Thursday, 23 December 2010

Domain Arbitration in 2010

Based in Geneva, Switzerland, WIPO was established in 1994 to offer Alternative Dispute Resolution options for the resolution of international commercial disputes between private parties, especially cross-border dispute settlement. The subject matter includes both contractual disputes (patent and software licenses, trademark coexistence agreements, distribution agreements for pharmaceutical products and research and development agreements) and non-contractual disputes (patent infringement). WIPO established an legal framework for the administration of disputes relating to the Internet and e-commerce.

WIPO is recognized as the leading dispute resolution service provider for disputes arising out of the abusive registration and use of Internet domain names both ccTLDs and gTLDs.

Year 2010 was the record braking at WIPO Arbitration and Mediation Center with almost 2,700 domain disputes involving 4,285 domain names:
The total number of disputes at WIPO reached 19,409 involving 35,232 domain names from all around the world. In 2010 only 12% of all disputes were ccTLD related.

France leads ranking of top 10 "most popular" ccTLDs at WIPO, followed by Netherlands, Spain, Switzerland...
Number of disputed domain names since 2000.

In 2010, Colombia, a "new" ccTLD, has joined France, Netherlands, Spain and Switzerland becoming Number "4". Colombia opened-up their extension (.CO) in 2010, and many disputes resulted just from TM infringements in the first days after the "big bang".
Number of disputed domain names in 2010
Among gTLDs (generic Top Level Domains), .COM leads the way, followed by .NET .ORG and .INFO

Number of cases almost matches number of domain names registered, also led by .COM followed by NET, ORG, INFO:

Thursday, 9 December 2010

Operation Payback

updated on UltraDNS Anycast solution on Dec 9, 0815 EST 
updated on Visa, MC on Dec 10, 0600 EST 
Here is the follow up of the story of Amazon, VISA, MasterCard, PayPal, SwissPost and many more companies involved in "cablegate". More than week ago those companies took WikiLeaks.org web page and WikiLeaks donations off-line (more: [1] [2] [3]).Today WikiLeaks' supporters are taking them down.

Due to the DDoS (Distributed Denial of Service) attack called "Operation Payback" both VISA and MasterCard's web pages were off-line on Thursday. People behind so called Operation Payback campaign are targeting all corporations that have withdrawn services from Wikileaks.

What is DDoS?
DoS (Denial of Service) attack is an attempt (successful in case of VISA and MasterCard) to make a computer resources unavailable to its users. In case of a DDoS (Distributed Denial of Service) attack, large numbers of computers distributed across the networks attack a single target. Computers used for the attack are either compromised systems (botnets) or legitimate hosts managed by people who decide to use their machines to flood the victim. In the Operation Payback most of the "attackers" were legitimate hosts deliberately used by their owners to send large number of queries to the Visa and MC servers.  (D)DoS attack can force different services of the victim including Web site (WWW), e-mail or transaction systems to cease operation. In some cases denial of service attack can also destroy files in the affected computer systems.

DDoS attacks are tools used by "hacktivists" as form of protest or revenge (WikiLeaks case). Today DDoS are generally used for cyber criminals to profit from:
  • ransom payed by victim to stop the attack and avoid further financial losses,
  • companies who want to knock out competitors from the market (sabotage, brand damage)
Current situation
As of December 9th, 2010, 0740 EST, VISA.com has not been reachable, but at least their Name Servers were reachable. In the contrary neither MASTERCARD.COM's web page nor their Name Servers have been reachable. Due to the fact that Name Servers of MasterCard haven't been reachable, it's likely that not only web page but also e-mail service were disrupted.

UPDATE: After 8+ hours of inaccessibility, web pages of VISA and MasterCard were back on-line.


And the winner is...
Attack on VISA and MasterCard shows, that "Operation Payback has actually one big winner - NeuStar's UltraDNS service. VISA made a good decision choosing UltraDNS as DNS provider. UltraDNS is using so called "UltraDNS Managed DNS Service" with the ability to advertise the same public IP addresses out of multiple machines and networks. By using IP Anycast, UltraDNS is bringing the answers for a DNS query closer to the end user, and it becomes far more likely that the query will reach its destination and be responded to quickly. IP Anycast makes DDoS attacks much more difficult, requiring more botnets or attacking computers to be involved in the attack. As UltraDNS says IP Anycast and BGP protect our network from security threats and Distributed Denial of Service attacks. Because queries are routed based upon where they enter the UltraDNS network, DDoS attacks will be "distributed" amongst our servers, thus "diluting" the strength of any DDoS attack.


