CAUCE

Submission to ICANN WHOIS Team review

 

CAUCE North America
PO Box 727
Trumansburg NY 14886
E-Mail: secretary@cauce.org

13. Apr. 2011

ICANN
by electronic mail

We appreciate the chance to comment on the ICANN WHOIS Review Team Plan as announced at http://www.icann.org/en/announcements/announcement-04mar11-en.htm

CAUCE NA, as an all-volunteer Internet end-user advocacy organization established in 1998 has moved beyond its original narrow mission of encouraging the creation and  adoption of anti-spam laws to a broader stance of defending the interests of individual Internet users.  CAUCE NA is led by a combined Board with a cumulative century of experience in the field of Internet advocacy and technology.

Based on that experience, including experience directly engaging with ICANN in a variety of capacities, we would like to offer the following comments on your proposed whois policy review activities.

1. Whois Is A Critical Anti-Abuse Resource

Combatting Internet abuse without access to whois data would, in most cases, be difficult if not impossible. To paraphrase a common cliché, IP addresses and domains don't attack Internet assets, people attack Internet assets. We cannot pierce the veil and map IP addresses and domain names to those people without routine access to the crucial information whois data contains.

If whois were to cease to be routinely available, targets of serious Internet abuse will have no alternative but to employ lengthy legal process to compel disclosure of resource assignment and allocation information. This process is cumbersome, time-consuming and expensive, and benefits no one except the attorneys who will be involved in pressing or defending these actions, and the miscreants who will enjoy weeks, months, sometimes even years of anonymity in which to continue to conduct their abuse with impunity. This abuse happens at internet speed; a slow response is effectively no response at all.

2. Whois Needs To Be A True Production Service Offering

Currently whois is offered on something of a "hobbyist" basis, particularly in TLDs that use the “thin” whois model. At one provider it will use one format, while at other times and at other providers, it will use another. This lack of consistent formatting, along with restrictive access policies, makes whois access something that's only suitable for small scale interactive "craft" access rather than being a production-ready and robust service that's appropriate for the volume of domains and other resources involved in today's domain name ecosystem.

If Internet abusers can script the creation of domains at arbitrary scale, but security teams and anti-abuse researchers are limited to some small number of manual whois queries per day, the abusers can obviously simply out-automate and out-scale us. This enforced handicap represents bad public policy.

Other technical ways that whois data access can and should be improved include:

• Whois data should be available via authenticated channels (or in a standardized bulk format) so that legitimate uses aren't thwarted by restrictive rate limits. (Authenticated access can and should be logged and audited to ensure that abuse is not occuring)

• Whois data should be structured in a consistent, standard format amenable to machine parsing. We believe that the tag:value form used by thick whois servers meets this requirement, so long as they continue to use a restricted and consistent tag vocabulary, and the definitions of each tag are available to the public — perhaps as an IETF RFC.

• Whois data should be aggregated and distributed from a central location using the “thick” model, rather than being distributed across hundreds or thousands of providers on a distributed "thin" model. This ensures both consistency and availability.

3. Whois Is a Community Resource

While law enforcement officers play a critical role in mitigating online crime, they are too few in number and too poorly funded to mitigate all online abuse. Much online abuse is handled by other entities, ranging from non-sworn government administrative agencies (such as the Federal Trade Commission here in the United States), to non-governmental organizations such as CAUCE NA or Spamhaus, to agents of aggrieved private parties seeking to protect their company's assets (including facilities, trademarks and intellectual property being used online in illegal ways).

If whois access were narrowly restricted to sworn law enforcement officers only, the "thin blue line" of law enforcement, important though it may be, will not be sufficient to maintain the status quo. The security and stability of the Internet will be negatively impacted, with an associated loss of public trust and transparency.

That said, we would not object if sworn law enforcement officers or civil investigators were offered expanded access to whois data, such as a routine ability to view an unfiltered version of whois data that is not encumbered by obfuscating private or proxy registration mechanisms — provided such access is authenticated, logged and audited to protect against arbitrary abuse and misuse.

4. Whois Data Must Be Meaningful

We have seen examples of whois data services that are present in name, but effectively of no value. For example, consider the data for chase-online-banking.com:

Domain: chase-online-banking.com
Registrar: Eurodns S.A.

Registrant:
Company:
Name: I P Freely
Address: 123 blowme lane
City: tacoma
Country: UNITED STATES
Postal Code: 98409

 

Administrative Contact:
Company:
Name: I P Freely
Address: 123 blowme lane
City: tacoma
Country: UNITED STATES
Postal Code: 98409
Phone: +012589636541
Fax:
Email: maiybs@gma.com

Technical Contact:
Company:
Name: I P Freely
Address: 123 blowme lane
City: tacoma
Country: UNITED STATES
Postal Code: 98409
Phone: +012589636541
Fax:
Email: maiybs@gma.com

Original Creation Date: 2011-04-04
Expiration Date: 2012-04-03

Status:
clientTransferProhibited

This entire WHOIS entry is transparently fraudulent. There is no “blowme lane” in Tacoma WA, no North American phone number starts with 01, and even if the zero were corrected as a typo, there is no 258 area code. The e-mail address is invalid, and even the simplest attempt to send a confirmation message would have revealed that mail to it is rejected.

If we see abuse involving that domain, which we have, there is no way to find an appropriate security or abuse contact.

It is nominally whois data, but it provides no information whatsoever about who or what that domain actually is. This shows what whois can devolve to, if we as a community allow it to degrade without objection.

