►
From YouTube: IETF115-IRTFOPEN-20221109-0930
Description
IRTFOPEN meeting session at IETF115
2022/11/09 0930
https://datatracker.ietf.org/meeting/115/proceedings/
A
A
A
A
A
A
A
A
A
A
A
A
The
irtf
follows
the
iitf's
intellectual
property
rights,
disclosure
rules
and,
as
a
result,
when
you're
participating
in
this
meeting,
you
must
disclose
a
reminder
that
you
must
disclose
any
patents
or
patent
applications
that
are
owned
or
controlled
by
yourself
or
your
sponsor
and
in
the
in
the
iotf.
We
we
we
expect
such
disclosures
to
be
filed
in
a
timely
manner,
a
period
of
days
or
weeks
rather
than
months,
and
the
slide
has
the
references
to
the
the
full
details
of
this
policy.
A
A
A
Foreign,
if
you
are
here
in
the
room,
please
do
scan
the
QR
code
on
the
screen
and
sign
in
using
the
meteco
light
tool
and
that
will
record
record
your
attendance
and
allow
us
to
size
the
rooms
appropriately
in
future.
If
you're
attending
remotely.
Please
make
sure
your
audio
and
your
video
are
off
unless
you're
explicitly
asking
a
question.
A
A
Final
reminder,
as
a
covered
safety
measure,
the
in-person
participants
in
this
meeting
and
in
in
the
other
ATF
controlled
rooms
are
required
to
wear
ffp2
and
95
masks,
with
the
exception
of
the
chairs
of
the
meeting
and
the
presenters
who
are
standing
at
the
front
and
actively
speaking
I
think
for
this
meeting,
it
is
also
permitted
to
remove
your
your
mask
briefly,
while
asking
questions
from
the
microphones.
If
everyone
in
the
audience,
you
are
required
to
wear
your
mask
at
all
times,.
A
All
right,
so
the
the
goals
of
the
irtf-
and
this
is
an
irtf
session,
rather
than
an
ietf
session,
the
goals
of
the
IIT
effort
to
focus
on
some
of
the
longer
term
research
issues.
We're
here
to
think
about
where
things
might
be
going
to
discuss.
Some
of
the
the
the
bigger
picture
issues
that
the
longer
term
issues,
perhaps
there's
a
way
of
feeding
into
the
standards
process
that
the
ATF
is
doing,
perhaps
as
a
way
of
for
the
research
Community
to
learn
from
the
standards
process.
In.
D
B
A
The
irtf
is
a
research
organization,
we
don't
develop
standards
and,
as
a
result,
while
we
can
publish
informational
or
an
experimental
rfcs.
The
primary
research
outputs
from
the
the
and
the
primary
outputs
from
the
irtf
tend
to
be
more
in
the
form
of
research
papers
than
in
the
form
of
rfcs
action.
A
Iitf
is
organized
as
a
number
of
research
groups
the
the
slide
here,
though,
those
in
light,
blue
or
gray
or
even
not
meeting
or
have
already
met
the
ones
highlighted
in
dark
blue
here,
the
pathway,
networking
research
group,
the
Privacy
enhancements
and
assessments
group,
the
measurement
and
Analysis
of
protocols
group
and
the
human
rights
protocol
considerations
group
are
still
to
meet
later
this
week.
So
please
do
consider
going
to
their
meetings.
A
A
In
addition,
we
have
a
couple
of
side
meetings
tomorrow
which
are
discussing
work
which
might
form
potential
new
research
groups,
and
you
may
have
seen
some
some
email
I
sent
to
the
attendees
list
and
to
the
ITF
discussion
list.
We've
got
a
site
meeting
tomorrow
lunchtime
in
the
Richmond
six
room
and
that
room
has
changed
from
the
initial
announcement,
which
will
be
looking
at
usable,
formal
methods
and
there's
there's
been
a
number
of
people.
Who've
contacted
me
expressing
interest
in
this,
so
I
think
we.
A
Another
meeting,
which
is
happening
at
I,
think
3
30
tomorrow
in
mezzanine
12,
is
a
potential.