VISA.COM - ping on Dec 9, 0815 EST
Ping 72.52.5.101
[visa.com]
Timed out
Destination network unreachable
Timed out
Timed out
Destination network unreachable
Destination network unreachable
Timed out
Timed out
Destination network unreachable
Timed out

Average time over 10 pings: 0 ms



VISA.COM - Name Servers query on Dec 9, 0815 EST
Retrieving DNS records for visa.com...
DNS servers
pdns3.ultradns.org
pdns2.ultradns.net
pdns1.ultradns.net
pdns6.ultradns.co.uk
pdns5.ultradns.info
pdns4.ultradns.org


Answer records
visa.com
TXT
3600s
visa.com
TXTv=spf1 ip4:198.80.42.3 ip4:198.241.159.4 ip4:69.20.125.232 ip4:198.241.175.106 ip4:216.251.253.98 ip4:67.208.216.61 ~all3600s
visa.com
SOA
server:pdns1.ultradns.net
email:hostmaster@visa.com
serial:2010120909
refresh:10800
retry:3600
expire:604800
minimum ttl:300
300s
visa.com
A72.52.5.101300s
visa.com
MX
preference:10
exchange:portal5.visa.com
3600s
visa.com
MX
preference:10
exchange:portal2.visa.com
3600s
visa.com
MX
preference:10
exchange:portal1.visa.com
3600s
visa.com
NSpdns6.ultradns.co.uk86400s
visa.com
NSpdns5.ultradns.info86400s
visa.com
NSpdns4.ultradns.org86400s
visa.com
NSpdns3.ultradns.org86400s
visa.com
NSpdns2.ultradns.net86400s
visa.com
NSpdns1.ultradns.net86400s

Authority records

Additional records
portal5.visa.com
A198.241.174.1383600s
portal2.visa.com
A198.241.159.33600s



MASTERCARD.COM ping on Dec 9, 0815 EST
IP address:
Error: Try again

Host name: mastercard.com
Alias:
mastercard.com
is from () in region



TraceRoute to [mastercard.com]
Hop(ms)(ms)(ms)
IP AddressHost name
Trace complete

Retrieving DNS records for mastercard.com...
DNS servers
dns2.mastercard.com [209.64.210.34]
dns1.mastercard.com [216.119.210.196]

DNS server returned an error: Name server failed

Monday, 6 December 2010

Swiss bank closes Assagne account

PostFinance Logo (link)
Few days ago in my BLOG I said "The last but not least is the choice of a bank. For such organization as WikiLeaks banks registered in US or with US investors are not an option... WikiLeaks decided to use Commerzbank and Swiss Post (PostFinance), especially the last one to guarantee rather uninterrupted service."

I was definitely wrong.  Today PostFinance said in statement "PostFinance has ended its business relationship with Julian Paul Assange". In the explanation, PostFinance says that Assagne "provided false information regarding his place of residence during the account opening process".

PostFinance is another financial institution after PayPal getting rid of WikiLeaks and WikiLeaks founder... Interesting story but no more blogs about WikiLeaks problems. It becomes boring...

WikiLekas upgrades its DNS

After long struggle with DNS providers and hosters (read HERE and HERE), WikiLeaks finally upgraded their DNS by using several Name Servers provided by different companies and distributed along many networks. Good news for WikiLeaks and its supporters and bad news for USG and the secret diplomatic files.

Here you can see dig query on "wikileaks.ch".
  
; <<>> DiG 9.2.3 <<>> @dns1.menandmice.com wikileaks.ch ANY
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 1455
;; flags: qr rd ra; QUERY: 1, ANSWER: 17, AUTHORITY: 15, ADDITIONAL: 19

;; QUESTION SECTION:
;wikileaks.ch. IN ANY

;; ANSWER SECTION:
wikileaks.ch. 1777 IN A 46.59.1.2
wikileaks.ch. 1777 IN A 213.251.145.96
wikileaks.ch. 1212 IN NS ns3.pcdog.ch.
wikileaks.ch. 1212 IN NS ns4.pcdog.ch.
wikileaks.ch. 1212 IN NS dns1.syshack.org.
wikileaks.ch. 1212 IN NS dns2.easydns.net.
wikileaks.ch. 1212 IN NS dns2.syshack.org.
wikileaks.ch. 1212 IN NS arjeplog.scnr.ch.
wikileaks.ch. 1212 IN NS marmotta.brabbel.ch.
wikileaks.ch. 1212 IN NS v217241437.yourvserver.net.
wikileaks.ch. 1212 IN NS s2.s3cr3t.de.
wikileaks.ch. 1212 IN NS dns.wikileaks.ch.
wikileaks.ch. 1212 IN NS lou.porcus.ch.
wikileaks.ch. 1212 IN NS ns1.pcdog.ch.
wikileaks.ch. 1212 IN NS ns1.buzzernet.net.
wikileaks.ch. 1212 IN NS ns2.pcdog.ch.
wikileaks.ch. 1212 IN NS ns2.easydns.com.

