asked ICANN and they sent me the actual e-mail that they sent out to registrars. It is published below. My analysis of it is in <a href="http://www.eweek.com/c/a/Security/Yes-Domain-Tasting-Will-End/">a column on eWEEK</a>.

<blockquote>
Dear Registrar,

This message is intended to explain how certain decisions that were made by the ICANN Board of Directors at its meeting in Paris last week may affect your registrar.

Specifically, the Board adopted GNSO recommendations on domain tasting that included both budget and non-budget provisions designed to restrict the applicability of the Add Grace Period (AGP).  Please note that this message is a summary of changes that affect registrars.  You should refer to the adopted budget document and adopted motions for further information.


Summary of Important Timing Issues

After several months of discussion and public comment on both the budget and the GNSO recommendations, the Board has approved the proposed budget containing a provision for collecting transaction fees above a threshold during the AGP.  Effective 1 July 2008, the registrar-level transaction fee will be collected on transactions, including names added on or after 1 July
2008 and deleted during the Add Grace Period above a certain minimum threshold.  Each "transaction" will continue to be defined as a one-year domain registration increment caused by a successful add, renewal or transfer command, but this year any domain names deleted during the AGP (if
offered)
will be included as transactions if they exceed the maximum of (i) 10% of that registrar's net new registrations in that month (defined as total new registrations less domains deleted during AGP), or (ii) fifty (50) domain names, whichever is greater.  The budget assumes the transaction fee rate will remain at US ./send.20.

The second change prohibits registries from issuing refunds above a similar threshold for names registered and deleted during the AGP (although some registries have made plans to charge for such transactions independent of this motion).  The implementation timing of this change has not been set, but should be expected to take place over a period of some months.  ICANN staff will solicit public comments and post a registrar advisory prior to implementation of this aspect of the GNSO recommendation.


Budget - Registrar Fees Effective 1 July 2008

The Operating Plan and Budget details for 2008-2009 fiscal year can be found at:

http://www.icann.org/en/financials/proposed-opplan-budget-v3-fy09-25jun0
8-en.pdf

Relevant section from the approved budget:

* Registrar-Level Transaction Fees

In FY08 the per transaction-year rate was ./send.20 (or a 5 cent discount from the established ./send.25 rate).  The draft FY09 budget assumes that the ./send.20 rate will continue for registrar transaction fees.  As in past years, each transaction will be defined as one-year domain registration increment caused by a successful add renewal or transfer command.  FY09 revenue is estimated to be .4 million for registrar-level transaction fees.  Each "transaction"
will continue to be defined as a one-year domain registration increment caused by a successful add, renewal or transfer command, but this year any domain names deleted during the AGP (if offered) will be included as transactions if they exceed the maximum of (i) 10% of that registrar's net new registrations in that month (defined as total new registrations less domains deleted during AGP), or (ii) fifty (50) domain names, whichever is greater.  Therefore per-transaction fee will continue to be charged for each one-year increment of every transaction (e.g.  at a ./send.20 fee level, the fee for a three-year renewal will be US ./send.60), and registrars will continue to have the option to "defer" payment of the fees for the years beyond one for each transaction.  n

Note, as in previous years, ICANN can collect such fees directly from the registrars only if they are "expressly approved by registrars who account, in the aggregate, for payment of two-thirds of all registrar-level fees collected by ICANN." ICANN will shortly undertake the process of requesting such approval for the 2008-09 fiscal year.  While ICANN is grateful for consistent approval by registrars of fee levels in prior years, and is optimistic about such approval this year, if for some reason the necessary approval is not achieved, the fees will be collected by ICANN, as permitted under the registry agreements through the registries.  (Note that the amount of such fees varies by registry, but in no case exceeds US ./send.25.) Registries will then be able to collect those payments from registrars to the extent permitted under the relevant contracts.  It is expected that the same transaction increments (including AGP) will be covered, whether collected directly by ICANN or in! directly by the registries, so registrars should anticipate this liability under either scenario.


