Don, there is no such thing as IDN at .RU - only ascii allowed - we understood the problem long time ago due to similarity of many Cyrillic letters with Latin. In IDN .РФ in Russia only Cyrillic allowed. This definitely must be the rule for registries. Or some kind of immediate mitigation service to bring down dangerous domains. --andrei 2017-04-26 11:34 GMT+03:00 Don Hollander <don.hollander@icann.org>:

Hi Andrei:

What about at the ccTLD? idn.ru? Does .ru also allow ASCII?

Does the .ru registry, for example, do anything to address homoglyphs between ascii and cyrillic?

D

On 26/04/2017, at 8:30 PM, Andrei Kolesnikov <andrei@rol.ru> wrote:

most use of idn.ascii gTLD as far as I know is .com for example http://путин.com/[xn--h1akeme.com] <https://urldefense.proofpoint.com/v2/url?u=http-3A__xn-2D-2Dh1akeme.com_&d=D...> Basically most of the confusing cases discussed above are from .com

--andrei

2017-04-26 10:35 GMT+03:00 Dr. AJAY D A T A <ajay@data.in>:

...

Hello Don,

Which all registries are allowed to register mix of scripts domain while registering an IDN. I checked .pyc (Cyrillic) and .भारत (Devanagiri) do not allow mix of scripts. I think we address those registries through ICANN by modifying the registry agreement, major problem can be solved.

Thanks.

*Dr. Ajay DATA* * | Founder & CEO * Get email id like *अजय@डाटा.भारत* in your own language, visit www.xgenplus.com[xgenplus.com] <https://urldefense.proofpoint.com/v2/url?u=http-3A__www.xgenplus.com_&d=DwMF...>

------------------------------ *From:* "Tan Tanaka,Dennis via UA-discuss" <ua-discuss@icann.org> MailId : [68456683] *To:* Don Hollander <don.hollander@icann.org>,"ua-discuss@icann.org" < ua-discuss@icann.org> *Subject: *Re: [UA-discuss] UASG Response to WordFence IDN Phishing concerns *Date:* 25 Apr 2017 06:28:22 PM

Don, my comments enclosed

Thanks

-Dennis

*From: *<ua-discuss-bounces@icann.org> on behalf of Don Hollander < don.hollander@icann.org> *Date: *Monday, April 24, 2017 at 5:40 PM *To: *"UA-discuss@icann.org" <ua-discuss@icann.org> *Subject: *[EXTERNAL] [UA-discuss] UASG Response to WordFence IDN Phishing concerns

Further to recent discussion on this list, we have drafted a document that we plan on posting as a Blog Post to the UASG Web site that can be referenced by others.

We want to get feedback from the community on this document by Thursday UTC.

So, here it is – pasted below and as a word document in case you want to enable tracking and make amendments. If you have comments or suggestions, please share them to this group.

Don

*IDNs and Phishing: What You Need to Know*

By TBD at UASG

Internationalized Domain Names[icann.org] <https://urldefense.proofpoint.com/v2/url?u=https-3A__www.icann.org_resources...> (IDNs) are growing in popularity, a testament to their role in the expansion of the global Internet and the value they provide in connecting non-English speakers to the Web. However, you may have noticed a renewed focus over the past week of a script mixing technique that phishing scammers could potentially use to trick Internet users into visiting malicious websites. This phishing method takes advantage of the fact that characters from various languages and scripts are sometimes visually similar to each other. For example, the Cyrillic “а” and the ASCII[en.wikipedia.org] <https://urldefense.proofpoint.com/v2/url?u=https-3A__en.wikipedia.org_wiki_A...> “a” look virtually identical. This technique is known as a homograph attack.

Homographic phishing efforts associated with IDNs are not new. In fact, they date back to the early 2000s. Registries have since implemented policies that preclude mixing scripts[1] within a domain name label.

While this issue should be taken seriously and serves as an important reminder of consumer safety, various IDN and anti-abuse groups are actively working to mitigate potential threats, and there are already certain browser-set protections in place. In the meantime, Internet users should practice the same basic security hygiene that is always recommended: avoid clicking suspicious links, and use a good password manager that will only enter login credentials on trusted sites.

