Minutes of the 2022-12-14 IAB Technical Discussion and Business Meeting

1. Administrivia

1.1. Attendance

Present:

Jari Arkko
Deborah Brungard
Liz Flynn (IETF Secretariat)
Wes Hardaker
Mirja Kühlewind (IAB Chair)
Warren Kumari (IESG Liaison)
Cindy Morgan (IAB Executive Administrative Manager)
Karen O’Donoghue (ISOC Liaison)
Colin Perkins (IRTF Chair)
Sabrina Tanamal (IANA Liaison)
Qin Wu
Jiankang Yao

Regrets:

Lars Eggert (IETF Chair)
Cullen Jennings
Mallory Knodel
Zhenbin Li
Tommy Pauly
David Schinazi
Russ White

Guest:

Audrey Randall

Observers:

None

1.2. Agenda bash and announcements

No new items were added to the agenda.

2. Technical Discussion: The Challenges of Blockchain-Based Naming Systems for Malware Defenders

Audrey Randall, a PhD candidate at University of California San Diego (UCSD), joined the IAB to discuss her work on “The Challenges of Blockchain-Based Naming Systems for Malware Defenders.”

A naming layer is required for C2 servers to issue commands and coordinate bots. Without a naming layer, infected hosts get stranded, but with a naming layer, malware can contact C2.

C2 naming systems are desirable because it is difficult to censor individual names, as there is no central authority with takedown capabilities, and it is costly to take down the entire system. The system must be useful to legitimate users, and takedown would create collateral damage.

Blockchain Naming System (BNS) is a distributed, append-only data store. Every piece of data that is stored in the blockchain is replicated across every computer that runs the blockchain.

To compare DNS versus BNS as C2 naming systems:

• DNS:
  • Critical. Never blocked wholesale.
  • Subject to hierarchy of authorities
    • Registrars
    • Registries
  • Vulnerable to takedowns
  • A single legal entity can perform an intervention.
• BNS:
  • No central authority.
    • Cannot take down record without its private key.
  • Growing blockchain popularity.
    • Blocking access -> collateral damage.
  • Already used by malware in the wild.

BNS comes in two categories:

• BNS built on naming-specific blockchains
  • Namecoin
  • Handshake
  • Emercoin
• BNS built on general-purpose blockchains
  • Ethereum Name Service
  • Unstoppable Domains

BNS names use alternate TLDs that cannot be resolved by DNS. Instead, resolution requires proxies, browser extensions, and/or built-in browser support. There are namespace collisions in alternate roots: .music is an alt-TLD that was bought by a Handshake customer, but .music was later introduced by ICANN as a TLD. There is also no coordination between different BNSes. Unstoppable Domains removed support for .coin, which collides with Emerson. Handshake’s .wallet collides with Unstoppable Domains.

Looking at whether ecosystem bottlenecks exist where interventions might be possible, there are three possible types of interventions:

• Blocklist: Request must cross a machine with the capability and willingness to implement a blocklist.
• Temporary Restraining Order (TRO): Grants legal authority to order intermediaries (registrar, proxies) to deny service to customer.
• Host Seizure: Physical seizure or Storage Communications Act warrant to shut down and image the device.

Audrey Randall’s research looked at which BNS systems are optimal for malware:

• Handshake: Actual use (abuse or otherwise) is negligible.
  • 51.1% no records
  • 48.7% invalid names
  • 0.14% any valid record at all
• Namecoin/Emercoin: Abuse is rampant, but legitimate use is very low.
• ENS/Unstoppable Domains: General-purpose blockchain naming systems are not DNS replacements.
  • Records mostly used to store wallet addresses or usernames, not websites.

General-purpose chains have higher licit adoption, so there is more collateral damage if defenders take it down. However, they have not been adopted for malware purposes because general-purpose BNS is too expensive. Names are $10 minimum, and transaction (“gas”) fees can be $10-$140. Naming-specific BNSes are cheap, relative to DNS. Malware operators won’t make the swap to a more dangerous BNS (from a defender’s persepctive) until the price becomes worthwhile, which will only be if we make naming-specific BNS and DNS unviable.