ICANN Board Resolution

Whereas, ICANN community stakeholders are increasingly concerned about domain tasting, which is the practice of using the add grace period (AGP) to register domain names in bulk in order to test their profitability.

Whereas, on 17 April 2008, the GNSO Council approved, by a Supermajority vote, a motion to prohibit any gTLD operator that has implemented an AGP from offering a refund for any domain name deleted during the AGP that exceeds 10% of its net new registrations in that month, or fifty domain names, whichever is greater.  <http://gnso.icann.org/meetings/minutes-gnso-17apr08.shtml>

Whereas, on 25 April 2008, the GNSO Council forwarded its formal "Report to the ICANN Board - Recommendation for Domain Tasting"
<http://gnso.icann.org/issues/domain-tasting/domain-tasting-board-report
-gnso-council-25apr08.pdf>,
which outlines the full text of the motion and the full context and procedural history of this proceeding.

Whereas, the Board is also considering the Proposed FY 09 Operating Plan and Budget <http://www.icann.org/financials/fiscal-30jun09.htm>, which includes (at the encouragement of the GNSO Council) a proposal similar to the GNSO policy recommendation to expand the applicability of the ICANN transaction fee in order to limit domain tasting.

Resolved (2008.06.26.06), the Board adopts the GNSO policy recommendation on domain tasting, and directs staff to implement the policy following appropriate comment and notice periods on the implementation documents.


Domain tasting motion approved by the GNSO Council 17 April 2008

<http://gnso.icann.org/issues/domain-tasting/domain-tasting-board-report
-gnso-council-25apr08.pdf>

Whereas, the GNSO Council has discussed the Issues Report on Domain Tasting and the Final Outcomes Report of the ad hoc group on Domain Tasting;

Whereas, the GNSO Council resolved on 31 October 2007 to launch a PDP on Domain Tasting;

Whereas, the GNSO Council authorized on 17 January 2008 the formation of a small design team to develop a plan for the deliberations on the Domain Tasting PDP (the "Design Team"), the principal volunteers to which had been members of the Ad Hoc Group on Domain Tasting and were well-informed of both the Final Outcomes Report of the Ad Hoc Group on Domain Tasting and the GNSO Initial Report on Domain Tasting (collectively with the Issues Report, the "Reports on Domain Tasting");

Whereas, the GNSO Council has received the Draft Final Report on Domain Tasting;

Whereas, PIR, the .org registry operator, has amended its Registry Agreement to charge an Excess Deletion Fee; and both NeuStar, the .biz registry operator, and Afilias, the .info registry operator, are seeking amendments to their respective Registry Agreements to modify the existing AGP;

The GNSO Council recommends to the ICANN Board of Directors that:

1.  The applicability of the Add Grace Period shall be restricted for any gTLD which has implemented an AGP ("Applicable gTLD Operator").
Specifically, for each Applicable gTLD Operator:

  a.  During any given month, an Applicable gTLD Operator may not offer any
  refund to a registrar for any domain names deleted during the AGP that
  exceed (i) 10% of that registrar's net new registrations in that month
  (defined as total new registrations less domains deleted during AGP), or
  (ii) fifty (50) domain names, whichever is greater.

  b.  A Registrar may seek an exemption from the application of such
  restriction in a specific month, upon the documented showing of
  extraordinary circumstances.  For any Registrar requesting such an
  exemption, the Registrar must confirm in writing to the Registry Operator
  how, at the time the names were deleted, these extraordinary circumstances
  were not known, reasonably could not have been known, and were outside of
  the Registrar's control.  Acceptance of any exemption will be at the sole
  reasonable discretion of the Registry Operator, however "extraordinary
  circumstances" which reoccur regularly will not be deemed extraordinary.

  c.  In addition to all other reporting requirements to ICANN, each
  Applicable gTLD Operator shall identify each Registrar that has sought an
  exemption, along with a brief descriptive identification of the type of
  extraordinary circumstance and the action (if any) that was taken by the
  Applicable gTLD Operator.