Equally important is to recognize the benefits of IDNs and avoid disabling them, which could lead to an unpredictable user experience and eventually a decrease in adoption. IDNs are essential in bringing non-English speakers – the majority of the world’s population – online, and allowing those users to create their own highly relevant online identities as well as navigate the Internet in their native languages. In addition to the social and cultural benefits of IDNs, they also represent a significant economic opportunity; a recent report[uasg.tech] <https://urldefense.proofpoint.com/v2/url?u=https-3A__uasg.tech_whitepaper_&d...> commissioned by the Universal Acceptance Steering Group (UASG) found that online spending from new IDN users could start at USD 6.2 billion per year.

The UASG’s mission is to help software developers and website owners keep pace with the evolving Domain Name System (DNS) – and this includes issues around the adoption and acceptance of IDNs. If you’d like to get involved in helping work toward a solution to this and other IDN-related issues, please visit https://uasg.tech/[uasg.tech] <https://urldefense.proofpoint.com/v2/url?u=https-3A__uasg.tech_&d=DwMFaQ&c=F...> or get in touch[uasg.tech] <https://urldefense.proofpoint.com/v2/url?u=https-3A__uasg.tech_contact_&d=Dw...> to learn more.

------------------------------

------------------------------

[1] Exceptions are practiced for languages with established orthographies and conventions that require the commingled use of multiple scripts, e.g. the Japanese writing system.

Do not Remove: [HID]20170425182821379[-HID]

-- Andrey Kolesnikov RIPN.NET[RIPN.NET] <https://urldefense.proofpoint.com/v2/url?u=http-3A__RIPN.NET&d=DwMFaQ&c=FmY1...>