We acknowledge that whois data, like any data, can potentially be abused. Not all whois data is equally at risk, however. For instance, we do not believe that an entity engaged in Internet commerce should have the same right to anonymity online that a political or religious dissident might require, and in fact, the customers of the Internet have a compelling right to know with whom they're doing business. We therefore urge ICANN to eliminate whois anonymity as an option for corporations and other non-natural persons controlling Internet resources.

5. Improvements To WDPRS and Whois Accuracy

When missing or inaccurate whois information is detected, users have the option of reporting that inaccuracy via the Whois Data Problem Reporting System (http://wdprs.internic.net/).

Unfortunately that system is operationally cumbersome, requiring domain-by-domain reporting via a web form, followed by email confirmations, even in cases where hundreds or thousands of domains share the same inaccuracies and the same registrar.

We understand that ICANN has a bulk WDPRS submission facility currently used by only a small number of high-volume reporters. That service should be made available, with suitable registration or other safeguards to deter abuse, to any entity submitting multiple WDPRS reports.

We also believe that the information WDPRS receives is not being appropriately leveraged to identify and address ongoing abuse. While WDPRS complaints may result in the correction of individual erroneous whois records, ICANN does not use that data to identify systematic problems, including potentially rogue ("bulletproof") registrars who make no effort at maintaining accurate whois data whatsoever — and may even treat whois inaccuracy and other violations of ICANN's rules as a competitive advantage.

Moreover, why is ICANN not sharing the substance of the community WDPRS reports it receives with community stakeholders? If there was more transparency about the reports received, consumer confidence in whois data accuracy would improve and we could even imagine a "PhishTank"-like model where community members could help to verify the reports that have been made via WDPRS.

We also believe that the costs associated with correcting erroneous whois data, particularly in the case of grossly and obviously inaccurate whois data, should be passed along to the registrar that has allowed that data to be accepted. Even the simplest of automated screening would easily allow many bogus point of contact data elements to be flagged at the time of domain registration; other types of online businesses have been doing this for years. Currently some registrars do not care if they accept bogus whois point of contact data, but if there were financial consequences to large amounts of invalid WHOIS, that could change.

Registrars that exhibit a clear and ongoing pattern of routinely accepting or failing to correct obviously bogus whois information should be subject to notice and breach proceedings under the registration agreement.

6. Adequacy of the "Key Definitions"

The Review Team also asked for feedback on the adequacy of the definitions it proposed at http://www.icann.org/en/announcements/announcement-04mar11-en.htm

In our opinion, the following adjustments would strengthen those definitions.

As written, definition 4.1 (Law Enforcement) does not distinguish between sworn law enforcement officers with criminal law enforcement powers (such as sworn federal law enforcement officers, sworn state police officers, sworn county sheriffs, and sworn municipal police officers here in the United States), and other entities incidentally included in an overly broad definition, including judges, lawyers, prosecutors, private security officers, administrative investigators and even parking enforcement officers (so-called "meter maids") whose responsibilities include "maintenance, co-ordination, or enforcement of laws, multi-national treaty or government-imposed legal obligations."

We believe "law enforcement officers" should be defined more narrowly to be only those individuals who have:

1. been sworn or commissioned as a law enforcement officer by a government agency of competent authority;
2. who are charged with upholding the general criminal laws of  an applicable jurisdiction, including having power of arrest;
3. typically have received specialized peace officer training (e.g., here in the United States such courses are typically offered by the Federal Law Enforcement Training Center ("FLETEC") or a similar program offered by one of the individual states, such as as Oregon's Department of PublicSafety Standards and Training Academy ("the DPSST Academy");
4. and who normally receive tangible official signs of their role such as a police uniform or official credentials (a badge and/or ID card).

In adjusting this definition, we do not mean to imply that ICANN should exclude non-sworn government officials from the scope of its work -- even though those government officials are non-sworn, they play an important role in enforcing applicable law via civil processes. They simply require a different label (such as "civil enforcement officer" or "administrative enforcement agent").

For example, here in the United States, while FTC investigators are not sworn law enforcement officers, they play an important role in compelling fair business practices using the civil enforcement powers at their disposal. They're just "investigators" and not "law enforcement officers" within the customary meaning of that term of art.

We also believe that ICANN should explicitly consider whether "law enforcement" includes those who may be members of national intelligence services, or a country or multinational organization's military services, recognizing that in some countries (such as the United States), there may be as many as seventeen agencies and organizations involved in collecting and processing national security-related intelligence information (see http://www.intelligence.gov/about-the-intelligence-community/ ).

Definition 4.2 (Applicable Laws) appears to concentrate primarily on laws related to "the collection, use, access, and disclosure of personally identifiable information." That focus would be appropriate if whois policy issues turned solely on matters related to registrant privacy.

CAUCE NA believes that any whois study must recognize the applicability of all criminal and civil laws on whois policy, and the impact of whois policy on those laws in turn.

Such laws would include, but not be limited to:

• laws against child exploitation and online "child pornography"

• laws making it illegal to attempt to obtain financial information without authorization by means of deceit or artifice ("phishing")

• laws forbidding the creation and distribution of viruses and other malicious computer software

• laws prohibiting the online sale and distribution of narcotics and other controlled drugs

• laws forbidding the advertising and delivery of copyright and trademark infringing products such as "knock-off" watches and pirated software, music and movies

• laws forbidding fraudulent schemes such as advance fee fraud schemes, penny stock "pump-and-dump" scams, products making baseless promises of weight loss or body enhancement

• laws regulating the collection of email addresses and distribution of bulk commercial email

Only when personal privacy rights are weighed against the full set of criminal and civil laws designed to protect a jurisdiction's citizens, can we achieve an appropriate balance between protecting privacy and protecting citizen's property and persons from all applicable risks.