A
meeting
to
discuss
a
potential
research
group
into
researching
the
internet
standards
process
and
Neil's
turnover
is
leading
this
effort.
This
follows
on
from
a
workshop.
The
internet
architecture
board
organized
I
think
it
was
late
last
year
where
a
number
of
people
were
exploring
the
data.
A
A
A
In
the
four
years,
I've
been
irtf
chair
and
we've
published
five
rfcs
in
the
last
cycle,
a
couple
from
the
intent-based
networking
research
group,
looking
at
intent,
classification
and
Concepts,
and
definitions
for
intent-based
networking,
a
couple
relating
to
information,
centering
networking,
looking
at
integration
of
ICN
protocols
with
4G
mobile
networks
and
looking
at
the
integration
with
network
coding
protocols
and
another
another
protocol,
looking
at
Network
coding
and
photo
error,
correction
and
its
relation
to
congestion,
control
and
transport.
So
please
do
take
a
look
at
those
rfcs.
B
A
Yeah
I'm
very
pleased
to
announce
that
we
will
have
we'll
be
making
free
applied
networking
research
prize
awards.
Today
these
will
go
to
gotam
umati,
who
is
standing
sitting
at
the
front
here.
He'll
be
talking
about
the
risks
of
domain
hijacking
due
to
register
practices
to
Karen
kef
he'll
be
talking
about
her
ethnographic
work
on
the
itf's
culture
and
so
Daniel.
What
Wagner
he'll
be
talking
about?
Ddos
attack,
detection
and
mitigation.
A
A
A
We
have
a
diversity
travel
grant
program
and
for
the
July
meeting
we
also
have
make
sure
our
grants
available
for
the
applied
networking
research,
Workshop
I
very
much
like
to
thank
the
sponsors
for
the
travel
grant
program,
Akamai,
Comcast,
cloudflare
and
Netflix.
I
think
this
is
a
fantastic
program.
We've
brought
three
or
four
really
great
people
here
this
time
and
we
we
bring
many
more
people
for
the
applied
networking
research
Workshop
in
the
summer.
A
A
A
A
Name
management:
this
paper
was
originally
published
in
the
ACM
internet
measurement
conference
in
2021.
Good
time
is
a
postdoctoral
researcher
at
Stanford
University.
He
completed
his
PhD
a
few
months
ago
from
UC
San
Diego,
where
he
was
advised
by
Jeffrey,
volcker
and
Stefan
Savage
and
Casey
clafey.
E
A
F
F
Okay,
thank
you.
My
name
is
Gautama
kiwate
and
I'm,
a
postdoctoral
researcher
at
Stanford,
University
and
again.
The
only
reason
that
it
doesn't
make
it
up
on
the
slide
is
because
I
did
this
work.
When
I
was
a
PhD
student
at
UC,
San
Diego
advised
by
Stefan,
Jeff
and
Casey,
who
I'm
told
some
of
you
know
so
at
a
high
level.
F
F
One
of
the
name
servers
ns2.internetemc.com
was
replaced
with
ns2.internet
EMC
random
characters.
That
is
what
was
surprising
about
this
domain.
Was
that
internet
EMC
random
characters
that
Biz
was
not
registered,
which
means
that
an
attacker
could
go
register
this
database
domain
and
be
the
authoritative
name
server
for
a
county
domain
and
the
implications
of
that
were
troubling.
F
F
So,
as
an
example,
here's
an
example
for
yourgadgetnews.com
we
saw
its
name
service,
ns1
and
ns2
known
ub.com,
being
replaced
by
drop.
This
host
string
of
random
characters,
dot
biz
and
again
we
found
ourselves
asking:
why
did
the
name
server
change?
Who
changed
the
name
service,
and
in
this
case,
given
the
large
numbers
we
realized?
It
must
be
something
systemic
like
these
can't
beat
typos
anymore,
and
in
order
to
understand
this
better.
In
order
to
understand
how
these
name
servers
get
changed,
we
first
needed
to
understand
how
these
name
circulars
get
propagated.