;; AUTHORITY SECTION:
wikileaks.ch. 1212 IN NS ns2.easydns.com.
wikileaks.ch. 1212 IN NS ns3.pcdog.ch.
wikileaks.ch. 1212 IN NS ns4.pcdog.ch.
wikileaks.ch. 1212 IN NS dns1.syshack.org.
wikileaks.ch. 1212 IN NS dns2.easydns.net.
wikileaks.ch. 1212 IN NS dns2.syshack.org.
wikileaks.ch. 1212 IN NS arjeplog.scnr.ch.
wikileaks.ch. 1212 IN NS marmotta.brabbel.ch.
wikileaks.ch. 1212 IN NS v217241437.yourvserver.net.
wikileaks.ch. 1212 IN NS s2.s3cr3t.de.
wikileaks.ch. 1212 IN NS dns.wikileaks.ch.
wikileaks.ch. 1212 IN NS lou.porcus.ch.
wikileaks.ch. 1212 IN NS ns1.pcdog.ch.
wikileaks.ch. 1212 IN NS ns1.buzzernet.net.
wikileaks.ch. 1212 IN NS ns2.pcdog.ch.

;; ADDITIONAL SECTION:
s2.s3cr3t.de. 77276 IN A 216.245.206.111
dns.wikileaks.ch. 1212 IN A 178.63.167.108
dns.wikileaks.ch. 1212 IN A 188.40.194.13
dns.wikileaks.ch. 1212 IN A 193.28.181.57
dns.wikileaks.ch. 1212 IN A 193.138.215.125
dns.wikileaks.ch. 1212 IN A 216.18.205.196
dns.wikileaks.ch. 1212 IN A 216.245.206.111
dns.wikileaks.ch. 1212 IN A 217.147.219.146
dns.wikileaks.ch. 1212 IN A 46.4.160.2
dns.wikileaks.ch. 1212 IN A 72.52.2.1
dns.wikileaks.ch. 1212 IN A 80.246.50.106
dns.wikileaks.ch. 1212 IN A 85.124.44.140
dns.wikileaks.ch. 1212 IN A 85.124.251.171
dns.wikileaks.ch. 1212 IN A 91.121.168.144
ns1.buzzernet.net. 1668 IN A 193.138.215.125
dns1.syshack.org. 34076 IN A 46.4.160.2
dns2.easydns.net. 37 IN A 72.52.2.1
dns2.syshack.org. 412 IN A 91.121.168.144
v217241437.yourvserver.net. 9012 IN A 188.40.194.13

;; Query time: 192 msec
;; SERVER: 217.151.171.7#53(dns1.menandmice.com)
;; WHEN: Mon Dec 6 08:29:22 2010
;; MSG SIZE rcvd: 955


To the contrary to .CH domain, wikileaks.org is not responding.

Friday, 3 December 2010

How to avoid government's "censorship"?

updated on France on December 4th, 0400 PST 
updated on PayPal on December 5th, 0300 PST
updated on VISA and MasterCard on December 7th, 1300 PST 
On-line presence (hosting+domain name)
After Amazon decided not to host the WikiLeaks content on Dec. 3rd, WikiLeaks had to move again. Additionally US-based DNS provider (EveryDNS.net) stopped providing DNS services to WikiLeaks at 2200 U.S. Eastern time (EST) on Thursday causing complete inaccessibility of the WikiLeaks.org web page.

update: More actions has been taken in France "French Minister Besson sent out a letter asking CGIET (Le Conseil général de l'industrie, de l'énergie et des technologies) for action. French ISP - OVH - replied he asked his lawyer for immediate query to Justice to state the case, claiming neither the Minister, nor the ISP cannot decide what is legal. The French press summarised it as OVH 1 – Besson 0" says Elisabeth Porteneuve, French ICT Market Expert

Julian Assange's decision of hosting WikiLeaks, using US-based DNS servers, US-based hosting as well as US-based Registry (.ORG domain) and Registrar (DynaDot) were not wise from stability and security point of view. What is even more strange, Assange is also using PayPal, US-based financial transaction proxy...