Don Hollander Universal Acceptance Steering Group Skype: don_hollander

-- Andrey Kolesnikov RIPN.NET

Dear all, To properly address and explain this problem. The nature of this attacks on a global level suggest that they will be done through most used gTLDs (old and new) who allows different scripts, which is by far> .com. For local level it can be done under ccTLDs and geoTLDs who allows different script. Now, the real picture, Don, is that we have a lot of registries who mix scripts in the table. You can look at IANA tables and see what is there. One example is .SU which allows all Cyrillic scripts from ex-Soviet Union (USSR). Then, there are ccTLDs like .PL, mixing the whole Unicode for years. I can understand why some ccTLDs allow that: in countries, there are a lot of minorities, so excluding their script from the table of national ccTLDs is not politically correct. To know if those cc’s allows usage of different (or even mixing) scripts and the attack can be created, we need to check local rules – and they are NOT something that ICANN is aware off, or something that ICANN can easily change. Even rules for the root zone, which are mentioned during this discussion, for the cc’s they will be presented in the form of recommendation. Some countries like Bulgaria and Greece, have IDN and ASCII under the same table and they have national laws on their usage. But, even in countries like Croatia and Romania, usage of their own Latin script can produce some of homographic attack. Like> coca-cola.hr and coča-cola.hr (confusion). Homographic attack is not a problem only in usage of different script under one TLD – they can be done under one, f.e. Latin, script also. Andrei suggested one way to address problem, but it can’t be the rule, because of political and other logical questions inside the countries. It’s in the ruleset of every single registry – who allows mixing script or not. You can have 20 different scripts in table, if you strictly avoid mixing, you are ok – and cross script homographic attack are not possible. But, single script attacks are staying possible, such as IBM.рф or саре.рф. If you want to change agreement with cc’s, in order to address their rules for registration, is not going to be easy task for ICANN, because of the nature of agreements. Some of them are just in the form of „exchange of letters“ and zou know which level of agreement is that. Regards, Dusan From: ua-discuss-bounces@icann.org [mailto:ua-discuss-bounces@icann.org] On Behalf Of Andrei Kolesnikov Sent: Wednesday, April 26, 2017 10:46 AM To: Don Hollander <don.hollander@icann.org> Cc: Dr. AJAY D A T A <ajay@data.in>; `tan tanakadennis via ua-discuss` <ua-discuss@icann.org> Subject: Re: [UA-discuss] UASG Response to WordFence IDN Phishing concerns Don, there is no such thing as IDN at .RU - only ascii allowed - we understood the problem long time ago due to similarity of many Cyrillic letters with Latin. In IDN .РФ in Russia only Cyrillic allowed. This definitely must be the rule for registries. Or some kind of immediate mitigation service to bring down dangerous domains. --andrei 2017-04-26 11:34 GMT+03:00 Don Hollander <don.hollander@icann.org <mailto:don.hollander@icann.org> >: Hi Andrei: What about at the ccTLD? idn.ru <http://idn.ru/> ? Does .ru also allow ASCII? Does the .ru registry, for example, do anything to address homoglyphs between ascii and cyrillic? D On 26/04/2017, at 8:30 PM, Andrei Kolesnikov <andrei@rol.ru <mailto:andrei@rol.ru> > wrote: most use of idn.ascii gTLD as far as I know is .com for example http://путин.com/[xn--h1akeme.com] <https://urldefense.proofpoint.com/v2/url?u=http-3A__xn-2D-2Dh1akeme.com_&d=D...> Basically most of the confusing cases discussed above are from .com --andrei 2017-04-26 10:35 GMT+03:00 Dr. AJAY D A T A <ajay@data.in <mailto:ajay@data.in> >: Hello Don, Which all registries are allowed to register mix of scripts domain while registering an IDN. I checked .pyc (Cyrillic) and .भारत (Devanagiri) do not allow mix of scripts. I think we address those registries through ICANN by modifying the registry agreement, major problem can be solved. Thanks. Dr. Ajay DATA | Founder & CEO Get email id like <mailto:???@????.????> अजय@डाटा.भारत in your own language, visit <https://urldefense.proofpoint.com/v2/url?u=http-3A__www.xgenplus.com_&d=DwMF...> www.xgenplus.com[xgenplus.com] _____ From: "Tan Tanaka,Dennis via UA-discuss" <ua-discuss@icann.org <mailto:ua-discuss@icann.org> > MailId : [68456683] To: Don Hollander <don.hollander@icann.org <mailto:don.hollander@icann.org> >,"ua-discuss@icann.org <mailto:ua-discuss@icann.org> " <ua-discuss@icann.org <mailto:ua-discuss@icann.org> > Subject: Re: [UA-discuss] UASG Response to WordFence IDN Phishing concerns Date: 25 Apr 2017 06:28:22 PM Don, my comments enclosed Thanks -Dennis From: <ua-discuss-bounces@icann.org <mailto:ua-discuss-bounces@icann.org> > on behalf of Don Hollander <don.hollander@icann.org <mailto:don.hollander@icann.org> > Date: Monday, April 24, 2017 at 5:40 PM To: "UA-discuss@icann.org <mailto:UA-discuss@icann.org> " <ua-discuss@icann.org <mailto:ua-discuss@icann.org> > Subject: [EXTERNAL] [UA-discuss] UASG Response to WordFence IDN Phishing concerns Further to recent discussion on this list, we have drafted a document that we plan on posting as a Blog Post to the UASG Web site that can be referenced by others. We want to get feedback from the community on this document by Thursday UTC. So, here it is – pasted below and as a word document in case you want to enable tracking and make amendments. If you have comments or suggestions, please share them to this group. Don IDNs and Phishing: What You Need to Know By TBD at UASG <https://urldefense.proofpoint.com/v2/url?u=https-3A__www.icann.org_resources...> Internationalized Domain Names[icann.org] (IDNs) are growing in popularity, a testament to their role in the expansion of the global Internet and the value they provide in connecting non-English speakers to the Web. However, you may have noticed a renewed focus over the past week of a script mixing technique that phishing scammers could potentially use to trick Internet users into visiting malicious websites. This phishing method takes advantage of the fact that characters from various languages and scripts are sometimes visually similar to each other. For example, the Cyrillic “а” and the <https://urldefense.proofpoint.com/v2/url?u=https-3A__en.wikipedia.org_wiki_A...> ASCII[en.wikipedia.org] “a” look virtually identical. This technique is known as a homograph attack. Homographic phishing efforts associated with IDNs are not new. In fact, they date back to the early 2000s. Registries have since implemented policies that preclude mixing scripts[1] within a domain name label. While this issue should be taken seriously and serves as an important reminder of consumer safety, various IDN and anti-abuse groups are actively working to mitigate potential threats, and there are already certain browser-set protections in place. In the meantime, Internet users should practice the same basic security hygiene that is always recommended: avoid clicking suspicious links, and use a good password manager that will only enter login credentials on trusted sites. Equally important is to recognize the benefits of IDNs and avoid disabling them, which could lead to an unpredictable user experience and eventually a decrease in adoption. IDNs are essential in bringing non-English speakers – the majority of the world’s population – online, and allowing those users to create their own highly relevant online identities as well as navigate the Internet in their native languages. In addition to the social and cultural benefits of IDNs, they also represent a significant economic opportunity; a recent <https://urldefense.proofpoint.com/v2/url?u=https-3A__uasg.tech_whitepaper_&d...> report[uasg.tech] commissioned by the Universal Acceptance Steering Group (UASG) found that online spending from new IDN users could start at USD 6.2 billion per year. The UASG’s mission is to help software developers and website owners keep pace with the evolving Domain Name System (DNS) – and this includes issues around the adoption and acceptance of IDNs. If you’d like to get involved in helping work toward a solution to this and other IDN-related issues, please visit <https://urldefense.proofpoint.com/v2/url?u=https-3A__uasg.tech_&d=DwMFaQ&c=F...> https://uasg.tech/[uasg.tech] or <https://urldefense.proofpoint.com/v2/url?u=https-3A__uasg.tech_contact_&d=Dw...> get in touch[uasg.tech] to learn more. _____ _____ [1] Exceptions are practiced for languages with established orthographies and conventions that require the commingled use of multiple scripts, e.g. the Japanese writing system. Do not Remove: [HID]20170425182821379[-HID] <https://data.in/XGenPlusMessageID:14931921150881741a-> <http://dlr.tbms.in:8077/XET21201:201704.jpg> -- Andrey Kolesnikov RIPN.NET[RIPN.NET] <https://urldefense.proofpoint.com/v2/url?u=http-3A__RIPN.NET&d=DwMFaQ&c=FmY1...> Don Hollander Universal Acceptance Steering Group Skype: don_hollander -- Andrey Kolesnikov RIPN.NET <http://RIPN.NET> --- This email has been checked for viruses by Avast antivirus software. https://www.avast.com/antivirus