F
So
the
registrant
communicates
the
any
name:
server
changes
to
the
registrar
using
this
web
portal
or
an
API
and
the
registrar
in
turn
uses
this
protocol
called
extensible
provisioning
protocol
Epp
to
communicate
these
changes
to
the
registry,
and,
given
that
these
were
large
numbers,
and
given
that
this
was
a
systemic
issues,
we
figured
that
there
must
be
something
amiss
with
Epp
and
also
the
fact
that
we
didn't
understand
anything
about
Epp.
So
what
I'd
like
to
do?
F
So
a
good
place
to
start
is
to
think
of
the
registry
top
level
domain,
DNS
configuration
as
a
database,
so
all
of
the
domain
objects
the
name
service
to
think
of
them
as
a
database,
and
this
database
has
two
sorts
of
objects.
The
first
is
a
domain
object
such
as
food.com,
and
the
second
is
a
host
object
and
every
host
object
that
belongs
to
the
same
top
level
domain
such
as
ns1.food.com
needs
to
have
a
relationship
with
the
domain
object.
F
F
F
We
next
introduced
the
subordinate
host
objects,
ns1
and
ns2.food.com
for
food.com,
which
has
abundant
host
objects
of
food.com
and
ns1.bar.com,
which
is
about
init
host
object
of
power.com.
We
also
show
the
delegated
name
server
relationships,
and
each
of
these
domains
has
two
delegated
name
servers
as
is
required,
and
what
is
the
thing
to
keep
in
mind
here
is
that
bar.com
is,
has
delegated
its
name
service
to
a
host
object
that
is
controlled
by
another
registrar,
and
that
in
itself
is
not
a
problem.
This
happens
all
the
time
designed
for
it
and
everything
works.
F
F
In
order
to
do
that,
EPP
requires
that
the
registrar
first
clean
up
all
of
the
Associated
host
objects.
So
the
register
goes
and
cleans
up
ns1.food.com
without
any
problems,
but,
as
you
can,
some
of
you
might
have
already
anticipated
when
the
register
tries
to
go
and
delete
ns2.food.com.
It
cannot
do
so
because
it
is
being
referenced
by
another
domain
object
and
hence
cannot
be
deleted.
Now.
This
is
a
domain
object
that
is
controlled
by
another
registrar,
and
so
the
register
at
this
point
of
time
has
two
options.
F
The,
and
so
this
is
not
really
an
option
and
Epp
sort
of
foresees
this
and
presents
a
workaround
which
is
to
rename
the
host
object.
So
what
does
this
renaming?
Look
like
what
are
some
of
the
constraints
around
this
renaming
and
it
turns
out.
There
are
very
little
constraints
and
like
the
the
primary
constraint
is
that
if
the
host
object
is
renamed
within
the
same
top
level,
domain
Epp
requires
that
the
domain
object
must
exist.
So
as
a
concrete
example,
ns2.food.com
cannot
be
renamed
to
drop
this
host
random
characters.com,
If
drop.
F
The
first
random
characters.com
does
not
exist,
and,
given
that
EPP
cannot
check
external
references
like
references
to
external
top
level,
domains,
ns2.food.com
can
totally
be
renamed
to
drop
this
host
random
characters,
dot
Biz,
because
dot
base
is
an
external
top
level
domain.
Even
if
drop.
This
is
regardless
of
whether
drop
the
source,
random
characters,
dot
base
exists
or
not,
and
these
were
the
constraints,
and
we
expected
there
to
be
a
third
which
was
like
just
dropping
the
name
server
altogether.
F
But
having
talked
to
registrars
and
Registries,
it
seems
like
that
is
not
really
an
option.
So,
like
you,
can't
just
drop
the
name.
Server
like
the
host
object
altogether.
So
not
entirely
sure
why
so,
given
those
constraints,
the
registered
now
has
two
options.
The
first
is
to
rename
the
name
server
to
a
sync
domain.
The
sync
domain
is
controlled
by
registrar,
a
this
sort
of
guarantees
that
the
domain
object
always
exists
so
that
the
operation
never
fails.
F
But
now
the
registrar
is
on
the
hook
for
the
queries
and
upkeep
of
the
sync
domain,
and
this
is
actually
a
problem
because
we
at
least
know
of
multiple
instances
where
registrars
abandoned
their
sync
domains,
exposing
thousands
of
domains
to
hijacks
and
and
like
this
is
a
single
domain
that
an
attacker
can
just
register
and
get
all
of
these
domains
for
free.