In many cases the protection of property and persons from malicious actors is best served by access to whois information, rather than by withholding that information from interested parties.

Thus, that balancing process requires a more inclusive definition of "applicable laws" in CAUCE's opinion.

Defintion 4.3 ("Producers and Maintainers of WHOIS DATA") comingles a variety of parties and roles in ways that fail to adequately recognize important differences in perspectives and interests. For example, 4.3.A, "Producers" is defined as "The individuals or organizations supplying contact data for inclusion into WHOIS data." While that's seemingly a simple entity -- typically the person registering a domain -- in reality, things are less clear.

For example, whois data producers may include:

• the true or ultimate registrant

• a proxy registrant acting on behalf of the true or ultimate registrant

• a registrar or hosting company, perhaps listed as a default "technical" point of contact for all domains they register on behalf of the true or ultimate registrant

• a registration services provider acting on behalf of a registrar as an independent contractor or as the registrar's agent

These roles may change over time as well. For example, an engineer who may have initially registered a domain on behalf of an employer may change roles or change employers, yet still be carried on a registration as the point of contact for that domain, simply because the relevant data has never been verified and updated.

We might attempt to clarify all this by referring to an "initial producer" of whois data, or a "primary producer" of whois data, or a whois data "producer of record," depending on our emphasis, but any of those titles are only an approximation given the actual underlying practice.

We are also confused by the definition of "Data Controllers," particularly the trailing sentence fragment: "May or may not be directly involved in these functions." While that tautologically covers all possible cases, and in fact all persons, it does little to illuminate what's intended in this case, and is so overly inclusive as to render the definition of "Data Controllers" effectively meaningless.

More substantively, the sundry roles lumped into the "definition" of "Data Controllers" should be explicitly teased apart unless there is some compelling reason to throw them all into the same vague stew. Those who may work in the IETF to define the whois protocol (thus defining what data may be collected), have little to do with those who may work in ICANN to "govern" how that data may be used, or the judges who may "require its release." Don't lump them all together.

7. Determining The Extent to Which Whois Policy Is Effective, and Meets the "Legitimate Needs of Law Enforcement," and Assessing The Extent to Which "Consumer Trust" Is Being Promoted

Finally, we are not persuaded that the articulated program of work will substantively meet the defined purposes of:

• assessing the extent to which WHOIS Policy is effective,

• meeting the legitimate needs of law enforcement, and

• promoting consumer trust.

If you have a grand program of work, but it doesn't meet those goals, you're wasting your time.

If ICANN wants to know these things, we recommend that it collect hard data on these topics using generally accepted technical market research and statistical methods. Simply asking for comments from the "usual suspects" (particularly when scant feedback is often provided) will not give a true understanding of what's happening in the real world.

Given the technical nature of the questions involved, ICANN should formally poll experts knowledgeable in the areas involved, as well as law enforcement agencies with officers who specialize in cyber crime, and organizations that represent consumer interests. This engagement needs to be proactive on ICANN's part, and not merely represent a willingness to listen to comments that may happen to trickle in from particularly motivated respondents who happen to comment.

Thank you for the opportunity to comment on this work, and we stand ready to address any points about which you may have questions or need further information.

Sincerely,

CAUCE North America

CAUCE News, Volume 13, Number 1 April 2011

Welcome

Welcome to the thirteenth year of CAUCE News. CAUCE was involved in an unprecedented number of important initiatives in 2010, which we would like to take a moment to tell you about.

CAUCE participated in the Digital Phishnet meetings in Montreal, Canada, was represented at the Anti-Phishing Working Group meetings in Dallas, the Team Cymru Cybercrime meetings in Lyon, France, attended all meetings of the Messaging Anti-abuse Working Group, was present at Toronto's ARIN (American Registry for Internet Numbers) meeting, several IETF (Internet Engineering Task Force) meetings, and countless hours advocating for the passage of Canada's Anti-spam Law, C-28, now known as CASL.

CAUCE was instrumental in the development by the U.S. FCC's Communications Security, Reliability and Interoperability Council (CSRIC) its ISP Network Protect BCP document, providing substantial input to the final product.

We thank all our CAUCE supporting and organizational members, whose yearly membership fees allow CAUCE to function, to attend these conferences, and to advocate on behalf of computer users who want to see the fight against malicious online abuse come to a succesful end. All CAUCE directors and officers are volunteers who give generously of their time.

Facts and Tips for Consumers about the Epsilon Breach

Epsilon Interactive, who sends commercial email on behalf of hundreds of companies, admitted to a security breach that they detected some time in March. Journalists covering the story have collected notifications sent by about 70 companies, including many financial institutions.

If you received a notification from one of Epsilon's clients, the thieves know your name and email address. Depending on which company had your information, the thieves may also be know the hotels you may stay at, which credit cards you may use, or where you buy stuff online. If your email address shows up on several of these lists, the criminals can draw together a pretty accurate profile of who you are, and what you typically do, and can guess your income level. Ironically, that is what companies like Epsilon do with the data, too.

