ICANN ponders ways to stop scammy Web sites

The overseer of the Internet's addressing system is soliciting ideas for how to fix a problem that is enabling spam and fraudulent Web sites to flourish.

The overseer of the Internet's addressing system is soliciting ideas for how to fix a problem that is enabling spammers and fraudulent Web sites to flourish.

The Internet Corporation for Assigned Names and Numbers (ICANN) has issued an initial report on fast flux, a technique that allows a Web site's domain name to resolve to multiple IP (Internet protocol) addresses.

Fast flux allows an administrator to quickly point a domain name to a new IP address, for example if the server at the first address fails or comes under a denial-of-service attack. It is legitimately used by content distribution networks such as Akamai to balance loads, improving performance and lowering data transmission costs.

But the technique has also been embraced by hackers and cybercriminals, who use it to make it harder for ISPs (Internet service providers) and law enforcement officials to close down phishing Web sites and other sites illegally hawking goods such as pharmaceuticals.

"Those engaged in these activities can frustrate the efforts of investigators to locate and shut down their operations by using fast-flux service networks to rapidly and continuously change the topology of the network on which their content is hosted," according to the report.

The main aim of cybercriminals is to keep their fraudulent Web sites up and running longer. Fast flux "is not an attack itself -- it is a way for an attacker to avoid detection and frustrate the response to the attack," the report said.

That's done in part by modifying how long name servers around the Internet cache the IP address corresponding to the domain name. When a person visits a Web site, a local name server caches the IP address of the domain name. How long the local name server refers to its cached record for a Web site is controlled by the "time-to-live" setting in the official DNS (Domain Name System) record for a site, set by Web site's operator.

While "time-to-live" is typically set to hours or even days, a Web site's IP address can be change as often as every few minutes, redirecting to countless servers belonging to different ISPs, all of which would have to be taken down. In combination with the use of proxy servers and redirect commands, antiphishing efforts can turn into endless game of chase.

Consumers can be defrauded, as cybercriminals try to hack into Web hosting accounts in order to set up new nodes on their fast-flux networks, the report said.

The security community is faced with the challenge of trying to mitigate criminal use of fast flux but also not inadvertently restricting its legitimate uses.

One solution is quicker identification and shut down of domain names identified with abusive activity. Domain names could be revoked by a registrar, which in most cases would stop the site from working. Another solution would be to limit the ability of a registrant to repeatedly change name servers or eliminate automated name-server hopping, the report said.

The 121-page report, written by ICANN's Generic Names Supporting Organization (GNSO) lays out a series of other methods that could be used to mitigate the problem. GNSO will accept comments for 20 days and then do a final redraft of the report.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags ICANN

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jeremy Kirk

IDG News Service
Show Comments

Father’s Day Gift Guide

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Luke Hill

MSI GT75 TITAN

I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Laura Johnston

MSI GS65 Stealth Thin

If you can afford the price tag, it is well worth the money. It out performs any other laptop I have tried for gaming, and the transportable design and incredible display also make it ideal for work.

Andrew Teoh

Brother MFC-L9570CDW Multifunction Printer

Touch screen visibility and operation was great and easy to navigate. Each menu and sub-menu was in an understandable order and category

Louise Coady

Brother MFC-L9570CDW Multifunction Printer

The printer was convenient, produced clear and vibrant images and was very easy to use

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Featured Content

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?