The
second
option
is
to
rename
the
name
server
to
a
random
domain
in
a
different
top
level
domain.
F
The
different
top
level
domain
is
to
bypass
the
Epp
check,
and
the
random
domain
is
so
that
you
don't
impinge
on
an
existing
domain
and,
in
this
case,
like
the
registrar,
doesn't
really
have
to
handle
any
queries
or
upkeep
any
domains.
But,
as
you
can,
as
you
might
have
figured
out
like,
there
is
a
potential
for
security
risk
here.
F
And,
of
course,
because
it's
the
internet,
we
chose
the
the
second
option,
which
is
to
just
dump
it
into
this
random
top
level
domain
dot
base
with
a
random
domain,
and
because
of
this
renaming,
the
the
host
object
is
no
longer
a
subordinate
host
object
of
food.com
and
the
register
can
go
ahead
and
delete
the
domain.
And
what
we're
left
with
is
a
sacrificial
name
server
and
by
Design.
This
is
a
random
domain
which
was
which
is
not
registered.
F
F
But
then
we
started
seeing
renamings
that
affected.gov.edu.net
and-
and
we
found
that
the
one
small,
tiny
adjustment
that
we
needed
to
make
in
our
mental
model,
that
was,
that
EPP
instances,
spanned
multiple
top
level
domains
so,
for
example,
very
science,
Epp
repository
spans.com.gov.net.edu
amongst
others
and
Ophelia's,
for
example,
spans.org
dot
info
and
amongst
others.
So
what
we'll
do
is
sort
of
try
to
rework
the
example
again
to
see
how
this
renaming
affects
domains
across
multiple
top
level
domains.
F
We
are
still
left
with
a
lame
delegation
and
each
of
this
can
be
registered
and
by
an
attacker
to
be
the
authoritative
name,
server
or
even
a
DOT
cup
domain.
So
here's
a
quick
summary
of
what
we
have
learned
so
far.
We
found
that
EPP
consistency,
constraints
led
to
unintuitive
consequences
and
domain
deletion.
F
The
expiredomainfood.com
does
not
really
fix
the
issue
here
and
what
was
surprising
to
us
was
that
it
affected
even
domains
in
restricted
top-level
domains
like
dot,
gov
and
Dot
edu,
and
we
actually
found
a
couple
and
like
the
wonderful
folks
who
were
at
verisign
and
who
I
can
see
here,
actually
helped
us
remediate,
some
of
them
or
all
of
them.
So,
given
that
we
understood
how
this
happened,
we
wanted
to
understand
the
scope
of
this
issue
and
do
so
longitudinally.
F
So
we
used
the
three
properties
of
sacrificial
name
servers,
which
is
not
really
important
for
this
presentation,
but
we
use
this
three
properties
and
sort
of
modified
a
methodology
to
identify
lame
delegations
from
one
of
our
previous
papers
and
applied
it
to
nine
years
worth
of
zones,
files
earning
1250
top
level
domains
and
applied
it
to
20
million
name
servers
and
doing
so.
We
found
quite
a
few
registrars
actually
indulging
in
it.
180
000
name
servers
and
half
a
million
domains
that
were
affected
as
a
result
of
these
renamings
and
I.
F
Just
want
to
say,
like
all
of
these
registrars,
who
we
contacted
were
actually
super
helpful
and
like
helped
us
understand
the
issue
and
actually
rectified
all
of
it.
So
this
was
this
was
great.
So
what
I
know
that
this
sounds?
This
pains
them
in
a
bad
light,
but
actually
they
were
super
helpful
and
super
further.
F
So,
given
that
not
only
were
half
a
million
domains
affected,
but
nearly
one-third
of
all
of
the
domains
were
hijacked
by
registering
the
sacrificial
name
servers
so
not
only
where
these
domains
being
exposed,
but
they
were
in
fact
being
taken
advantage
of,
and
these
were
not
really
sophisticated
hijacks
and
the
hijackers
essentially
were
trying
to
get
hold
of
these
domains
in
order
to
serve
ads
and
where
search
engine
optimizations
were
the
other
use
case
that
we
saw,
and
essentially
these
were
opportunistic
hijacks
so
like.
