Tag Archives: Security

ICANN Appoints Hacker As Chief Security Officer

ICANN has appointed a hacker as its Chief Security Officer the organisation announced Thursday. However the appointment of Jeff Moss is not a case of bad boy turned good. Moss was the founder of DEF CON, the world’s largest hacker conference, and Black Hat, a global technical security conference.For more information, see the ICANN news release below:Jeff Moss Appointed ICANN Chief Security Officer
Respected Hacker to Lead Risk Management Efforts
Jeff Moss, founder of DEF CON, the world’s largest hacker conference, and Black Hat, a global technical security conference, has been named Vice President and Chief Security Officer of the Internet Corporation for Assigned Names and Numbers (ICANN), the multinational non-profit organization working for a secure, stable and unified global Internet.”I can think of no one with a greater understanding of the security threats facing Internet users and how best to defend against them than Jeff Moss,” said Rod Beckstrom, ICANN’s President and Chief Executive Officer. “He has the in-depth insider’s knowledge that can only come from fighting in the trenches of the on-going war against cyber threats.”The appointment received immediate support across a range of organizations and interests.”This is a great hire for ICANN. Jeff’s been in the infosec community since the dawn of time and not only knows where the weak spots are but also how they got that way, and what needs to be done and by whom,” said Paul Vixie, Chairman and Chief Scientist at the Internet Systems Consortium. “He’s the ideal person to drive ICANN’s security agenda.””In the area of network security, Jeff Moss knows the problems, knows the people and brings remarkable energy,” said Steve Crocker, a leading expert on DNS security and Vice Chair of ICANN’s Board of Directors. “I’m looking forward to having him apply his talents in the ICANN community.””The global threats to the Internet’s Domain Name System are in essence the digital cold war of the new millennium,” said Merlin Hay, member of the British House of Lords and Chairman of the Information Society Alliance. “To win this war we need someone like Jeff Moss who understands the hacker’s mindset and has the international experience to grasp that today’s online attacks can come from just about anywhere on the planet.””Jeff Moss’ selection as ICANN’s Chief Security Officer is an outstanding choice,” said Linton Wells, Director of the Center for Technology and National Security Policy (CTNSP). “Too often, Internet security experts don’t understand the motivations and mindsets of those who pose an online threat to Internet users. Jeff has shown time and again that he not only understands hackers, but that he also truly gets why they do what they do. I look forward to working with him.”Moss has been a self-proclaimed hacker for over 20 years. Prior to his work with Black Hat and DEF CON, he was a Director at the Secure Computing Corporation, where he established the professional services department in Asia, Australia and the United States. He also worked in the information system security division of Ernst & Young, LLP.Throughout his career he has used his skills and understanding of the hacking community and its methods to help organizations secure their global networks. “I’m looking forward to bringing my skill sets to ICANN,” said Moss. “Its role in coordinating the global Internet addressing system means that it is positioned to become the leader in identifying and dealing with online threats to the Domain Name System that could affect two billion global Internet users.”Moss has organized technical security conferences around the globe, in locations such as the Netherlands, Spain, the United Arab Emirates, Japan, and Singapore.Moss graduated from Gonzaga University with a BA in Criminal Justice. He currently serves as a member of the U.S. Department of Homeland Security Advisory Council and is a member of the Council on Foreign Relations.He will begin working out of ICANN’s Washington, D.C. offices on April 29, 2011.This ICANN news release was sourced from:
icann.org/en/news/releases/release-28apr11-en.pdf

ICANN Head Calls For Global Cyber Security Collaboration; New gTLDs Still On Track

Global collaboration against cyber security threats is one of the key themes of the ICANN meeting currently being held in Cartagena, Colombia according to the ICANN CEO and President Rod Beckstrom.Beckstrom has called for the increased global sharing of information about security risks and escalating threats to the Internet’s Domain Name System (DNS).”Good security measures cannot be developed in a vacuum,” said Rod Beckstrom. “We need to document threats to the DNS.”Beckstrom made the comments during the opening session of ICANN’s 39th public meeting in Cartagena, Colombia, where he called on the Internet community and governments to collaborate in the battle against online security threats.”Many in the community are willing to discuss risks, threats and security incidents in private,” said Beckstrom in encouraging participant to now make those conversations public, because they are “essential for a full understanding of the situation and to establish a baseline of previous attacks and their impact.”The ICANN leader also said that governments should also become more collaborative. “As governments urge us to remain committed to security efforts, we in turn request that they help us by responding and working with the ICANN community on this vital mission.”In discussing what promises to be the hot-button issue of the meeting, the possible expansion of generic top-level domains, such as .COM, .NET and .ORG. Beckstrom summed up why the ICANN Board of Directors will consider vastly expanding the current list of 21 such domains.”Opening up the name space to new generic top-level domains is intended to promote competition, innovation and consumer choice in a safe and stable manner, with sufficient and appropriate safeguards to mitigate costs and risks.”The issue of new gTLDs became even more heated this week when ICANN received a letter from the U.S. Department of Commerce saying it was basically opposed to the launch of new generic top-level domains. The Board is expected to take up the issue of gTLD expansion at its closing meeting on Friday.The intervention by the US Department of Commerce was not unexpected with ICANN still to decide how to respond to the letter.”Because it deals with both Affirmation of Commitments and AGB concerns, it appears that the two threads may be unpicked and dealt with separately,” noted Domain Incite.However the plans to open applications for new gTLDs on 30 May are still on track.For on-the-ground coverage, check out Kieren McCarthy’s post here. McCarthy wrote on Beckstrom’s speech to open the conference, concluding that “In short, for the first time since taking over as CEO, and following a series of misjudged speeches, Beckstrom’s Cartagena opening speech demonstrates that he has started to find his feet in a complex and unforgiving environment.””And not a moment too soon.”