Prior interventions that worked include:

• OpenNIC (alternate root) ceases supporting .bit
  • Spamhaus, Malwarebytes blocklisted OpenNIC resolvers.
  • Community voted to remove .bit support.
• “Blockchain-DNS.info” proxy takedown
  • Some proxy endpoints sinkholed, more blocklisted by Spamhaus.
  • Proxy moved to a bulletproof provider, but is now entirely defunct.

Audrey Randall concluded that BNS is not an insurmountable threat. Centralized chokepoints still exist. The low licit use of Namecoin/Emercoin means that they can be blocked entirely. There is high licit adoption but low malicious use of Handshake, ENS, and Unstoppable Domains, and they are unlikely to be adopted for malware unless their fees decrease. BNS must become widely adopted to become dangerous; name management must be easy, transaction fees must be low, and browsers must adopt the BNS system natively.

Mirja Kühlewind said that she thinks name-based blocking isn’t a good idea because it is the same technique used for censorship.

Audrey Randall replied that blocklists are often not effective and can be used for censorship, but the relevant point is that using them does not put us into a different situation than we are already in for DNS. There are a lot of challenges, but they have been effective in the past.

Mirja Kühlewind agreed that they can be effective, but there are ways to circumvent them.

Wes Hardaker said that the notion everyone seems to agree on is that the best thing to do is increase the costs for bad actors. You cannot always stop them, but you can force them to keep moving to make things more difficult for them.

The IAB thanked Audrey Randall for her presentation.

3. Monthly Reports

3.1. IANA Liaison Report

–Begin IANA Liaison Report, Sabrina Tanamal–

IANA Services Liaison Report – 14 December 2022

SLA Deliverables Update:

ICANN met 100% of processing goal times for the November 2022 monthly 
statistics report, exceeding the SLA goal to meet 90% of processing goal 
times. These times include the steps that ICANN has control over and not 
time it is waiting on requesters, document authors or other experts. 
Monthly reports can be found at:

https://www.iana.org/performance/ietf-statistics

Other News:

The IETF-IANA Group Meeting minutes from 8 November will be available in 
the next IANA Services Liaison report.

–End IANA Liaison Report, Sabrina Tanamal–

3.2. IRTF Chair Report

–Begin IRTF Chair Report, Colin Perkins–

IRTF Chair report to the IAB for the month ending 14 December 2022.

Research Groups

The charter for the proposed research group on Usable Formal Methods is 
in IRSG review, and should be ready for IAB review and approval shortly. 
Working with the proponents of the proposed research group on Research 
and Analysis of Internet Standards Processes to revise the charter in 
the light of IRSG feedback.

ICCRG is completing a charter revision.

ANRP

Nominations for ANRP 2023 closed on 18 November 2022. There were 65 
nominations received. The review process is under way, with decisions to 
be announced in early January.

ANRW

Nothing to report

Documents and Errata

Waiting for IRTF Chair:

draft-irtf-cfrg-voprf-16
draft-irtf-pearg-censorship-06
 * Revised I-D Needed
draft-irtf-panrg-path-properties-06
 * Revised I-D Needed
draft-irtf-icnrg-ccnx-timetlv-01
 * Revised I-D Needed

Awaiting IRSG Reviews:

(None)

IRSG Review:

draft-irtf-hrpc-guidelines-16
draft-irtf-icnrg-icnping-07
draft-irtf-icnrg-icntraceroute-07
draft-irtf-t2trg-iot-edge-07

In IRSG Poll:

draft-irtf-nwcrg-bats-06
draft-irtf-nwcrg-tetrys-04

In IESG Review:

draft-irtf-pearg-numeric-ids-history
 * Recently updated to address review comments
draft-irtf-pearg-numeric-ids-generation
 * Recently updated to address review comments

Sent to the RFC Editor:

draft-irtf-cfrg-spake2-26
 * Holding for references
draft-irtf-cfrg-vrf-15
 * Holding for references
draft-irtf-cfrg-hash-to-curve-16
draft-irtf-icnrg-ccninfo-13
draft-irtf-qirg-principles-11

Other Activities

Working with the secretariat confirm the available funds for IETF 116 
diversity travel grants. Call for applications to be announced shortly.

