<html><head><meta http-equiv="Content-Type" content="text/html charset=iso-8859-1"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div>(Just sending to dnsops as it seems all the right people are on this list.)</div><div><br></div>I don't know if this is still something that would interest us. He would like us to continue to provide him packet captures if we take over the domains to enable ongoing research.<div><br></div><div>I am less worried about the actual resources to do this, it is probably largely set and forget, but I imagine there are some liability questions. Have we dealt with similar things with DITL captures?<br><div><br></div><div>Any thoughts?</div><div><div><br></div><div>kim<br><div><br><div>Begin forwarded message:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px;"><span style="font-family:'Helvetica'; font-size:medium; color:rgba(0, 0, 0, 1.0);"><b>From: </b></span><span style="font-family:'Helvetica'; font-size:medium;">Nick Freeman <<a href="mailto:nick.freeman@security-assessment.com">nick.freeman@security-assessment.com</a>><br></span></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px;"><span style="font-family:'Helvetica'; font-size:medium; color:rgba(0, 0, 0, 1.0);"><b>Subject: </b></span><span style="font-family:'Helvetica'; font-size:medium;"><b>Re: <a href="http://root-servers.net">root-servers.net</a> and <a href="http://gtld-servers.net">gtld-servers.net</a> bit-flipped variants</b><br></span></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px;"><span style="font-family:'Helvetica'; font-size:medium; color:rgba(0, 0, 0, 1.0);"><b>Date: </b></span><span style="font-family:'Helvetica'; font-size:medium;">October 15, 2013 5:03:14 PM PDT<br></span></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px;"><span style="font-family:'Helvetica'; font-size:medium; color:rgba(0, 0, 0, 1.0);"><b>To: </b></span><span style="font-family:'Helvetica'; font-size:medium;">Kim Davies <<a href="mailto:kim.davies@icann.org">kim.davies@icann.org</a>><br></span></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px;"><span style="font-family:'Helvetica'; font-size:medium; color:rgba(0, 0, 0, 1.0);"><b>Cc: </b></span><span style="font-family:'Helvetica'; font-size:medium;">Sebastian Castro <<a href="mailto:sebastian@nzrs.net.nz">sebastian@nzrs.net.nz</a>>, Gregory Patrick <<a href="mailto:gpatrick@verisign.com">gpatrick@verisign.com</a>><br></span></div><br><div>-----BEGIN PGP SIGNED MESSAGE-----<br>Hash: SHA1<br><br>Hi Kim,<br><br>I am happy to put together a research proposal. Is there a template or<br>any format you would prefer to receive it in? The resources required<br>from ICANN would be:<br><br>a) a VM to be authoritative for the 'bit-flipped' servers, running tcpdump<br>b) a (preferably automated) method to deliver me a the PCAP file once<br>a week for processing.<br><br>Hopefully this wouldn't require too much work to be accepted.<br>Alternatively, I am happy to hold on to the domains until they are due<br>to expire.<br><br>I will give you access to the reporting interface once I have tidied<br>it up a bit. I believe that, while the 'bit-flip' incidents happen<br>quite rarely, the potential impact when one does occur can be serious<br>- - and would be worth conducting further research on.<br><br><br>Best regards<br>Nick<br><br>On 16/10/13 11:58, Kim Davies wrote:<br><blockquote type="cite">Hi Nick,<br><br><blockquote type="cite">Thanks for your email, and also for agreeing to take over the<br>domains. I would like to keep the domains until I have completed<br>my upcoming presentation at Kiwicon (November 9th) - the week<br>after that would be ideal for making the transfer.<br></blockquote><br>Of course, they are your domains so it is up to you how you wish to<br>do this.<br><br><blockquote type="cite">Something I am hoping for is that, while handing over the<br>domains, to continue carrying out the research. If possible, I<br>would like to receive a data feed (pcaps, ideally) of the<br>requests for the bit-flipped domains, so I can continue trying to<br>correlate events (heat waves, increased cosmic ray activity,<br>radiation issues etc) with servers being victims of bit flip<br>attacks. I would of course be happy to share my findings from<br>this with you. Would this be possible please?