Il 26 aprile 2017 alle 11.50 Dusan Stojicevic <dusan@dukes.in.rs> ha scritto:

If you want to change agreement with cc’s, in order to address their rules for registration, is not going to be easy task for ICANN, because of the nature of agreements. Some of them are just in the form of „exchange of letters“ and zou know which level of agreement is that.

I really think that we are spending lots of energies on a non-problem here. If ICANN develops some good best practices/rules and pushes them to the gTLD registries, over which it has full regulatory powers, then these practices will naturally become the reference for everyone and I am sure that most ccTLDs which are affected by the problem will just voluntarily adopt them as well. Also, most if not all of the potential phishing attempts will be focused on .com domains, because that is where most global businesses and paid services are, so fixing the .com namespace is the first and foremost issue and would already prevent the majority of the risks. Other big ccTLDs will just follow, and anyway often they disallow the Cyrillic script altogether, as Cyrillic is not used in their country; and the ccTLDs for countries where Cyrillic is a national script have already been dealing with this issue for a long time anyway, so they're possibly well prepared already. Regards, -- Vittorio Bertola Research & Innovation Engineer Cell: +39 348 7015022 Skype: in-skype-ox@bertola.eu Email: vittorio.bertola@open-xchange.com mailto:vittorio.bertola@open-xchange.com Twitter: @openexchange http://twitter.com/openexchange - Facebook: OpenXchange https://www.facebook.com/OpenXchange - Web: www.open-xchange.com http://www.open-xchange.com Open-Xchange AG, Rollnerstr. 14, 90408 Nuremberg, District Court Nuremberg HRB 24738 Managing Board: Rafael Laguna de la Vera, Carsten Dirks, Uwe Reumuth Chairman of the Board: Richard Seibt European Office: Open-Xchange GmbH, Olper Huette 5f, D-57462 Olpe, Germany, District Court Siegen, HRB 8718 Managing Directors: Frank Hoberg, Martin Kauss US Office: Open-Xchange. Inc., 530 Lytton Avenue, Palo Alto, CA 94301, USA Confidentiality Warning: This message and any attachments are intended only for the use of the intended recipient(s), are confidential, and may be privileged. If you are not the intended recipient, you are hereby notified that any review, retransmission, conversion to hard copy, copying, circulation or other use of this message and any attachments is strictly prohibited. If you are not the intended recipient, please notify the sender immediately by return e-mail, and delete this message and any attachments from your system.