There has been a lot of talk, blogging, tweeting and press reportage about the Epsilon breach, but little in the way of concrete information to consumers as to where they stand, if their personal information (PII) such as their name and email address has been lost to criminals. The CAUCE Board of Directors have developed the following FAQ that provides facts and guidance for those affected by the breach

Read more

 

Impenetrable Processes and Fool's Gold at ICANN
By: J.D. Falk, Director-at-large

A couple of weeks ago, I attended part of the ICANN meeting in San Francisco. I've been watching ICANN and been peripherally aware of their issues since the organization began, but this was my first chance to attend a meeting.

What I learned is that ICANN is a crazy behemoth of a bureaucracy, steeped in impenetrable acronyms and processes that make it nearly impossible for someone new to get up to speed.

The best example of this is the recent approval of the .XXX top-level domain. There are already top-level domains for specific types of companies or organizations: .MUSEUM for museums, .COOP for co-ops. None of them have been very successful ? there are only a few hundred museums in .MUSEUM and 6000 co-ops in .COOP ? but they've been mostly harmless. So okay, the adult entertainment industry wants a top-level domain, why not let them have it?

Read more

 

C-28 Anti-Spam Law Receives Royal Assent
By: Shaun Brown, Counsel & Director-at-large

It's been a long time coming, but Canada finally has an anti-spam law. Bill C-28, the law with no name, was passed in December, 2010

First introduced in April 2009 as C-27, the Electronic Commerce Protection Act, it died when parliament was prorogued in December 2009, only to be resurrected in May of 2010.

Having been involved since the beginning, and eagerly awaiting its passage, CAUCE is excited and relieved to see Bill C-28 become law; it provides Canada with the tools to do its part in the global fight against spam and related threats.

Read more

 

Yes, People Still Care About Email Spam

Just over a month ago, we posted an article entitled "Do People Still Care About Email Spam Anymore?". Part of the reason why people might not care anymore, according to this article, is that email has become pass?. With so many other new ways to communicate, why even bother with email?

Not only did a few readers take the time to post some compelling counter-arguments to our article, even muckraking marketing columnist Ken Magill has weighed in on the debate. Citing a few recent studies ? including a finding by the Pew Internet & American Life Project that email is still the No. 1 online activity across all age groups of internet users ? Magill goes so far as to advocate a pretty hefty dose of harassment for the next person who states in public that email is dead.

According to The Radicati Group, there are currently 1.4 billion email users. A study by Nielsen found that 25 minutes out of every hour spent on a mobile device is on email. And so on.

Read more

 

Consider supporting CAUCE by becoming a free or supporting individual Member or an organizational Sponsor: Join Here. Organizations can support CAUCE at several levels, starting at $5,000 per year. Sponsors may enjoy a range of benefits, including logo placement and recognition in our periodic newsletter. Please contact us via e-mail at support@cauce.org for additional information.

We encourage redistribution of this message, as long as they are not spammed anywhere, are on-topic for any forum to which you send them, and include our copyright notice. When in doubt, post the URL of our site (http://www.cauce.org) instead, or put it in your signature. Press, broadcast, and Internet media may treat this material as they would a press release.

Facts & Tips for Consumers about the Epsilon Breach

Epsilon Interactive, who sends commercial email on behalf of hundreds of companies, admitted to a security breach that they detected some time in March. Epsilon and its parent company, Alliance Data, have posted two press releases about the breach.

• Epsilon Notifies Clients of Unauthorized Entry into Email System – April 01, 2011
• Alliance Data Provides Statement Surrounding Unauthorized Entry Incident at Epsilon Subsidiary - April 06, 2011

How many companies’ customers' email addresses were lost?

Epsilon has not revealed any statistics beyond ‘2% of our clients’, of which they reportedly have 2,500.

Journalists covering the story have collected notifications sent by about 70 companies, including many financial institutions. The names of these companies have been published at:

• Bank Info Security
• Krebs on Security

What information was lost?

Epsilon has stated that the names and email addresses of their clients' customers were taken. Presumably the attackers were also able to access the names of each client.

What does this mean for consumers?

If you received a notification from one of Epsilon's clients, the thieves know your name and email address.  Depending on which company had your information, the thieves may also be know the hotels you may stay at, which credit cards you may use, or where you buy stuff online. If your email address shows up on several of these lists, the criminals can draw together a pretty accurate profile of who you are, and what you typically do, and can guess your income level. Ironically, that is what companies like Epsilon do with the data, too.

Do the criminals have any more information about me?

While it's common for the contents of an email message to include more personal information than your name and email address, as far as we know, this information was not stolen. Often times, different data is stored in different places, and the thieves may have not been able to access the contents of previously sent messages. There is a pretty good explanation of the way these marketing databases generally work here

My address was lost in the Epsilon breach; CAUCE says the only way protect myself against phishing is to change my address. Isn't that is a rather extreme approach?

Sadly, it may not be extreme enough.  The Anti-Phishing Work Group reports that there are about 360,000 unique phishing sites, annually [2010].

Anti-virus software catches new malware about 20% of the time, leaving computer end-users exposed to a tremendous amount of viruses, keyloggers, and spyware, and other bad things. Anti-spam software does a pretty good job, getting well upwards of 90% of all spam, but some trickles through. We know that phishing attempts were successful at companies, ESPs, who were on high alert for the attempts.

While some phishing attempts are obvious, almost silly, others can be extremely difficult for end-users to recognize. Our friends at Word to the Wise took apart a legitimate email from an Epsilon client-company, and even email experts had a hard time determining if the email was real. See their article ‘Real. Or. Phish?’.