2.  Implementation and execution of these recommendations shall be monitored by the GNSO.  Specifically;

  a.  ICANN Staff shall analyze and report to the GNSO at six month intervals
  for two years after implementation, until such time as the GNSO resolves
  otherwise, with the goal of determining;

    i.  How effectively and to what extent the policies have been implemented
    and followed by Registries and Registrars, and

    ii.  Whether or not modifications to these policies should be considered
    by the GNSO as a result of the experiences gained during the
    implementation and monitoring stages,

  b.  The purpose of these monitoring and reporting requirements are to allow
  the GNSO to determine when, if ever, these recommendations and any ensuing
  policy require additional clarification or attention based on the results
  of the reports prepared by ICANN Staff.

</blockquote><img src="http://feedproxy.google.com/~r/RSS/cheap_hack/~4/xJKws7q3qKE" height="1" width="1"/>]]></content:encoded>
      <pubDate>Tue, 08 Jul 2008 11:42:32 +0000</pubDate>
      <category domain="http://securityratty.com/tag/icann">icann</category>
      <category domain="http://securityratty.com/tag/directly">directly</category>
      <category domain="http://securityratty.com/tag/fees directly">fees directly</category>
      <category domain="http://securityratty.com/tag/fees">fees</category>
      <category domain="http://securityratty.com/tag/registrar fees effective">registrar fees effective</category>
      <category domain="http://securityratty.com/tag/effective">effective</category>
      <category domain="http://securityratty.com/tag/registrar-level fees">registrar-level fees</category>
      <category domain="http://securityratty.com/tag/fee">fee</category>
      <category domain="http://securityratty.com/tag/per-transaction fee">per-transaction fee</category>
      <source url="http://feeds.ziffdavisenterprise.com/~r/RSS/cheap_hack/~3/xJKws7q3qKE/ch_icanns_announcement_of_antidomain_tasting_measures_to_registrars.html">ICANN's Announcement Of Anti-Domain Tasting Measures To Registrars</source>
    </item>
    <item>
      <title><![CDATA[$1B market for meddling with DNS poses security problem]]></title>
      <link>http://securityratty.com/article/9ab33b44a0f3766f9ad4e8f4aec36c69</link>
      <guid>http://securityratty.com/article/9ab33b44a0f3766f9ad4e8f4aec36c69</guid>
      <description><![CDATA[The interception of Internet traffic to snoop on phone calls or track surfers' behavior is a hot topic -- but what's keeping members of ICANN's Security and Stability Advisory Committee up at night is...]]></description>
      <content:encoded><![CDATA[The interception of Internet traffic to snoop on phone calls or track surfers' behavior is a hot topic -- but what's keeping members of ICANN's Security and Stability Advisory Committee up at night is the interception of traffic to and from sites that don't even exist. They explained why in a session at ICANN's public meeting in Paris on Monday.<p><A href="http://ad.doubleclick.net/jump/idg.us.nwf.rss/security;sz=468x60;ord=48650?">
<IMG src="http://ad.doubleclick.net/ad/idg.us.nwf.rss/security;sz=468x60;ord=48650?" border="0" width="468" height="60"></A>
</p>]]></content:encoded>
      <pubDate>Mon, 23 Jun 2008 20:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/internet traffic">internet traffic</category>
      <category domain="http://securityratty.com/tag/traffic">traffic</category>
      <category domain="http://securityratty.com/tag/stability advisory committee">stability advisory committee</category>
      <category domain="http://securityratty.com/tag/track surfers">track surfers</category>
      <category domain="http://securityratty.com/tag/icann">icann</category>
      <category domain="http://securityratty.com/tag/interception">interception</category>
      <category domain="http://securityratty.com/tag/hot topic">hot topic</category>
      <category domain="http://securityratty.com/tag/phone calls">phone calls</category>
      <category domain="http://securityratty.com/tag/security">security</category>
      <source url="http://www.networkworld.com/news/2008/062408-1b-market-for-meddling-with.html?fsrc=rss-security">$1B market for meddling with DNS poses security problem</source>
    </item>
    <item>
      <title><![CDATA[Fake Celebrity Video Sites Serving Malware]]></title>
      <link>http://securityratty.com/article/e6b6b6bb079e0140b924b302a0f75bb8</link>
