VeriSign Withdraws Request To Suspend Malicious Domains

In a bizarre twist of events, VeriSign has now withdrawn a controversial request it submitted to ICANN earlier this week to suspend domains that harbor botnets and malware.

VeriSign had petitioned the ICANN Registry Request Service for the authority to suspend known malicious domains without having to first obtain a court order, and to scan its registrars' domains. The top-level domain provider for com, .net, and .name has now killed its proposed Anti-Abuse Domain Use Policy, an ICANN spokesman confirmed. The ICANN website today lists the proposal as "withdrawn."

VeriSign was unavailable for comment at the time of this posting.

In a request submitted to ICANN this week, VeriSign had proposed a new domain-suspension policy that would "facilitate takedown of malicious sites," as well as a new, free, and optional malware-scanning service for its domain registrars to help them identify malware in their domains.

Domain providers and registrars are increasingly under pressure to weed out malicious domains that support botnets and other cybercriminal activities. Microsoft early last year secured a federal court order that basically required VeriSign to shut down 277 .com domains that were serving as the connections between the massive Waledac spamming botnet's command-and-control servers. The move was unprecedented, and helped streamline the process of dismantling the botnet in a sneak attack by Microsoft, VeriSign, Shadowserver, the University of Washington, and a group of researchers from Germany and Austria who previously had infiltrated the botnet.

Shutting down the domains of Waledac, which had amassed some 60,000 to 80,000 bots, provided a precedent for botnet-fighters to take down other botnets, security experts said at the time. But the court-order process can waste precious time in a surprise-attack takedown, and bypassing that step could help streamline the process of knocking cybercriminal operations offline.

"All parts of the internet community are feeling the pressure to be more proactive in dealing with malicious activity. ICANN has recognized this and the new gTLD Applicant Guidebook requires new gTLDs to adopt a clear definition of rapid takedown or suspension systems that will be implemented. To address concerns over malware, Verisign is seeking to (i) provide a malware scanning service to assist registrars in identifying legitimate sites that have been infected and (ii) establish an anti-abuse policy to facilitate the takedown of abusive non-legitimate sites," VeriSign's now-defunct proposal said.

VeriSign wanted to be able to deny, cancel, or transfer any domain registration or transaction, and to put any domain name on hold or another suspended status for various purposes, including "to protect the integrity, security and stability of the DNS; to comply with any applicable court orders, laws, government rules or requirements, requests of law enforcement or other governmental or quasi-governmental agency, or any dispute resolution process; to avoid any liability, civil or criminal, on the part of Verisign, as well as its affiliates, subsidiaries, officers, directors, and employees," as well as for any malware issues, according to the document.

It was unclear whether legitimate sites could inadvertently be shut down if they were unknowingly harboring malware. But VeriSign had said it would offer a protest process for legitimate website owners who feel their sites was incorrectly suspended, and notes that "various" law enforcement officials "have validated" its proposed plan for stemming domain-name abuse.

"VeriSign is sort of between a rock and a hard place. The DNS is the most stable namespace in the world, making it attractive for the entire spectrum of users. Where is the line drawn? Wherever that is, VeriSign would probably prefer not to get sued over it," said researcher and DNS security expert Dan Kaminsky of the proposal, before it was withdrawn.

A copy of VeriSign's now defunct-proposal to ICANN is available here (PDF).

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.