Basically,
there
was
nothing
targeted.
F
F
F
There
are
multiple
instances,
as
I
had
mentioned,
before,
of
sync
domains
being
Avail
becoming
available
for
registration
as
registrars
sort
of
move
to
newer
domains,
and
in
this
case
a
single
registrant
gets
all
of
the
domains,
and
we
have
a
few
suggestions
for
long-term
Solutions
in
the
paper.
One
of
this
could
be
one
of
a
DOT
alt
TLD
again,
which
has
been
discussed
in
in
the
DNS
of
a
working
group.
F
I
think
Warren
and
Paul
have
been
working
on
an
RFC,
and
it's
like
in
its
draft
stages,
and
the
second
potential
solution
could
be
just
you
know,
delete
the
host
object
without
trying
to
rename
it,
and
we
are
not
entirely
sure
of
what
the
potential
implications
could
be
for
that.
So
something
to
study.
F
F
Attackers
come
in
and
want
to
Target
a
specific
domain
and
do
so
and
if
there
are
any
lessons
that
we
can
learn
from
there,
so
that
we,
when
we
are,
if
it
is
going
to
revisit
these
protocols,
then
we
should
do
so
that
do
so
in
a
way
that
solves
both
of
these
problems
and
a
lot
of
you
might
be
familiar
with
targeted
hijacks
because
of
this
Department
of
Homeland
Securities
emergency
directive,
asking
government
domains
to
evaluate
their
DNS
infrastructure
for
signs
of
tampering
in
January
of
2019.
This.
F
This
was
what
sisa
published
around
the
same
time.
There
were
multiple
security
vendors,
such
as
Cisco,
Dallas,
Cloud
strike
and
FireEye,
which
published
multiple
reports
of
widespread
DNS
hijacking
activity,
targeting
multiple
sectors
across
multiple
countries
and
and
the
the
the
hijack
of
the
French
Aerospace
company
was
perhaps
like
the
the
most.
F
So,
let's
say:
you're
a
client
trying
to
log
into
the
secure
network
for
this
French
Aerospace
company,
essentially
you're,
trying
to
load
up
this
login
page
in
order
to
enter
your
credentials
and
to
do
that,
you
need
to
First
resolve
secure.net.fr,
which
is
where
this
domain
lives,
and
in
order
to
do
that,
the
client
sends
off
this
request
to
the
recursive
resolver
and
we
are
all
familiar
with
how
this
resolution
process
takes
place.
The
recursive
resolver.
Does
this
dance
with
all
of
the
authoritative
name?
F
F
in
2014,
attackers
were
able
to
maliciously
update
DNS
delegations
at
the
top
level
domain,
authoritative,
name,
servers
and
I
want
to
make
sure
that
you
folks
are
aware
of
this
key
difference,
unlike
DNS
cache,
poisoning
or
query
interceptions
which
Target
the
DNS
query
protocol.
In
this
case
the
attackers
Target
the
registrars
and
the
Registries
in
order
to
influence
the
delegation
at
the
top
level
domain,
authoritative
name
server.
So
this
is
not
a
query
protocol
attack.
This
is
a
social
engineering
supply
chain
attack.
F
If
you
will,
where
the
attackers
Target
the
registrar
and
the
registry
in
order
to
influence
the
top
level
domain
delegations
and
now
because
the
attackers
actually
control
control
the
authoritative
name
servers,
they
can
redirect
all
users
all
users
trying
to
resolve
that
domain
to
an
IP
address
of
their
choice.
And
now
the
web
web
browser
is
going
to
go
to
this
malicious
IP
address
and
load
a
web
page.
That
looks
awfully
similar
to
the
actual
login
page.
F
It
is,
in
fact,
malicious,
and
at
this
point
of
time
a
lot
of
you
must
be
asking.
Isn't
this
exactly
what
TLS
is
supposed
to
help
us
with
like?
How
is
this
new?