      <guid>http://securityratty.com/article/e6b6b6bb079e0140b924b302a0f75bb8</guid>
      <description><![CDATA[With blackhat search engine optimization tactics clearly converging with social engineering , the result of which is the increasing supply of Zlob malware variants served as fake codecs, it's about...]]></description>
      <content:encoded><![CDATA[<a href="http://bp0.blogger.com/_wICHhTiQmrA/SFuPgUZ-1iI/AAAAAAAABz0/CfFQY0pYbO4/s1600-h/fake_celebrity_sites_malware1.JPG"><img id="BLOGGER_PHOTO_ID_5213918779007751714" style="margin: 0px 10px 10px 0px; float: left;" alt="" src="http://bp0.blogger.com/_wICHhTiQmrA/SFuPgUZ-1iI/AAAAAAAABz0/CfFQY0pYbO4/s200/fake_celebrity_sites_malware1.JPG" border="0" /></a>With <a href="http://ddanchev.blogspot.com/2008/06/blackhat-seo-redirects-to-malware-and.html">blackhat search engine optimization tactics clearly converging with social engineering</a>, the result of which is the increasing supply of Zlob malware variants served as fake codecs, it's about time we spill some coffee on several campaigns in order to get a better understanding of the way the campaigns function.<br /><div><br />These campaigns are also starting to get so sophisticated, that analyzing a single one will expose another massive SQL injection, reveal several blackhat SEO domain farms, let you obtain fresh Zlob malware variants, and point you to the very latest and undetected rogue software if you manage to expose the entire scammy ecosystem through all the redirections put in place to make it harder to get to the bottom of it.<br /><br /><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://bp2.blogger.com/_wICHhTiQmrA/SFuTjKmVT2I/AAAAAAAAB0M/uoqsc9RfJNU/s1600-h/fake_celebrity_sites_malware2.JPG"><img style="margin: 0pt 10px 10px 0pt; float: left; cursor: pointer;" src="http://bp2.blogger.com/_wICHhTiQmrA/SFuTjKmVT2I/AAAAAAAAB0M/uoqsc9RfJNU/s200/fake_celebrity_sites_malware2.JPG" alt="" id="BLOGGER_PHOTO_ID_5213923225961320290" border="0" /></a>What's important to keep in mind when assessing and shutting down such comprehensive campaigns is that on the majority of occassions the front end domains as well as the secondary ones are all attempting to download the codecs from hardcoded locations. Consequently, you have 50 front end domains and another 50 as secondary redirection points all attempting to download the codecs from 3 download locations. Once again, the malware authors efficiency centered mentality emphasising on the easy of management for the campaign is making it possible to.<br /><br /><div>Here's are some currently active fake celebrity video sites serving malware including the codec redirectors :<br /><br /><a href="http://bp3.blogger.com/_wICHhTiQmrA/SFuQGWDNAzI/AAAAAAAABz8/V4kNHEWuR0A/s1600-h/fake_celebrity_sites_malware.JPG"><img id="BLOGGER_PHOTO_ID_5213919432284111666" style="margin: 0px 10px 10px 0px; float: left;" alt="" src="http://bp3.blogger.com/_wICHhTiQmrA/SFuQGWDNAzI/AAAAAAAABz8/V4kNHEWuR0A/s200/fake_celebrity_sites_malware.JPG" border="0" /></a><span style="font-weight: bold;">stillnaked.net</span> <span style="font-weight: bold;"><br />funkytube.net</span><br /><span style="font-weight: bold;">starvid.info</span> <span style="font-weight: bold;"><br />yetmorefun.net</span> <span style="font-weight: bold;"><br />hotnudity.net</span> <span style="font-weight: bold;"><br />alreadynude.com</span> <span style="font-weight: bold;"><br />celebvids.info</span> <span style="font-weight: bold;"><br />sexystar.name</span> <span style="font-weight: bold;"><br />hotserved.net</span> <span style="font-weight: bold;"><br />thestars2008.com</span><br /><span style="font-weight: bold;">nudde.net</span> <span style="font-weight: bold;"><br />gottabigfuick.com</span> <span style="font-weight: bold;"><br />moviecity.se</span> <span style="font-weight: bold;"><br />gossip-starz.com</span> <span style="font-weight: bold;"><br />tmz-video.com</span><br /><span style="font-weight: bold;">js0.info</span> <span style="font-weight: bold;"><br />superfakamyvideo.com</span> <span style="font-weight: bold;"><br />hdavidz.com</span> <span style="font-weight: bold;"><br /></span><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://bp0.blogger.com/_wICHhTiQmrA/SFuRy8PMNtI/AAAAAAAAB0E/qBrd4frSeM0/s1600-h/thestars2008_com_visualized.JPG"><img style="margin: 0pt 10px 10px 0pt; float: left; cursor: pointer;" src="http://bp0.blogger.com/_wICHhTiQmrA/SFuRy8PMNtI/AAAAAAAAB0E/qBrd4frSeM0/s200/thestars2008_com_visualized.JPG" alt="" id="BLOGGER_PHOTO_ID_5213921297960810194" border="0" /></a><span