If your email was lost by a client company of Epsilon, we stand by our suggestion that changing your address is the best way to avoid receiving and having to deal with the phishing emails and other spam that will inevitably come from this data theft. Even if you don't want to abandon your current address entirely, this would be a good time to set up a new address and move your important communications there.

I unsubscribed from a customer list at Epsilon, and still received a notification from them. Isn’t this illegal?

It is arguably illegal under some laws, but it makes good sense that they did mail you. It doesn’t mean you weren’t unsubscribed. Here’s how it works: When you unsubscribe from an emailer’s list, they put your address into what they call a ‘suppression list’. The criminals presumably stole these too. The companies did the right thing by alerting you to the fact that your address was stolen.

How can I unsubscribe from everything at Epsilon?

Epsilon maintains a list of places where you can unsubscribe from a variety of their clients' newsletters.

We do not know if this will ensure that another of their clients will not upload your address to Epsilon in the future, and of course there are many other ESPs out there.

 Are the authorities involved? Can I sue someone?

Epsilon is reportedly working with the Secret Service, presumably because information related to bank and credit card clients was lost. Previously, some of the companies who were targets or victims of the previous series of breaches (which, again, may not be connected to the Epsilon incident) have been working with law enforcement.

The Australian Communications and Media Authority and Australian Privacy Commissioner are aware of the attack, having been alerted to it by Dell Australia, whose data was stolen. The breach may prompt an investigation by the UK Information Commissioner's Office, Connecticut Attorney General George Jepsen and Consumer Protection Commissioner William Rubenstein are investigating, and have written a letter to Attorney General of the United States asking him to investigate. Leaders of the House Energy and Commerce panel in the United States have written to the CEO of Alliance Data, Epsilon’s parent company, asking for more details on how many customers were affected and how the breach occurred.

You could try to sue someone: the company holding your data, or Epsilon, or both. There may be class action lawsuits coming out of this, as well as lawsuits by Epsilon’s client companies. If you do file with a class-action, you should not expect a large financial settlement, as these are generally quite small.

CAUCE suggests that if you live in a relevant jurisdiction, you can file a complaint with the local authorities about the breach:

• Australia (Australian Communications and Media Authority)
• Australia (Privacy Commissioner) 
• Canada (Office of the Privacy Commissioner of Canada)
• United States (Federal Trade Commission)
• United Kingdom (Information Commissioner's Office)

 If you have incurred a financial loss as a result of any phishing attack, or see suspicious activity on your bank account, contact your financial institution to alert them and report your credit card stolen immediately. Then, call your local and federal police forces to file a complaint (the bank will not do this for you).

BACKGROUNDER

How was the hack accomplished?

Epsilon has not released details about the mechanics of the breach. If it is similar to the hacking attempts targeted at ESPs last year, the hackers may have used social engineering and spear-phishing techniques, leading to an employee mistakenly typing their username and password into a web page controlled by the hacker.  However, at this time, we do not know what happened or whether there's any connection to the previous attacks.

Has Epsilon been hacked before?

Maybe. Epsilon has not publicly admitted to any previous attack, but their customer Walgreens has indicated that this is the second time they have lost data by way of Epsilon.

“After the incident last year, Walgreens requested that Epsilon put a number additional security measures in place. Apparently, that expectation was not fully met.” – Walgreen spokesperson, via databreaches.net

Is the Epsilon breach part of the previous series of attacks on the ESP industry?

These attacks appear to have begun as early as November 2009, the first victim being a company called aWeber.

Typically, the criminals would hack into an ESP by sending an employee an email that infected them with keylogger spyware, take over one of their client accounts, and send spam for fake Adobe or Skype software. More than a dozen different ESPs, including Epsilon, were targets or victims of these attacks in 2010.

It is impossible to say if this is the same as what happened to Epsilon more recently. Adobe or Skype spam was seen during previous breaches. This did not happen with the current breach with Walgreen or any other Epsilon customer.

This could have been the same group, using the same point of attack. It could have been a copycat using the same tactics, or an entirely different approach. We do not know, and there are too many variables for anyone to say they know definitively — though if Epsilon were to share what they know with the security community, it's likely that we could understand quite a bit more.

Did Epsilon have lax security?

We do not know what changes they made after their first breach, so it is impossible to say.

Were there things they could have done to improve security?

Obviously — they were hacked, after all. Epsilon will presumably address whatever let the hackers get into their systems this time, but any security professional will tell you that security is never perfect. What appears secure today may be exploited tomorrow.

There are many steps ESPs can take to much improve their security related to client lists and outbound email – we have listed them here

I heard that someone warned ESPs about breaches in November.

They did. Return Path provides services to ESPs, blogged about their own breach, and those at ESPs in November 2010. In fact, the ESP industry was becoming aware of this series of breaches all the way through 2010, as they were happening.

Security isn’t 100%? Why?

Software, and the way it interacts with various web applications is very complicated. Many sites do not, or cannot update all components that go into a web application, because to do so may break functionality on the site, or they are negligent. Home computers are pretty much the same. Microsoft, for example, issued 67 updates this past ‘Patch Tuesday’. Have you updated your computer?

Who is the real victim here?

You are. Epsilon suffered the initial attack. Their clients suffer as well, losing consumer trust. There may also be marketing or advertising agencies involved. But as far as CAUCE is concerned, the people who stand to suffer the most are the regular Internet users who trusted that the major brands whose products they enjoy would keep their email addresses and other personal information safe and secure. If these companies do not take immediate, public actions to prove that they deserve our trust, then they do not deserve our business.

