Feeds

Cybercrook? Bent on mischief? WE'LL GET YOU, vow Facebook and pals

Secure Domain Foundation will pull rug from under web miscreants

Internet Security Threat Report 2014

Internet heavyweights have teamed up to form a non-profit organisation designed to supply internet infrastructure operators with free tools and intelligence in the fight against cybercrime.

Facebook, security intelligence firm Crowdstrike, Verisign, ESET Anti-Virus, Verizon and the Anti-Phishing Working Group, among others, are putting their support behind the Secure Domain Foundation) (SDF).

Cybercrooks have long used domain names to control botnets, distribute malware, and compromise unsuspecting visitors. The SDF’s free API product will give "credit ratings" for customers based on security reputation and contact data validation.

Domain name transactions such as new account creation, domain registration, and record updates can be queried against this trustworthiness database to flag up potential problems.

The database of malicious domains and bad actors has been in development for two years. Domain registrars are being invited to incorporate this contact data validation services into their domain registration processes.

SDF was founded by security researcher Chris Davis, who was involved in the successful Mariposa botnet takedown operation four years ago and Norm Ritchie, a domain industry expert and one of seven keyholders of the secure root zone.

“ICANN has recently mandated that domain registrars must validate postal addresses, phone numbers, and email addresses that are provided as contact information during the domain registration process,” said Norm Ritchie, chairman of the SDF.

“Many new gTLD registries have pledged to take a more proactive role in combating domain abuse within their TLDs. The SDF provides an entirely free service that not only validates the contact registration data provided but also lets the registrar and registry know if we have seen that data used previously in relation to cyber crime.”

The SDF plans to provide free-of-charge tools, technology, research, and security intelligence to Internet domain name registrars, registries, ccTLD operators, and gTLD operators. The organisation hopes to expand its services to hosting providers, DNS operators, CERTS, law enforcement and other Internet infrastructure operators over coming months.

SDF will act as a “brains trust” analysing thousands of malware samples daily before teaming up with domain registrars and other to shut down the criminals’ command and control infrastructures.

“Beyond our current offering of tools and services, we are also dedicated to raising the cost and risk of cyber crime,” said Chris Davis, president of the SDF.

“With our partners, we analyse hundreds of thousands of malware samples daily and actively engage with registries, registrars and hosting providers to shut down the criminal command and control infrastructure. Our staff and volunteer researchers and analysts work tirelessly to provide criminal attribution intelligence to the proper global law enforcement organisations and help to bring these criminals to justice.”

Chris Davis, co-founder of SDF and director of intel partnerships at CrowdStrike, acknowledged that abuse will continue despite SDF's efforts because cybercriminals often use bulletproof hosting from unscrupulous providers or hacked systems. What SDF can do is make life more difficult for bot-herders and other crooks.

"Right now there is essentially no 'barrier to entry' for a bad guy to set up something like a botnet command and control infrastructure," Davis explained. "Our hope is, if we can start in the domain space and make life harder, we can expand this model towards hosting providers and other infrastructure type orgs.

"One of our goals is to publicly name and shame or spotlight malicious and/or apathetic providers. We have on our roadmap – a plan to provide DNS RPZ feeds to allow users to easily block those providers," he added. ®

Internet Security Threat Report 2014

More from The Register

next story
George Clooney, WikiLeaks' lawyer wife hand out burner phones to wedding guests
Day 4: 'News'-papers STILL rammed with Clooney nuptials
Shellshock: 'Larger scale attack' on its way, warn securo-bods
Not just web servers under threat - though TENS of THOUSANDS have been hit
Apple's new iPhone 6 vulnerable to last year's TouchID fingerprint hack
But unsophisticated thieves need not attempt this trick
PEAK IPV4? Global IPv6 traffic is growing, DDoS dying, says Akamai
First time the cache network has seen drop in use of 32-bit-wide IP addresses
Oracle SHELLSHOCKER - data titan lists unpatchables
Database kingpin lists 32 products that can't be patched (yet) as GNU fixes second vuln
Researchers tell black hats: 'YOU'RE SOOO PREDICTABLE'
Want to register that domain? We're way ahead of you.
Stunned by Shellshock Bash bug? Patch all you can – or be punished
UK data watchdog rolls up its sleeves, polishes truncheon
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.