style="font-weight: bold;">blog-x.in</span> <span style="font-weight: bold;"><br /></span><span style="font-weight: bold;">tmz-video.com</span> <span style="font-weight: bold;"><br />newhotpeople.com</span> <span style="font-weight: bold;"><br />dirty-gossips.com</span> <span style="font-weight: bold;"><br />flaxxvid.com</span> <span style="font-weight: bold;"><br />videoid.info</span> <span style="font-weight: bold;"><br />realvideofree.com</span> <span style="font-weight: bold;"><br />yetmorefun.net</span> <span style="font-weight: bold;"><br />popvids.info<br />ihavewetfuckpussy.com<br /></span><span style="font-weight: bold;">virus-scanonline.com</span> <span style="font-weight: bold;"><br />adultx2008.com</span><br /><span style="font-weight: bold;">lux-software2008.com</span><br /><br />As well as some sample subdomains for traffic acquisition purposes, since all of these have already been crawled by search engines :<br /><br /><span style="font-weight: bold;">jodie.popvids.info</span> <span style="font-weight: bold;"><br />jessica.popvids.info</span> <span style="font-weight: bold;"><br />tila.popvids.info</span><br /><span style="font-weight: bold;">paris.celebvids.info</span> <span style="font-weight: bold;"><br />vanessa.celebvids.info</span> <span style="font-weight: bold;"><br />britney.nudde.net</span> <span style="font-weight: bold;"><br />paris.nudde.net</span> <span style="font-weight: bold;"><br />kardashian.nudde.net</span> <span style="font-weight: bold;"><br />vanessahudgens.yetmorefun.net</span> <span style="font-weight: bold;"><br />lindsaylohan.yetmorefun.net</span> <span style="font-weight: bold;"><br />britneyspears.yetmorefun.net</span> <span style="font-weight: bold;"><br />parishilton.yetmorefun.net</span> <span style="font-weight: bold;"><br />kardashian.nudde.net</span><br /><br />We also have embedded IFRAMEs and as well as injected ones into vulnerable sites, acting as redirectors to some of these fake video sites. For instance, at the <span style="font-weight: bold;">pedophilesexstories.blog.com</span> we have an injected redirector - <span style="font-weight: bold;">js0.info/?s=16&amp;k=pedophile+sex+stories&amp;c=5</span> and <span style="font-weight: bold;">js0.info</span> itself is a blackhat SEO operation that's aggregating generic search traffic like this :<br /><br /><span style="font-weight: bold;">js0.info/16/5/ragnarok+hentai</span> <span style="font-weight: bold;"><br />js0.info/15/4/antivirus+characteristic</span><br /><span style="font-weight: bold;">js0.info/16/5/msn+monkey</span><br /><span style="font-weight: bold;">js0.info/15/4/airplus+internet+security</span><br /><br /><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://bp1.blogger.com/_wICHhTiQmrA/SFuW_npeNMI/AAAAAAAAB0U/aqnVPUbVWjc/s1600-h/malicious_redirector_script.JPG"><img style="margin: 0pt 10px 10px 0pt; float: left; cursor: pointer;" src="http://bp1.blogger.com/_wICHhTiQmrA/SFuW_npeNMI/AAAAAAAAB0U/aqnVPUbVWjc/s200/malicious_redirector_script.JPG" alt="" id="BLOGGER_PHOTO_ID_5213927013330334914" border="0" /></a>Once accessed, you get redirected to through <a href="http://ddanchev.blogspot.com/2008/06/malicious-doorways-redirecting-to.html">two separate redirection campaigns</a> at <span style="font-weight: bold;">searchaw.info/sa/in.cgi?16</span>; and <span style="font-weight: bold;">hmel.info/stds13/go.php</span>, until you finally get to the codecs.<br /><br />With blackhat SEO-ers already well developed inventory of topical junk content, and experience in what's popular content and what's not,  the entry barriers for malware authors into the traffic acquisition joys of blackhat SEO has never lower.<br /></div></div><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=WOphoI"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=WOphoI" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=W1jLhI"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=W1jLhI" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=PO1pbi"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=PO1pbi" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=b0ILEi"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=b0ILEi" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=HEkGpI"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=HEkGpI" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=vnYhGI"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=vnYhGI" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=1X0RPi"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=1X0RPi" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/316164970" height="1" width="1"/>]]></content:encoded>