Global Internet Security Update Aims to Prevent Cybercrime

A critical upgrade to the internet’s infrastructure that will help make it more secure has been made in what is described as an historic collaboration between ICANN, the US Department of Commerce and VeriSign. The upgrade is to the domain name system and aims to protect Internet users from certain forms of online fraud. The upgrade will eventually allow Internet users to know with certainty that they have been directed to the website they intended.”A cyber criminal can steal your money or your personal data without you even knowing it. Cyber crime doesn’t respect national boundaries,” said Rod Beckstrom, President and CEO of ICANN. “This upgrade will help disrupt the plans of criminals around the world who hope to exploit this crucial part of the Internet infrastructure to steal from unsuspecting people.”The upgrade aims to protect against online fraud such as certain cybercrimes, cache poisoning and man-in-the-middle attacks. However it is not designed to protect against all attacks.DNSSEC isn’t an antidote to all Internet security problems. It does not ensure confidentiality of data or protect against denial of service or many other attacks. The best way to protect yourself online is still to use common sense.”DNSSEC is not a silver bullet to stop every cyber crime. But it will have a real and positive impact on the security of the Internet. This is one important step forward in the fight against cyber crime,” according to Beckstrom.An ICANN news release on the announcement is posted below.Global Upgrade Makes Internet More Secure [news release]
Helps defend users against specific types of cyber crimeThe security of the global Internet has been bolstered by a historic collaboration between government and the private sector. ICANN has joined the U.S. Department of Commerce and VeriSign Inc. to add security at the top of the domain name system – the technical infrastructure behind the Internet’s “phone book” – to protect Internet users from certain forms of online fraud.”A cyber criminal can steal your money or your personal data without you even knowing it. Cyber crime doesn’t respect national boundaries,” said Rod Beckstrom, President and CEO of ICANN. “This upgrade will help disrupt the plans of criminals around the world who hope to exploit this crucial part of the Internet infrastructure to steal from unsuspecting people.”With the Internet’s pervasive role in daily life expanding rapidly, finding viable solutions to cyber crime is imperative. Deployment of Domain Name System Security Extensions, or DNSSEC, at the “root” of the Internet has laid the foundation for a new generation of innovative cyber security solutions by creating a global authentication platform – a common source of trust in the validity of Internet addresses.Once fully deployed, DNSSEC will help prevent criminals from redirecting users to fake websites that can be used to perpetrate cyber crimes.The domain name system is where all Internet addresses are stored, and the unique nature of those addresses is fundamental to ensuring that computers around the world can speak to each other. Working silently in the background, the domain name system is consulted up to a trillion times each day by the world’s 1.8 billion Internet users. By using sophisticated public key cryptography, DNSSEC increases trust in the integrity of that process.Stopping certain cyber crimes
DNSSEC is a powerful tool to combat cyber crimes that have no organizational or national borders. Cyber crime covers a wide range of illegal activities that includes online fraud, money laundering and identity theft. DNSSEC will specifically protect against two types of attack known as “cache poisoning” and “man-in-the-middle attacks” that can be used to distribute malicious software and commit fraud.Cache poisoning
When you type an address into your browser, you are sent to that site and the domain name system saves, or caches, the information so your next request for that address will be processed faster. If your request is diverted to a false address, you might end up at a malicious site that infects your computer with viruses, worms, Trojan horses or spyware. These can lead to fraud and the theft of personal or sensitive information. If the request came from a service provider, thousands of people can be affected when the false information is sent on to the provider’s customers. Once the fake information is saved on your machine, your DNS cache information is considered poisoned.Man-in-the-middle attacks
In a man-in-the-middle attack, a criminal intercepts one-to-one communications then continues to communicate with the second party while masquerading as the first. For instance, a criminal could divert an online communication from a customer to a bank and then, pretending to be the customer, use the information to empty the victim’s bank account.What DNSSEC does
It will eventually allow Internet users to know with certainty that they have been directed to the website they intended.What it doesn’t do
DNSSEC isn’t an antidote to all Internet security problems. It does not ensure confidentiality of data or protect against denial of service or many other attacks. The best way to protect yourself online is still to use common sense.”DNSSEC is not a silver bullet to stop every cyber crime. But it will have a real and positive impact on the security of the Internet. This is one important step forward in the fight against cyber crime,” according to Beckstrom.Decades of engineering work
The Internet is a global resource and its bottom-up cooperative nature has once again proven key to achieving a significant improvement. “The Internet will be more secure because the Internet Engineering Task Force (IETF) devoted decades to solving the technical challenges,” stated Steve Crocker, member of the ICANN Board of Directors and chair of ICANN’s Security and Stability Advisory Committee.This ICANN news release is also available from:
icann.org/en/news/releases/release-28jul10-en.pdf

Security becoming an issue with .AU domains

Negar Salek writes in Secure Computing :

The number of successful attacks on .au domain names has increased over the past 12 months, according to the latest Cyber Hack Update 2008 report from TippingPoint. The report, released at the AusCERT conference revealed that Australia is second in APAC in terms of the number of successful cyber attacks annually; up one position from last year’s third ranking.

Korea Republic domain names which were previously most attacked in 2006-2007 fell below Australia and are now in third place. China is now leading the pack in APAC with 32,128 successful hacks in 2007-2008.

The report also revealed that there were more successful attacks on .au domains than popular Asian countries, Russia, Taiwan, Japan and Hong Kong.

To read the rest of Negar Salek article : http://www.securecomputing.net.au/news/76934,au-domain-names-increasingly-attacked.aspx