–End IRTF Chair Report, Colin Perkins–

4. Meeting Minutes

The following meeting minutes were approved:

• 2022-11-10 business meeting (Thursday IETF 115)

The following meeting minutes remain under review:

• 2022-12-07 business meeting

5. Action Item Review

Done:

• 2022-12-07: Cindy Morgan to send draft-iab-protocol-maintenance out for community review, including the edm list.
• 2022-12-07: Cindy Morgan to send a call for volunteers for the 3GPP liaison manager position.
• 2022-12-07: Cindy Morgan to send a call for volunteers for the IEEE 802.1 liaison manager position.
• 2022-12-07: Cindy Morgan to send an announcement about the ICANN Technical Liaison Group appointment.
• 2022-12-07: Wes Hardaker to find out if his co-author on “The Challenges of Blockchain-Based Naming Systems for Malware
  Defenders” is available for a technical discussion at the 2022-12-14 IAB meeting.

In Progress:

• 2022-06-15: Mirja Kühlewind to check with Robert Sparks/Tools Team on how to document the proposed changes to the liaison tool and approval process.
• 2022-09-07: Mallory Knodel to work with Mark Nottingham on an update to draft-nottingham-avoiding-internet-centralization and
  bring it back to the IAB to discuss adoption.
• 2022-07-24: Mallory Knodel and Mirja Kühlewind to draft a document outlining the architectural principles that the IAB thinks are important and need to be understood when considering Internet governance.
• 2022-05-20: Cullen Jennings to look into a possible IAB Technical Discussion on Internet user identity in Internet communications applications.
• 2022-11-23: Liaison Coordinators to add information about potential candidates to reach out to for future IAB-appointed positions to the private IAB wiki.
• 2021-11-17: Mirja Kühlewind and Cindy Morgan to put together some options for the IAB Website revamp for the IAB to review.
• 2022-12-07: Cindy Morgan to follow up on setting up email aliases for each liaising organization.
• 2022-11-06: Jari Arkko to update draft-arkko-iab-data-minimization-principle based on the IAB discussion at IETF 115.
• 2022-12-07: Cindy Morgan to send a message to arch-d list about possible adoption of draft-arkko-iab-data-minimization-principle once Jari Arkko updates the document and confirms that the message is ready to go.
• 2022-12-07: Cindy Morgan to send draft-iab-path-signals-collaboration to the RFC Editor pending a new revision from the authors.

New:

• 2022-12-14: Cindy Morgan to send a call for feedback on the IRTF Chair.

6. IAB Document Status Update

Datatracker: https://datatracker.ietf.org/stream/iab/

• draft-arkko-iab-data-minimization-principle-03
  I-D Exists, IAB stream
  IAB Shepherd: Mirja Kühlewind
• draft-iab-path-signals-collaboration-02
  IAB Review: Informational
  IAB Shepherd: N/A
• draft-iab-protocol-maintenance-10
  Community Review (ends 2023-01-04)
  IAB Shepherd: Tommy Pauly
• draft-kpw-iab-privacy-partitioning-00
  Active IAB Document
  IAB Shepherd: David Schinazi

7. WG Chartering in Progress (Initial Charters Only)

Datatracker: https://datatracker.ietf.org/group/chartering/

• Application-aware Networking (APN)
  Internal Review (Initial Chartering)
• More Instant Messaging Interoperability (MIMI)
  Internal Review (Initial Chartering)
  IESG Telechat: 2022-12-15
  IAB Reviewer: David Schinazi

8. Next IAB Meeting

The next IAB meeting will on on 2023-01-11 at 0700 PST.

9. Executive Session: IRTF Chair Appointment

The IAB discussed the IRTF Chair appointment in an executive session. Cindy Morgan will send a call for feedback on the IRTF Chair.