Some people asked me to explain what are the "elements" of the Internet presence, who are the "Actors" and how should WikiLeaks (or a similar service) avoid such problems in the future... Let's start from the beginning. It's a little bit complicated - it's not only about hosting (content) but also DNS (translating domain names into IP addresses), domain name Registries and domain name Registrars. Recent developments with Combating Online Infringement and Counterfeits Act, 82 domain seizures, Amazon.com refusal and EveryDNS case show that USG and politicians will do everything to remove illegal web pages with dangerous content from the web.

So here is the list of the key players you have to deal with and their connection with US-government:
Double Click for better quality.
Financial transaction providers
Regardless of the technical nature of DNS and Hosting, it's important for such an organization as WikiLeaks to be able to receive funds. PayPal is one of the most popular ways for fund-rising, not only for WikiLeaks. On December 4th, 2010 PayPal being US-registered company, decided to suspend of WikiLeaks' PayPal account.

PayPal has posted a statement to its website, saying: PayPal has permanently restricted the account used by WikiLeaks due to a violation of the PayPal Acceptable Use Policy, which states that our payment service cannot be used for any activities that encourage, promote, facilitate or instruct others to engage in illegal activity. We have notified the account holder of this action.

The same story could be with other transaction providers like VISA or Diners Club, that's why old good wire transfers are the only solution for WikiLeaks and similar organizations.
update: On December 7th, 2010, VISA and MasterCard suspended transactions to WikiLeaks. The argument provided by VISA is very unusual and very unprofessional: "its investigation would determine the nature of Wikileaks' business, and "whether it contravenes Visa operating rules". WHETHER??? They don't know but suspend? As we can see, the suspension is "just in case" due to the fact that as of today, VISA do not know if it contravenes or not.

Banks
The last but not least is the choice of a bank. For such organization as WikiLeaks banks registered in US or with US investors are not an option... WikiLeaks decided to use Commerzbank and Swiss Post, especially the last one to guarantee rather uninterrupted service.
update: PostFinance said in statement "PostFinance has ended its business relationship with Julian Paul Assange".

November closed down for .US domain count

My blog posted on November 6th was entitled .US Domain Is Back On Track... Unfortunately November closed down for .US domain count. With 1,610,492 at the end of October, .US zone file contained in November only 1,607,455 domains, 3,037 below October count.

October has become relatively a good month for .US domain operated by NeuStar. American ccTLD ended October with 17,283 domains above September's results.

Looking at the graph, we can see fluctuations of .US zone month to month. US ccTLD is neither growing nor declining. It's surprising, because almost all big TLDs, are steady growing. November closed up for most big TLDs except .MOBI and .TEL.

The question is what NeuStar is going to do to promote .US. For NeuStar, the big telecommunication company, dotUS domain business is just a fraction of their revenue. What's more important, domain business for NeuStar is rather PR activity than focus on the results (number of registered domain names). Anyway it would be great to see .US growing at least with the average speed of the gTLD and ccTLD domain names market.

NeuStar, heads up and make it grow :)

Thursday, 2 December 2010

US companies get rid of WikiLeaks

Today Amazon announced that is no longer hosting WikiLeaks.org. Wikileaks has been pulled after political pressure from US politicians, especially Joe Lieberman, chairman of the Senate's committee on homeland security.

To be honest I'm not surprised. I was surprised when WikiLeaks.org decided to use Amazon Elastic Compute Cloud (Amazon EC2) for hosting WikiLeaks documents and other content. Upcoming Combating Online Infringement and Counterfeits Act as well recent seizures of the domain names by DHS prove, FEDs and US politicians will do everything to force US based companies to stop hosting illegal content (of course the question is if the content is illegal; in the USA, diplomatic cables are illegal; in the contrary, in all other countries, US cables are not "SECRET" and not subject to the local law).

As Liberman said, Amazon's decision "should set the standard for other companies WikiLeaks is using to distribute its illegally seized material. I call on any other company or organisation that is hosting WikiLeaks to immediately terminate its relationship with them."

The question is why Julian Assange decided to use Amazon.com. In my opinion the contract with Amazon (big, US based company) was signed with the expectation to be soon... terminated by Amazon (as it finally happened). For everybody it was clear that Amazon just can't host it, so why has he done it? Today, Julian Assange can show to the media that US is chasing and mistreating him with unfair methods to get him out of business.

Has it been done just for PR? I bet "yes". We have even more examples. Assange decided to publish just a fraction of the documents and is "leaking" next cables one by one. Why? It's a standard PR activity to keep someone on the front pages for a long period of time.

Regardless of you think about WikiLeaks, next time you read about WikiLeaks think about Marketing and PR side of it...