      <pubDate>Fri, 20 Jun 2008 02:58:44 +0000</pubDate>
      <category domain="http://securityratty.com/tag/malware">malware</category>
      <category domain="http://securityratty.com/tag/blackhat seo-ers">blackhat seo-ers</category>
      <category domain="http://securityratty.com/tag/blackhat seo">blackhat seo</category>
      <category domain="http://securityratty.com/tag/net">net</category>
      <category domain="http://securityratty.com/tag/malware authors">malware authors</category>
      <category domain="http://securityratty.com/tag/malware authors efficiency">malware authors efficiency</category>
      <category domain="http://securityratty.com/tag/blackhat seo operation">blackhat seo operation</category>
      <category domain="http://securityratty.com/tag/info">info</category>
      <category domain="http://securityratty.com/tag/blackhat">blackhat</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/316164970/fake-celebrity-video-sites-serving.html">Fake Celebrity Video Sites Serving Malware</source>
    </item>
    <item>
      <title><![CDATA[Five reasons SocGen did not detect that $7 billion fraud]]></title>
      <link>http://securityratty.com/article/0206d215620c074008882bf996ff888a</link>
      <guid>http://securityratty.com/article/0206d215620c074008882bf996ff888a</guid>
      <description><![CDATA[You'd think it wouldn't be so easy to lose $7 billion through just one relatively low-level employee's actions, but a report released last week by Paris-based Societe Generale showed that no man, not...]]></description>
      <content:encoded><![CDATA[You'd think it wouldn't be so easy to lose $7 billion through just one relatively low-level employee's actions, but a report released last week by Paris-based Societe Generale showed that no man, not even a fraudster, is an island.
<p><a href="http://feeds.computerworld.com/~a/Computerworld/Security/News?a=L0mQTf"><img src="http://feeds.computerworld.com/~a/Computerworld/Security/News?i=L0mQTf" border="0"></img></a></p><img src="http://feeds.computerworld.com/~r/Computerworld/Security/News/~4/299522806" height="1" width="1"/>]]></content:encoded>
      <pubDate>Tue, 27 May 2008 09:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/low-level employee">low-level employee</category>
      <category domain="http://securityratty.com/tag/billion">billion</category>
      <category domain="http://securityratty.com/tag/societe generale">societe generale</category>
      <category domain="http://securityratty.com/tag/actions">actions</category>
      <category domain="http://securityratty.com/tag/island">island</category>
      <category domain="http://securityratty.com/tag/week">week</category>
      <category domain="http://securityratty.com/tag/easy">easy</category>
      <category domain="http://securityratty.com/tag/report">report</category>
      <category domain="http://securityratty.com/tag/fraudster">fraudster</category>
      <source url="http://feeds.computerworld.com/~r/Computerworld/Security/News/~3/299522806/article.do">Five reasons SocGen did not detect that $7 billion fraud</source>
    </item>
    <item>
      <title><![CDATA[Thalys Hits Glitch in Impressive Train Launch]]></title>
      <link>http://securityratty.com/article/017e06ae2b23fbae6f8c43e35598b70e</link>
      <guid>http://securityratty.com/article/017e06ae2b23fbae6f8c43e35598b70e</guid>
      <description><![CDATA[Thalys has launched Internet service on high-speed train routes between Paris, Brussels, Amsterdam, and Cologne: The service hit glitches in its big press rollout, but glitches shouldn't be mistaken...]]></description>
      <content:encoded><![CDATA[<p><img src="http://wifinetnews.com/images/train.jpg" align="right" border="0" hspace="5" /><a href="http://news.yahoo.com/s/pcworld/20080514/tc_pcworld/145901"><strong>Thalys has launched Internet service on high-speed train routes between  Paris, Brussels, Amsterdam, and Cologne:</strong></a> The service hit glitches in its big press rollout, but glitches shouldn't be mistaken for actual performance. The satellite-backed service pulls down 2 Mbps of ruinously expensive backhaul, compressed to provide speeds that feel like 4 Mbps. (Read: faster for email, TIFF images, certain PowerPoint presentations, and Web pages with gzip disabled; normal rate for JPEGs, GIFs, compressed Web pages, and PDFs.)</p>

