RiskReact on Domain Name Security & Domain Locks

RiskReact is a service of Realtime Register B.V. with a focus on security threats, cyber intelligence & OSINT.

Last year a registrar employee was the victim of social engineering resulting in an unauthorized transfer of a domain name. 

A few months ago, a registrar employee was the victim of a spear-phishing attack, resulting in a DNS hijack. 

A possible solution to counter such issues and other risks is a Domain Name Registry Lock. 

Domain name registry locks are available for many TLDs. They all cover the same basic level of protection. 

  • Domain name update lock, preventing unauthorized or accidental updates
  • Domain name deletion prevention
  • Prevents unauthorized transfers or domain theft
  • Prevents host updates or deletions 

When we look at our competitors who offer registry locks as a service we observe the following issues; 

  • No option for secure and encrypted user authentication. 
  • Domain updates and passphrases are not encrypted.
  • One size fits all procedure.
  • Procedures are posted publicly on websites for anyone to read, including social engineers and hackers with malicious intent. 
  • Low prices. While low pricing is not a bad thing itself, low pricing usually does not provide the highest possible security. 

With RiskReact, we approach the solution from a different angle. 

Our approach is not to offer the cheapest or most convenient solution. With Risk React, we aim for the best custom solution that matches your threat and risk profile. 

In counter-surveillance, a useful strategy is to let unknown surveillance operators know that there are robust measures in place that make surveillance hard and detectable. Such an approach is acting as a deterrence to protect the target. Below I will explain how Risk React can work as deterrence and why it is an excellent solution to protect your high profile domain names. 

Assess the risk (module 1, included in base price)

Together with the client/reseller, we will discuss the potential dangers that a domain name might face and discuss the best possible solution. 

After the decision on what solution is best, we will perform an OSINT and non-intrusive technical scan to determine if the solution matches reality.

If there is a divergence in the assumed risk model, we will inform the client/reseller so we can adjust the solution if required.

Module one also includes a scan for public breached user accounts. In case of detection and in combination with the RiskReact service, we will discuss this first with you as it is usually better to avoid such user accounts and email addresses altogether for security reasons.

Also included for free is the 24/7 Intelligence Monitoring.
Our Enterprise-grade endpoint security engine scans domain names constantly for malware, phishing, APTs, botnets, or if your domain name is blocklisted.
A blocklisted domain name can have a negative impact on your SEO, or worse, your domain name is no longer accessible.

One or multiple authorized users (module 2)?

Depending on the setup and organization of the client/reseller, it might be advisable to add more authorized users to add more flexibility. 

For example, we have a client where both the CISO and CTO have to approve the changes. 

Out of band, out of the box (module 3). 

We understand that in some cases, like a domain name that is part of a critical internet infrastructure requires a lot more added security and a different set of protocols and perhaps different communication channels. 

For example, it might be necessary that communications are done through an encrypted decentralized communication protocol.

Such options can all be discussed, so surprise us!

SOCMINT (module 4).

Social media is great for branding until you become the target of activists or worse, hacktivists.

RiskReact can monitor social media, and our CTI analysts will inform you of possible threats. Being alerted of such events at an early stage allows you to deploy possible mitigation responses.

Brand monitoring (module 5)

Make sure that you are aware of typo or homograph domain names.
Typo or homograph domain names are often used for spearphishing attacks.
Our system will alert you regarding newly registered domain names that impersonate your brand or might infringe on your intellectual property.

Public breached and leaked database assessment and monitoring (module 6)

RiskReact monitors domain names and PII provided by the client/reseller by checking public breached databases and publicly-leaked databases. These databases are updated almost weekly. When we discover the submitted PII in a breach/leak, we notify the client/reseller. 

Be advised we need to comply with the GDPR, and the service mentioned above has some restrictions.

 Dark web Research (module 7)

Dark web research is an excellent way to detect possible threats arising from the dark Web. 

Such research includes the detection of exploits used in the wild or leaked information. Naturally, analyzing a part of the Internet frequented by individuals trying to stay out of the spotlight is a more difficult task than traditional measurement campaigns conducted on the regular Web.

For more information, contact our support team to discuss your potential domain name risks and solutions!

Post GDPR gTLD Transfers

Update: 25-05-2018

The procedure below is now live as per the ICANN temporary spec. I observe that not every Registrar was aware of the below situation. If you cannot transfer out your domain name(s) advise the gaining registrar to stop parsing WHOIS data and trying to send FOA emails to the registrant or admin contact, this will no longer work.

 

The new procedure has been communicated last week by ICANN to all registrars. To view this communication click here,

 

 

As mentioned in a previous blog the WHOIS will change drastically over the next few weeks.

At the moment when you start a transfer through the API or domain manager, our system sends an FOA to the registrant or the admin contact based on our contractual ICANN requirements. Once the FOA has been approved by one of the above contacts the transfer is requested at the registry,

 

Transfer solution post-GDPR

We will no longer send the incoming FOA, the auth code is sufficient to request the transfer on a registry level.

The losing registrar will still be required to send the outgoing FOA, the registrant can agree or decline the request. If there is no response from the registrant the transfer will be processed automatically after 5-7 days unless the losing registrar not acknowledges the transfer and cancel the transfer on their side.

Domain names that are set to transfer prohibited will not be transferred, if your customer wishes to transfer in or out, the transfer lock needs to be removed prior to the transfer. We recommend setting your domain names to transfer prohibited and regularly change the auth-codes for the domain names under your management for security reasons.

The above-described transfer process should not be to complex for most resellers, as it works somewhat similar how the larger ccTLD registries operate.

Recommended domain name security reading

A Registrant’s Guide to Protecting Domain Name Registration Accounts a report from the ICANN Security and Stability Advisory Committee (SSAC)

SSAC Advisory on Registrant Protection: Best Practices for Preserving Security and Stability in the Credential Management Lifecycle

Domain theft?

Though at first glance it seems the above changes might lead to more domain theft. This is counter mitigated due to the fact that the WHOIS info will no longer contain registrant data and email addresses. This info is usually an attack vector for hackers who steal domain names, with this attack factor no longer in play we expect to see fewer cases of domain theft.

Key transfer changes post GDPR summary.

  • Transfers will continue to require a valid authorization code; just like EU ccTLDs
  • The gaining registrar will no longer be required to send a Form of Authorisation (FOA) to the registrant, again most likely there is no WHOIS info to create one.
  • The losing registrar will continue to send an FOA (aka outgoing FOA) that allows the registrant or admin contact to ACK (acknowledge) or NACK (not acknowledge) the transfer;
  • If there is no action/response, the transfer will auto-ACK by the registry after five days from initiation of transfer;
  • Registration information will not be transferred as part of the IRTP-C, registrants will independently re-enter transfer information with the gaining registrar. This will include entering into a registration agreement with the new registrar as it is now.