DNS Abuse

DNS Abuse is any malicious activity aimed at disrupting the DNS infrastructure or causing the DNS to operate in an unintended manner. Abusive activities include corrupting DNS zone data, gaining administrative control of a name server, and flooding the DNS with thousands of messages to degrade name-resolution services.

Overview

According to the Internet and Juridiction Policy Network, there are five broad categories of DNS abuse:

• malware,
• Botnet Attacks,
• phishing,
• pharming, and
• spam (when it is used to deliver other forms of DNS Abuse), accounting for over 85% of DAAR-reported DNS abuse in February 2021.

History

In 2009-2010, the Registration Abuse Prevention Working Group (RAPWG) generated a report that distinguished between “Registration Abuse” (technical abuse) and “Use Abuse” (content abuse). Technical abuse was defined as attempts to harm the DNS infrastructure and/or using the DNS to cause harm. Content abuse was defined as harms carried out through the use of a domain name, such as through the content on a website. This category of harm includes trademark and copyright infringement, defamation, piracy, child sexual abuse, and hate speech. The RAPWG concluded that technical abuse was within ICANN’s jurisdiction but content abuse was not. However, the working group recommended the development of the Uniform Dispute Resolution Policy (UDRP) because it involved the registration and use of domain names in bad faith.

In 2013, conversations between the Governmental Advisory Committee and the ICANN Board led to an amendment to Registry Agreements in 2013 to include Specification 11. Registry operators must now periodically conduct a technical analysis to assess whether domains within their TLD are used to carry out security threats, such as pharming, phishing, malware, and botnets. They must also include terms in their RRAS such that registrants are prohibited from perpetuating technical and content abuse.

In 2016, when the ICANN Bylaws were re-written as part of the IANA Transition, a provision was added to state that ICANN is not responsible for content.

In 2019, a group of domain name registries and registrars developed and released a document called the "Framework to Address Abuse," with 11 signatories. By 2021, 48 signatory registrars and registries had voluntarily bound themselves by the principles laid out in the framework.

Open Questions

Defining and Measuring the Problem

Is there a hard and fast difference between technical abuse and content abuse?

• The BC and GAC want more enforcement from ICANN in terms of gray areas, for instance, when technical and content abuse overlap
• The ICANN Board does not want to deliberate over content issues

How should DNS abuse be measured?

1. Domain Abuse Activity Reporting (DAAR) - ICANN releases a monthly report on malicious activity
2. SURBL
3. Spamhaus
4. PhishTank
5. .ORG Anti-Abuse Metrics

Responsibility

Remit: Whose job is it to stop the abuse?

• Registries do not host content and therefore cannot remove a piece of content from a website. The only way to remove content from the Internet is to delete it from the computer that hosts it via the hosting provider, or permanently remove that device from the Internet.

Interoperability: Can the various stakeholders work together to combat attacks?

Mitigation

What tools are available to mitigate or respond to attacks?

Technically, there are limits on what each type of stakeholder can do to stop abuse.

• The DNS Abuse Framework was developed by registries and registrars. The framework discourages a registry or registrar from taking action against domains, except in certain types of Website Content Abuse:

1. child sexual abuse materials,
2. illegal distribution of opioids online,
3. human trafficking, or
4. specific, credible incitements to violence

• ICANN's

• OTCO monitors gTLD zone files,
• SSAC advises on the stability and security of the DNS, and
• Contractual Compliance is not beholden to the DNS Abuse Framework; instead, the office can reprimand registrars or registries that do not maintain abuse contacts (or a webform) to receive abuse complaints or promptly investigate allegations of DNS Abuse in good faith.

• TTL on DAAR-listed domains
• Site Operators, Registrants, and Hosting Providers can remove content.
• Registrars and registry operators can

1. include their own acceptable use policies or terms of use to set forth provisions to cover Website Content Abuses,
2. contract Trusted Notifiers to monitor content and report abuse

• Registry Operators

1. Have to determine whether the domain in question was maliciously registered or if the domain has been compromised. Registries cannot generally directly remediate a compromised domain; instead, it is up to the sponsoring registrar. Conversely, if a domain has been maliciously registered, the registry has six options:
2. Suspend the domain (most common)
3. Refer to the sponsoring registrar
4. Lock the domain
5. Redirect a domain by changing the name servers
6. Transfer the domain
7. Delete the domain (generally considered an ineffective and extreme response)

If a registry encounters unregistered domain names resulting from an automatic Domain Generation Algorithm (DGA), the operator can:

1. Reserve the domains or
2. create the domains in order to suspend or sinkhole the domains for victim identification

Intersecting Issues

Jurisdictional confusion

Law enforcement wants more cooperation from industry leaders

Data privacy and limits imposed by the General Data Protection Regulation

Progress

Is it getting better or worse?

Getting worse: In March 2021, the FBI’s Internet Crime Complaint Center (IC3) released its 2020 Internet Crime Report. There were 791,790 complaints of suspected internet crime, which indicated an increase of more than 300,000 from 2019, involving losses in excess of US$4.2 billion. Phishing, non-payment/non-delivery scams, and extortion were the top three types of crime reported. Getting better:

Are new or Legacy gTLDs experiencing more problems? The February 2021 DAAR report indicates the majority (64.8%) of security issues are occurring in legacy TLDs, which comprise 88.8% of resolving gTLD domains in zone files.

Domain Abuse Activity Reporting