Was your Email lost by Epsilon? Change your Address!

So far, 67 companies have admitted to having lost your personal information (PII) as a result of the Epsilon breach, including at least 8 financial institutions (list here).

Epsilon, and their customers are issuing advice to end-users like you. They are telling you not to answer emails from strangers, and to not provide information in response to emails. They are telling you to:

 Just hit delete.

That is, at best, bad advice. These stolen addresses will probably be used to send you phishing mail and attempts to install spyware, keyloggers and other malware on your computer: you will be at great risk of handing over even more information to the criminals behind these thefts.

CAUCE has a much safer alternative to protect yourself:

Change your address!

Your old address is ruined, and although changing is a hassle, Identity Theft  and losses at your bank are a much bigger hassle. Changing is the only 100% guaranteed way you can avoid all the spam that is about to head your way.

Change all of your login accounts at various retailers and banks, and other services you use, update them all with the new address. Today is a good time to come up with some fresh passwords to use, too. Keep the old address account in case you forget your password somewhere, but you can ignore it, moving forward.

If you want to get fancy, you can ‘tag’ your new address. Security blogger Brian Krebs has information on how to do this here. No matter what, change your address as soon as possible. Consider it one of your 'To Dos" for the weekend.

 

Why the Epsilon-Fukushima Analogy Was Apt

A few days ago, CAUCE published a blog post entitled “Epsilon Interactive breach the Fukushima of the Email Industry” on our site, and the always-excellent CircleID.

 A small coterie of commenters was upset by the hyperbolic nature of the headline. Fair enough, an analogy usually has a high degree of probability that it will fail, and clearly, no one has died as a result of the release of what appears to be tens of millions of people’s names and email addresses.

But, the two situations are analogous in many other ways, and here’s why. When I wrote the piece, I had in mind an article I recently read at The Economist, ‘When the steam clears - The Fukushima crisis will slow the growth of nuclear power. Might it reverse it?’, which sums up the aftermath neatly.

“FEAR and uncertainty spread faster and farther than any nuclear fallout.” – The Economist

There has been tremendous initial effect across the email industry as a result of Epsilon-shima. That whooshing you may have heard last Saturday was the sound of a collective frightened intake of breath at major brands and ESPs. A security staffer noted he had slept very little over the weekend, as the news broke.  The fact of the matter is, this happened to Epsilon, but it could just as easily have happened to any of their competitors, of which there are many hundreds.

Followers of the Twitter #epsilon hashtag, see that regular, everyday people are furious. They are furious that the trusted brands they do business with handed over their personal information to a 3rd party, they are furious that it was stolen due to lack security, and they want to know who the hell Epsilon is (CAUCE Director Dennis Dayman wrote about the need for transparency among emailers here). End-users are also beginning to blame every piece of spam they receive on Epsilon, even though, to date, there has been no verifiable reports that I have seen that the thieves have sent a single piece of spam out. End-users are gun-shy. Unfortunately, they’ll get over it, of course, and drop their guard, making them vulnerable to spear-phishing.

“There will certainly be more durable effects too. Years of cleanup will drag into decades” – The Economist

It’s true. Once lost, these email addresses will very likely be used as spear-phishing targets (remember, the criminals also have the proper names of victims, as well as a list of who they did business with, including their financial institutions). Once they have served that purpose, they will be sold to other spammers, who will send untargeted spam to them.  While spam filters will likely take care of most of this problem, there will undoubtedly be financial loses and successful instances of Identity Theft as a direct result of the Epsilon breach. This is a mess that simply can’t be cleaned up by form letters downplaying the theft, assuring people the criminals ‘only’ stole the data they did.

Make no mistake about it, an email address is considered to be personal identifiable information in Canada and Europe, and for good reason, because quite simply it is private information. Canadian and European brands  were affected by the Epsilon breach. While the United States lags far behind the rest of the world with regard to breach and privacy legislation, this thing is far from over from an investigative and legal standpoint.

(An ESP) “Looks dangerous, unpopular, expensive and risky. It is replaceable with relative ease and could be forgone with no huge structural shifts in the way the world works. So what would the world be like without it?” – The Economist

ESPs are simply out-sourced services that many companies use to maintain their customer database, and send email marketing campaigns, and sometimes-transactional email, to clients.

We know that Epsilon lost 50 companies’ client information. What if all 50 of those companies were doing their own email and database management? In practical terms, I could see that making things worse. Relying on relatively unskilled, or even incompetent IT and marketing departments at retailers to do email correctly from a technical and policy standpoint is a highly unlikely scenario. Mass emailing is quite complicated these days, with laws, technical requirements, and methodologies ever-changing. Better to centralize the adherence to industry standards in the hands of the experts. If ESPs magically disappeared, mass email marketing would be in a bigger mess that it is today.

Like Fukushima, there were plenty of preemptive rumbles that should have reasonably warned Epsilon and the other ESPs that something bad was coming. There had been at least a dozen breaches of ESPs in the last year, and database and site breaches are as ‘common as car crashes’ as British telecom Chief Security Officer Bruce Schneier said.

Akin to the Tokyo Electric Power Company, even in light of prescient safety reports, ESPs failed to react appropriately to secure their sites. Databases should be encrypted, industry-standard security technologies and policies deployed, and 2-factor authentication implemented to access private data, across the board, as quickly as humanly possible.

Sadly, none of these is a silver bullet that will make data 100% secure. There is no such thing as 100% security, but all holders of private information, including ESPs must be held accountable to the highest standards, and not continue to allow themselves to be dumb, low-hanging fruit for criminals.

