Wampum

Reading S.2661 is depressing. Here's the worst crud from the "Findings". I put a call into Olympia Snowe's Porland office this morning.

(2) Phishing e-mails are becoming more sophisticated by having malicious spyware attachments that once opened covertly record the keystrokes and passwords of computer users, or install malware software.

Keystroke logging software developed by the Federal Bureau of Investigation is pervasively deployed, and is "not detected" by commercial anti-virus software. As we mentioned in RFC 2048, building wiretap into the network, at the physical forwarding elements or application layer filtering, which is what anti-virus software is, creates an exploitable mechanism for uniformed, and non-uniformed criminals.

(6) The United States is consistently 1 of the top 3 countries that host the most phishing websites. In November 2007, the United States hosted approximately 24 percent of phishing websites.

This is a baffling factoid. There are 150m second-level entries in the global namespace, 70m are in .com, 10m are in .net, so half the global namespace is published by VGRS and easily half of the A records published by VGRS' resolve to ipv4 addresses in blocks allocated by ARIN, so one could just as well have written "Verisign" as "United States", and then relied upon existing contract, rather than ignoring existing contract, involving the DoC, the NTIA, ICANN and VGRS.

(7) A form of phishing known as `Spear Phishing' targets companies and government agencies to gain unauthorized access to their computer systems in order to steal financial information, trade secrets, or even top secret military information.

The final example of masquerading as a trustworthy entity, using socially engineered payloads against specific targets, to acquire valuable information, usually usernames, passwords and credit card details, but here "top secret military information" is reasonable, if you believe that DISNET is connected to MILNET and MILNET to "the Internet", and that each connection is a policy-free (non-filtering) gateway.

When I ran SRI's largest internal (and external) network, I'd one of the seven MILNET to ARPANET mail gateways in my shop. Neither MILNET nor ARPANET (modernly "the Internet") were classified networks. In the basement was a SCIF, on DISNET. I once "broke" the ARPANET by adding subnets for a Usenix meeting. That got me a same-day call from the ARPANET NOC at BBN. If I'd connected my DISNET node to either my MILNET IMP (modernly, router) or my ARPANET IMPs (ditto), I'd probably still be inside Leavenworth.

Whoever wrote the final cherry on that slice of pie was either plain ignorant or interestingly dishonest.

I've probably tossed them by now, but back when I hosted Barry's Amptoons his URL earned several multi-hundred node DDOS attacks, and I was always amused to find military assets, pwned of course, in the logfile of each attack. Calling their owners was always good for a laugh.

(9) Phishing operators utilize deceptive domain names for their schemes. They routinely register domain names that mimic the addresses of well-known online merchants, and then set up websites that can fool consumers into releasing personal and financial information.

This mixes two issues, to the loss of sense of both. The appearance of a domain name in the payload of some phish isn't the same thing as the actual domain name. This is why, when you look at a phish payload you often find that Sears or Bank of America appear to be operating out of Russia, the Ukraine, and China. The problem is "HTML-enabled" email. It makes pretty, and it makes hiding all kinds of neat toys, from web beacons that disclose every reading of a payload by an "HTML-enabled mail reader", to the bones of every phish.

The other issue is what is really at play in S2661. Trademark. This is more overtly discovered in the 12th Finding:

(12) Deceptive domain names, and the abuses for which they are used, threaten the integrity of domain name system. Businesses, small and large, rely upon the integrity of the domain name registration to ensure that their brands aren't misrepresented. The World Intellectual Property Organization reported in April 2007, that the number of Internet domain name cybersquatting disputes increased 25 percent in 2006.

Remember, you got here because the Peoples Liberation Army or someone is spear fishing in the third deck of E-ring, the SCIF that houses the secure-side of the office of the SecDef, the senior staffers of the OSD, and all the happy campers awaiting the return of Donald Rumsfeld. Where you're about to go to prevent this critical disclosure of "top secret military information" is ... a bunch of Intellectual Property lawyers in Geneva (I'm actually going there next week, not just to Geneva, but to the World Intellectual Property Organization) and a more accurate WHOIS database.

That's sure to foil the PLA, the KGB, and reverse Global Warming too.

I'll cover other parts of this gem in the near future. I operate an ICANN Accredited Registrar, one with its operational facilities in Portland and Bangor. The pointy end of S.2661 is aimed at Registrars, apparently because we either control the PLA, the KGB, and the melting point of ice, or because Markmonitor is using Olympia Snowe's office for marketing.

Markmonitor is big on phish. They're the registrar of record for verizon.com. Some of us registrars would like them to take down that domain as we know there is criminal conduct going on there. Phishing on a continental scale.