<p>The service will cost first-class passengers not a thing, but coach will pay &euro;6.50 (US$10) per hour or &euro;13 (US$20) for an entire trip. The train operator is initially equipping 7 trains, but will complete work on all 26 trains by October. Trip durations run from 1 hour 20 minutes to 3 hours.</p>

<p>Most impressively, the consortium that built the system is using a pretty modest antenna that moves automatically to stay in contact with the satellite. It's 80 by 72 cm (31.5 by 28.3 inches), and plans are to shrink that to something 2/3rds the height when a new dish is certified. Ultimately, IDG News Service reports, the group plans to use 3 cm (1 in) high phased-array antennas that would cover the train's roof. Very, very clever, as it jettisons any moving parts.</p>

<p>Three companies worked on the technology: Telenet, handling the billing and authentication, is a Belgian ISP that also runs hotspots; Nokia Siemens is a well-known systems integrator, and is providing some gear and handling installation and integration; 21Net, perhaps the least-well known partner, has the satellite technology. </p>

<p>This project dates back to at least 25-April-2005, a point at which 21Net and Nokia Siemens announced a successful test on the Thalys run from Brussels to Paris. </p>]]></content:encoded>
      <pubDate>Wed, 14 May 2008 11:50:22 +0000</pubDate>
      <category domain="http://securityratty.com/tag/train">train</category>
      <category domain="http://securityratty.com/tag/service hit glitches">service hit glitches</category>
      <category domain="http://securityratty.com/tag/glitches">glitches</category>
      <category domain="http://securityratty.com/tag/service">service</category>
      <category domain="http://securityratty.com/tag/service pulls">service pulls</category>
      <category domain="http://securityratty.com/tag/train operator">train operator</category>
      <category domain="http://securityratty.com/tag/satellite">satellite</category>
      <category domain="http://securityratty.com/tag/satellite technology">satellite technology</category>
      <category domain="http://securityratty.com/tag/nokia siemens">nokia siemens</category>
      <source url="http://wifinetnews.com/archives/008320.html">Thalys Hits Glitch in Impressive Train Launch</source>
    </item>
  </channel>
</rss>
