1. SGNIC’s Measures Against Domain Name Abuses 26 August 2011 Lim Choon Sai General Manager (SGNIC)

2. Scope Types of Abuse Measures Identity Verification Detection and Tracking Enforcement Conclusion

3. Usage Abuse Registration Abuse Types of Abuse Objectionable Domain Names Registration in Wrong Category Sale of Domain Names Incomplete or Incorrect registration details Identity Theft or Fake Identity Cybersquatting Pornographic Socially or politically sensitive Fake Drugs Copyright violations Scam Spam Malware Phishing Abuses that SGNIC is concerned about:

4. Usage Abuse Registration Abuse Types of Abuse Objectionable Domain Names Registration in Wrong Category Sale of Domain Names Incomplete or Incorrect registration details Identity Theft or Fake Identity Cybersquatting Pornographic Fake Drugs Copyright violations Scam Spam Malware Phishing In some areas, SGNIC feels more effectively measures are required: Socially or politically sensitive

5. Measures Effective Enforcement Effective Detection and Tracking Effective Identity Verification Registration in Wrong Category Incomplete or Incorrect registration details Identity Theft or Fake Identity Malware Phishing

6.  “VerifiedID@SG” scheme  Leverages on National online personal ID authentication (SingPass)  All Singapore Citizens, Permanent Residents and Foreign workers have SingPass ID and password issued by Government.  Must use SingPass ID to access government online services.  Domain Name registrations will be linked to the SingPass authentication system. Registrations require the SingPass ID holder to vouch that the submitted details are complete, accurate and truthful Identity Verification Effective Identity Verification

7.  Providing inaccurate or incomplete registration information is often a precursor to other domain name abuses  Domain Name Abuse Management System (AMS) provides early warnings by checking the accuracy and completeness of new registrant information – E.g. Checks for address completeness, postal code accuracy Detection and Tracking Effective Detection and Tracking

8. Detection and Tracking abc.sg [OWNER] : ABC Pte Ltd [Com No.:200709805A] [ADDRESS]: 79,ROBINSON RD, ABC BUILDING #03-00 Singapore 111111 [PHONE] : +65.22223333 [EMAIL] : buy@abccompany.sgbuy@abccompany.sg ACRA Database (registry of companies) “Company Name” must match with “Company number” must be valid 1 Postal code Database “Postal code” must be valid “Address” must be ‘similar’ with 2 Singapore phone number must start with ‘2’,’3’,’8’ or ‘9’. Highlight if it looks fake: +65.2221234 +65.98765432 3 Does email contain ‘suspicious’ words? (e.g. ‘buy’, ‘sale’) 4

9. Examines registration trends. Highlights suspicious bulk registrations from same registrant, email, telephone number. e.g. – > 10 domains (all different registrant name) using same email in 1 day – > 50 domains (all different registrant name) using same email in 30 days Detection and Tracking Bulk Registration TagDescription BR4-166 registrations in 30 days using the email ben.xxx@hotmail.com. BR4-254 registrations in 30 days using the phone no. +65.9872XXXX Example of cases detected:

10. Automated scanning of domain name against third party security databases for malware distribution/phishing activities. Detection and Tracking A BC D example.sg Clean Risky Clean

11. AMS continually monitors all domain names  All new names are scanned weekly for 3 months, thereafter monthly scans Detection and Tracking Effective Detection and Trackin Domain names scanned by AMS Flagged as possibly abusive Confirmed Malicious 130,000722131 Initial Run results (in end July) :

12. Actively enforce against all types of abuses. For malware and phishing: Time is of essence: Critical to send quick and timely advices to each party who may be involved (ISP, website hosting provider, registrant, admin and tech contact) for them to take action Formalised collaboration with SingCERT who can provide expert opinion For confirmed cases, will work with SingCERT for further investigation Last straw for serious breaches: suspend or delete - drawing powers from registrant agreement Enforcement Effective Enforce- ment

13. SGNIC’s experience:  Adopt a more proactive approach in dealing with domain name abuses  For the benefit of the community and upholding the ccTLD/country’s reputation  To assusage concern of the authority  DNS abuse management is a long term commitment and concerted effort by relevant stakeholders  New applications over DNS giving rise to new opportunity for exploitation  No single agency has control over all aspects of DNS abuses Conclusion

14. Thank you