On 4/26/2017 6:07 AM, Maxim Alzoba wrote:

Dear Vittorio,

if you read public comments to LGRs ICANN invented, you will see that those rules are not so wise.

(Unfortunately they try to create rules where nobody needed it sometimes, and also not always use business practices - for example for Japanese LGRs https://forum.icann.org/lists/comments-japanese-lgr-second-level-27jan17/ )

As someone involved in this particular project, I would have a slightly different perspective... A./

Sincerely Yours,

Maxim Alzoba Special projects manager, International Relations Department, FAITID

m. +7 916 6761580(+whatsapp) skype oldfrogger

Current UTC offset: +3.00 (.Moscow)

...

On Apr 26, 2017, at 15:37, Vittorio Bertola <vittorio.bertola@open-xchange.com <mailto:vittorio.bertola@open-xchange.com>> wrote:

...

Il 26 aprile 2017 alle 11.50 Dusan Stojicevic <dusan@dukes.in.rs <mailto:dusan@dukes.in.rs>> ha scritto:

If you want to change agreement with cc’s, in order to address their rules for registration, is not going to be easy task for ICANN, because of the nature of agreements. Some of them are just in the form of „exchange of letters“ and zou know which level of agreement is that.

I really think that we are spending lots of energies on a non-problem here. If ICANN develops some good best practices/rules and pushes them to the gTLD registries, over which it has full regulatory powers, then these practices will naturally become the reference for everyone and I am sure that most ccTLDs which are affected by the problem will just voluntarily adopt them as well.

Also, most if not all of the potential phishing attempts will be focused on .com domains, because that is where most global businesses and paid services are, so fixing the .com namespace is the first and foremost issue and would already prevent the majority of the risks.

Other big ccTLDs will just follow, and anyway often they disallow the Cyrillic script altogether, as Cyrillic is not used in their country; and the ccTLDs for countries where Cyrillic is a national script have already been dealing with this issue for a long time anyway, so they're possibly well prepared already.

Regards,

--

*Vittorio Bertola* Research & Innovation Engineer

Cell: +39 348 7015022 Skype: in-skype-ox@bertola.eu <mailto:in-skype-ox@bertola.eu> Email: vittorio.bertola@open-xchange.com <mailto:vittorio.bertola@open-xchange.com>

Twitter: @openexchange <http://twitter.com/openexchange> - Facebook: OpenXchange <https://www.facebook.com/OpenXchange> - Web: www.open-xchange.com <http://www.open-xchange.com/> Open-Xchange AG, Rollnerstr. 14, 90408 Nuremberg, District Court Nuremberg HRB 24738 Managing Board: Rafael Laguna de la Vera, Carsten Dirks, Uwe Reumuth Chairman of the Board: Richard Seibt

European Office: Open-Xchange GmbH, Olper Huette 5f, D-57462 Olpe, Germany, District Court Siegen, HRB 8718 Managing Directors: Frank Hoberg, Martin Kauss

US Office: Open-Xchange. Inc., 530 Lytton Avenue, Palo Alto, CA 94301, USA Confidentiality Warning: This message and any attachments are intended only for the use of the intended recipient(s), are confidential, and may be privileged. If you are not the intended recipient, you are hereby notified that any review, retransmission, conversion to hard copy, copying, circulation or other use of this message and any attachments is strictly prohibited. If you are not the intended recipient, please notify the sender immediately by return e-mail, and delete this message and any attachments from your system.