ESPS … “won’t go away, but … must to some extent remain a sideshow, however spectacular it looks when (they go) wrong. – The Economist

Epsilon, and other members of the sending and ESP communities have a tremendous opportunity to change in front of them, to become competitively better than ever. Epsilon will likely recover from this debacle, but the next ESP breached in a similar manner? Their fate remains quite uncertain.

Epsilon Interactive breach the Fukushima of the Email Industry

Marketing as Usual? Not a chance. – Epsilon corporate catch phrase

A series of attacks on the Email Service Provider (ESP) community began in late 2009. The criminals spear-phish their way into these companies that provide out-sourced mailing infrastructure to their clients, who are companies of all types and sizes.

Upon gaining access to an ESP, the criminals then steal subscriber data (PII such as names, addresses, telephone numbers and email addresses, and in one case, Vehicle Identification Numbers). They then use ESPs’ mailing facility to send spam; to monetize their illicit acquisition, the criminals have spammed ads for fake Adobe Acrobat and Skype software.

On March 30, the Epsilon Interactive division of Alliance Data Marketing (ADS on NASDAQ) suffered a massive breach that upped the ante, substantially.  Email lists of at least eight financial institutions were stolen. 

Thus far, puzzlingly, Epsilon has refused to release the names  of compromised clients. CAUCE has drawn the a list of  from news reports (below)

The obvious issue at hand is the ability of the thieves to now undertake targeted spear-phishing problem as critically serious as it could possibly be.

What to do?

CAUCE is calling on the ESP industry and ISP and Email Receivers to implement these measures across the board, to protect the PII of end-users everywhere. What follows are best common practices that have existed for many years. It is time to take a stand against the data-thieves, and begin to properly protect end-users, without fail.

ESP & Senders

• Security must be the top corporate priority. Both Silverpop and Epsilon Interactive were either breached repeatedly, or failed to fully mitigate their initial security lapse in December.  I was told by one ESP security staffer that he hadn’t been given sufficient resources to affect all the appropriate changes. That is at best lamentable.

• Two-factor authentication must be implemented for ESP system access for both staff and clients.

• Senders and ESPs must sign all email with DKIM, and authenticate all mailing IPs with SPF.

• ESPs must check all outbound content against domain blacklists such as SURBL and the Spamhaus DBL before deployment.

• ESPs must deploy extended-validation certificates on web properties.

• ESPs and senders must rigourously adhere to the MAAWG Senders’ BCP

• ESPs and brand owners should use the services of email authentication services such as Authentication Metrics, eCert, Return Path, and Truedomain, as well as anti-phishing services like BrandProtect, Internet Identity and tools such as Lashback’s BrandAlert

• ESPs must adopt and embrace a culture of transparency and commit to cooperative full disclosure

“Epsilon has refused to provide additional details on what other brands may have been affected.” – Security Week

“SilverPop did not respond to requests for comment” – Krebs on Security

While it is the instinctive corporate reaction to be secretive, such a strategy exacerbates the frustration of the other set of victims of data-theft, namely the end-users. A complete list of breached clients is fundamental to protecting end-users, and allowing them to protect themselves.

Receiving Systems

We need desperate measure for desperate times, CAUCE calls upon the receiving community to better their protection of end-users.

• Email receivers must follow Yahoo! Mail’s lead and deploy multi-layer phishing protection.

• Email receivers must deploy DKIM and SPF checking, and treat messaging failing such checks accordingly by labeling the subject line, placing it in a spam folder, or blocking it entirely.

• Email receivers must deploy checks using URI blacklists like SURBL and Spamhaus on message headers and content domains.

• Email receivers must take extreme measures, even if there are false positives. Better safe that sorry, and given the potential damage these breaches can cause to a recipient, far better that there are false positives (legitimate email refused or sidetracked to the bulk folder) than false negatives (illicit email delivered to the inbox).

The list of breached companies

 

Microsoft, others help take down Rustock Botnet

Microsoft's DCU and some federal agencies took down the Rustock botnet two days ago. A hearty CAUCE congratulations to all those involved, in the forefront, and behind the scenes.

Here's a compilation of various news and data sources:

Krebs on Security: http://krebsonsecurity.com/2011/03/rustock-botnet-flatlined-spam-volumes-plummet/
Wall Street Journal: http://online.wsj.com/article/SB10001424052748703328404576207173861008758.html

Microsoft: http://blogs.technet.com/b/mmpc/archive/2011/03/18/operation-b107-rustock-botnet-takedown.aspx & http://blogs.technet.com/b/microsoft_on_the_issues/archive/2011/03/18/taking-down-botnets-microsoft-and-the-rustock-botnet.aspx

CBL (2nd & 3rd charts) http://cbl.abuseat.org/totalflow.html  & http://cbl.abuseat.org/rustock.html
Spamcop: http://www.spamcop.net/spamgraph.shtml?spamweek
Nixspam: http://img.ly/3eix

The court orders (PDF) http://bit.ly/fg0d0u

Kidnapping, Theft and Rape Are Not "Cyber" Crimes

Kidnap. Rape. There are no lesser words that can be used to describe what happened to the daughter of an anti-spam investigator in Russia.

His daughter was recently released, according to Joseph Menn’s recent article on Boing Boing, after having been kidnapped from her home five years ago, fed drugs, and made to service men, as a warning to ward off further investigations.

The criminals behind these vicious acts were also responsible for large spamming organization associated with Russian Mob activity.