<br></blockquote><br>Based on what we have been told so far, our only intention so far<br>was basically to hold the domain registrations but not do anything<br>with them. i.e. probably hold them undelegated. Anything that would<br>involve standing up servers or other facilities has not been<br>discussed within our organisation.<br><br>Whether it makes sense for ICANN to do so will depend on what such <br>research is expected to result in, and whether that is in line with<br>our mission. If you have a specific research proposal in mind on<br>what you'd like us to do I can propose it internally. Likely such<br>activity would be sponsored by our Security department, rather than<br>IANA where I am based.<br><br><blockquote type="cite">Secondly, do you have any plans on contacting the registrants of<br>the remaining 6 root-server bitflips?<br></blockquote><br>I had no plans, but as with above, that is merely due to a lack of<br> data on what the risks are and whether they are substantial enough<br>to warrant significant actions by ICANN in this area. Even though<br>we regulate aspects of the domain name system, we have no power to<br>take these domains away from valid registrants under current<br>policy, so anything along these lines would involve appealing to<br>the existing registrant to come to some arrangement.<br><br><blockquote type="cite">And finally - I ask only due to the number of domains - is there<br>any possibility of part of the cost of the domain registration<br>being returned to me? I used GoDaddy as a registrar as they had<br>what I found as the best bulk deal - but 101 domains still comes<br>to over NZD1000 per annum. I completely understand if this is not<br>possible but if it is, it would be appreciated.<br></blockquote><br>Given your thoughts above about this not being a simple handover<br>but an ongoing commitment by ICANN, I think it makes the most sense<br>to put together a proposal, and if you wish to have reimbursement<br>as part of it, I would suggest including it.<br><br>My discussions internally have basically been on the level this is <br>cost neutral to us in the short term, and I received agreement it<br>made sense on that basis. If I need to obtain budget for this<br>activity, and dedicate ongoing resources to manage services such as<br>packet collection, I will need to have a further conversation to<br>determine if we are able to make more of a commitment on this<br>project.<br><br><blockquote type="cite">I am still in the process of writing slides but would be happy<br>to share them with you prior to the presentation, and if you<br>like, am also happy to the provide access to the reporting<br>interface for the data I have collected so far (once I've tidied<br>it up a bit - it's very much cobbled together at this point!).<br></blockquote><br>Of course, we'd be happy to help out where we can.<br><br>thanks!<br><br>kim<br><br></blockquote><br>- -- <br>Nick Freeman<br>Principal Security Consultant<br><br><a href="http://Security-Assessment.com">Security-Assessment.com</a><br>Mobile: +64 21 424 777<br>Email : nick.freeman@security-assessment.com<br>Web : http://www.security-assessment.com<br>-----BEGIN PGP SIGNATURE-----<br>Version: GnuPG v1.4.11 (GNU/Linux)<br>Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/<br><br>iQIcBAEBAgAGBQJSXdfCAAoJEHsndH8/peG7/AkQAJL7qe04SBxDjLJZYZPgn81g<br>z0Gw3nVQpNcjjqOsAvWLzVuO1AyCLMXYmnjHEijicy3QOrhva+ve5qVGwzom2Hkh<br>MbsE6/4XEex2aEQP6ffGTiNOYLyDReTzVEGXZrfCk54xJGfSK4MxxvJa7rk7bQTe<br>kxdbHz+ferDJLY6FBrTABcd7lO1TWSbO17sK34rqwO41ZyaQ/bo9984yPog5vV+E<br>8kv8i9Gd/98ojgNazwHNAb/DUheJVmlNsdhYLcGRjq2eu9Iml1YMKrbEcKT7ObV6<br>fQaRtJlna2UDH+S4EXBsAYy2JdvB8StNQepsd8XyZi4pr+6oK97Od8gG3GDQJ49g<br>+1khh9XX5hwN4+muyO/2gt1SI/AvPcSL6pXlEM5BVNgnIPuto16kdiTz9AYuRa1b<br>XOB1Lnpfql3Q6z/UZ9s0+zRyP0qXBinas4mb8idFNtR5hzlNOcXJRTGNrEX9XeUJ<br>qkCR7wOYu8loAVfFGMOX0mxUAJg2A7qeoUbPvwGqgGavbO58MOJzUfzq5JRuCwEJ<br>sqZmdYafzUB6VryRKRSewjr6W0tXDIE59w+SfGsjLEo7x8GOQ4zrXie6vzSK4ME0<br>2o3EEYQY2Tsys6yUIDMoaMJL14dOUxvvjNGariFg7mAQSHkskKErmBFC6+ndF51b<br>v9fAX6KQgo+tPBaVpE0A<br>=I1g1<br>-----END PGP SIGNATURE-----<br></div></blockquote></div><br></div></div></div></body></html>