(An Anti-Abuse Perspective) DNS Fundamentals (An Anti-Abuse Perspective) Carlos Álvarez, IS-SSR Team | Steve Conte , Office of the CTO 18 May 2016

Domain Name System 1 Resolution Process 2 Registration Process 3 Internet Identifiers Structure and Resolution Resolution Process Parties Involved Registration Whois 2 Registration Process 3 Why all this matters: Anti-Abuse

DNS: Internet Identifiers MAC, IP, Domains

SLD – Second Level Domain DNS: Structure and Resolution string.tld. “.” edu org club biz ar any isoc icann gacweb whois root – “.” TLD – “.org.” 2nd Level – “icann.org.” 3rd Level – “gacweb.icann.org.” Top Level Domain SLD – Second Level Domain 4

DNS: Structure and Resolution string.tld. m.root-servers.net a0.org.afilias-nst.info ns1.icann.org dns.icann.org www.icann.org? 1 2 3 4 5 6 7 8 5

DNS: Registration Process Who does what? 6

DNS: Registration Process <command> <create> SRS (market competition) / EPP Availability check / response Provision of account information and WHOIS Registrar receives, adds to own DB, forwards to Registry Registry adds entry in its zone 7

DNS: WHOIS Registration Info Postal address, email, phone, fax Timestamps, statuses, name servers Accuracy Validation, i.e. emails in RFC5322, phone numbers in ITU-T E.164, postal addresses in UPU or S42 format template Verification: Registrant or Account Holder email or telephone requiring affirmative response Contacts: Registrant, Admin Contact, Tech Contact, Billing Contact 8

DNS: Why all this matters Anti-Abuse 9

DNS: Why all this matters Anti-Abuse Some hot topics regarding abuse of registration services: Resellers: Identified by Registrar? Responsive? Privacy/Proxy services: Relay/Reveal Compliance with RAA abuse provisions: Review and Respond Suspension/cancellation of malicious domains? DNS Sinkholing? Not enough data or false positive? Domain Generation Algorithms: Automated! Threats: Botnet command and control Malware distribution Phishing/pharming 10

DNS: Why all this matters Anti-Abuse Some hot topics regarding abuse of resolution services: m.root-servers.net a0.org.afilias-nst.info ns1.icann.org dns.icann.org 1 2 3 4 5 6 7 8 DNS Hijacking / Cache Poisoning 11

x DNS: Why all this matters Anti-Abuse Some hot topics regarding abuse of resolution services: http://string.tld x DNS Servers (ISPs, own) Victim Reflection+Amplification=DDoS 12

ICANN One World. One Internet

Engage with ICANN Questions? carlos.alvarez@icann.org / steve.conte@icann.org @isitreallysafe twitter.com/icann gplus.to/icann facebook.com/icannorg weibo.com/ICANNorg linkedin.com/company/icann flickr.com/photos/icann youtube.com/user/icannnews slideshare.net/icannpresentations