Note that we say "also."

When someone is mugged, harassed, kidnapped or raped on a sidewalk, we don't call it "sidewalk crime" and call for new laws to regulate sidewalks. It is crime, and those who commit crimes are subject to the full force of the law.

For too long, people have referred to spam in dismissive terms: just hit delete, some say, or let the filters take care of it. Others — most of us, in fact — refer to phishing, which is the first step in theft of real money from real people and institutions, as "cyber crime." It's time for that to stop.

Some of these crimes involve technology. So what? Criminals have used technology before.

Some of these crimes cross borders. So what? Crimes have crossed borders before.

Spam isn't illegal everywhere yet. So what? Spam 2.0 (spam, malware & spyware) is the leading edge of far worse activities, often things that have been illegal as long as we've had laws.

It is high time that governments and law enforcement stop thinking of computer crime as that perpetrated by teenagers in their parent’s basement. It is the Russian Mob and other organized criminals that are doing this.

While we are at it, we should mention ‘cyber-warfare’, something too often conflated with cyber-crime. Cyber-crime is not "cyber-warfare.” There may be state or terrorist agencies copying the tactics and methods of these criminals, but that does not mean that the criminals must be left alone until new cyber-warfare agencies have been created and funded.

As Purdue computer science professor ‘Spaf’ Spafford was recently quoted as saying in a note-worthy piece ‘Cyberwar Vs. Cybercrime’ on the GovInfo Security blog

"Why aren't we seeing the investment and prioritization being made in law enforcement, first? Why is all the publicity, funding and prioritization being given to the military - with efforts such as the build-up of the military cyber command - when so much of the clear and present threat is from the criminal element and not from other nation-states?"

Just so, Prof. Spafford!

As we have said repeatedly on this site, these are criminal gangs who have found an incredible loophole in the justice systems of the world: they can rob banks and people, with little chance of getting caught, let alone going to jail. This is not because they're doing things that aren't illegal; they've just found a new way to hide.

David Black, manager of the RCMP's cyber infrastructure protection section recently said to CAUCE Executive Director Neil Schwartzman “we don’t do spam”. OK, but why not? Spam is no longer, and hasn’t been for some time, about simply sending unwanted emails. Spam is now a delivery mechanism for malware, which in turn threatens infrastructure, and facilitates theft. We have seen precious few cases filed using existing Federal computer intrusions laws in Canada, and none, to our knowledge have been filed under the renovated anti-phishing law, S-4, passed in September 2009.

Governments and law enforcement agencies need to begin to treat online theft with the same seriousness as they do other physical crimes. It is time to bring this up to the diplomatic level, or seriously consider refusing packets from places that treat the Internet, and innocent victims, as their personal ATM.

CAUCE is made up of people who care about email qua email. We understand it, we love it. It is still the ‘killer app’. Furthermore, we understand why some folks in law enforcement or the judiciary might ask, "When there are people stealing millions or hurting people in the commission of violent crimes, why are you wasting our time with 'just' a spam case?” Here's why:

1. Most spam is sent by organized criminal gangs, just like other organized crime.
2. Those gangs intentionally operate trans-nationally, in an effort to frustrate investigation and prosecution.
3. Money laundering of the proceeds from spam is routine, and that money directly fuels official corruption and other social ills.
4. Some spammers are actually selling something. Their favorite product? Counterfeit pharmaceuticals. In many cases these may be scheduled controlled substances, sold in bulk, and available to minors; in other cases, critical medicines needed to properly treat cancer and other serious illnesses may be counterfeit placebos, with potentially tragic results.
5. Spammers operate by compromising tens or hundreds of thousands of end-user PCs, violating those users' privacy and sometimes steal sensitive personally identifiable information such as individuals’ and even corporate access to financial services at the same time they're using their systems to spam. Computer ‘phishing’ is no less a crime than bank robbery, home invasion, and mugging.

Cyber criminals consider cyber crime to be a virtually riskless offense; they're unlikely to be identified; if identified, they're unlikely to be investigated; if investigated, they're unlikely to be charged and prosecuted; if prosecuted, they're unlikely to be convicted; if convicted, they're unlikely to do jail time.

The courts need to make it clear that that's wrong in all respects. If you commit cyber crimes, you will be identified, investigated, charged, prosecuted, convicted and sentenced to serious time and we will seize your assets.

This will not happen so long as crime, which involves the Internet, is dismissed as "cybercrime" and either scoffed at, or used to justify ever-increasing cyberwarfare budgets

This isn't just email. This isn't a war. This isn't "cyber.” This is crime. It is time to call a cop, and expect a response.

 

by CAUCE Executives J.D. Falk & Neil Schwartzman

Facebook Spammer Ordered to pay $1 Billion Judgement

Earlier this week a Quebec Judge decided to rule in favour of upholding the record setting judgement of $873 Million USD Montreal resident Adam Guerbuez. 

The original case of Facebook v. Atlantis Blue Capital, alleged millions of messges flooded Facebook's network via compromised accounts resulting in Statuatory damages of ~$436 million and aggravated damages of ~$436 million (or $100/$100 per recipient respectivly).

As Canada does not currently have a compariable law to CAN-SPAM, Facebook petitioned the Quebec courts to enforce the judgement in California.

Read the Story at the Globe and Mail here: Quebec court orders alleged spammer to pay $1-billion to Facebook

This is a great example of the importance of FISA being quickly passed through Goverment.

October is National Cybersecurity Awareness Month

For more information, see staysafeonline.org.