How
does
TLS
not
help
us
with
this,
and
it
turns
out
that
TLS
would
have
helped
had
it
not
been
for
this
unfortunate
trust
dependence
between
certificate
issuance
and
DNS?
F
So
it
turns
out
that
certificate
issuance
automated
certifications
uses
DNS
to
approve
domain
ownership,
and
since
attackers
actually
control
the
DNS,
they
can
obtain
TLS
certificates
for
the
domain
and
keep
in
mind
like
these
are
completely
legitimate
certificates,
maliciously
obtained
but
legitimate
certificates.
Nevertheless,
and
as
a
result,
users
currently
distinguish
between
legitimate
infrastructure
and
attacker
infrastructure.
F
Certificate
certificate,
transparency
and
allows
for
auditing
of
all
of
the
certificates
that
were
issued
and
sort
of
helps
us
in
being
able
to
identify
these
hijacks
and
place.
So
transparency
plays
a
big
role
as
in
us
being
able
to
identify
these
hijacks,
okay.
So
a
quick
summary
of
like
this
targeted
infrastructure
hijacks,
they
start
by
an
attacker
acquiring
ability
to
control
DNS
delegations.
These
hijacks
are
characterized
by
multiple
brief
updates.
F
So,
instead
of
hijacking
for
a
period
of
a
day,
they
prefer
to
do
it
a
few
hours
over
a
period
few
hours
every
day
over
a
period
of
weeks,
so
as
to
not
attract
attention
and,
more
importantly,
because
they
control
the
DNS
infrastructure.
They
can
bypass
dnsic
TLS.
They
can
just
disable
it
or
bypass
it,
and
there
is
this
parallel
attacker
infrastructure,
which
is
to
mimic
the
target
domain,
and
this
response
with
a
maliciously
obtained
TLS
certificate,
which
basically
means
like
they
cannot
be
distinguished
from
the
legitimate
infrastructure.
F
F
We
wanted
okay,
now
sorry
I,
sort
of
spoiler
alert,
so
we
wanted
to
construct
yeah.
Okay,
we
wanted
to
construct
a
methodology
to
retroactively,
identify
these
targeted
domain
hijacks
in
the
wild
and
as
an
independent
third
party
and
I'm
not
going
to
go
into
the
details
of
how
we
did
it
happy
to
talk
about
it.
The
link
to
the
paper
is
in
the
slides,
but
in
all
we
identified
41
domains
as
hijacked
33
of
these
domains.
F
We
were
able
to
independently
re-identify
and
verify
from
previously
published
reports,
I
think
we
were
able
to
independently
re-identify
each
nearly
all
of
the
domains
that
were
previously
published
and
eight
domains
that
were
not
previously
identified,
or
at
least
not
reported,
and
we
think
that
these
are
high
confidence
and
like
each
of
them
is
manually
evaluated.
There
are
many
many
more
domains
where
there
is
circumstance
circumstantial
evidence,
but
we
just
didn't
feel
confident
enough
to
consider
them
as
hijacked,
and
this
is
one
of
the
limitations
of
being
an
independent
third
party.
F
So,
to
give
you
a
sense
of
what
is
it
that,
like
the
data
that
we
were
able
to
find
so
so
here
is
an
example
of
four
domains
that
we
identified
a
hijacked
all
belonging
to
dot
kg,
which
is
the
Kyrgyzstan
government.
Three
of
them
were
government
domains.
One
of
them
was
an
infrastructure
provider
in
Kyrgyzstan,
and
we
find
that
each
of
them
was
targeted
from
the
same
network
geolocated
to
Russia,
each
of
them
targeting
the
mail
infrastructure.
I
just
want
to
be
careful
here.
F
The
geolocation
is
not
really
not
attribution,
but
in
each
of
these
cases
the
mail
infrastructure
was
the
one
that
was
targeted
and,
for
example,
for
Ministry
for
foreign
affairs
in
Kyrgyzstan
they
used
Zimbra
as
their
mail
provider,
and
we
find
that
the
attackers
sort
of
setting
up
this
parallel
infrastructure
with
that
mimics,
the
Zimbra,
my
login
page
and
sort
of
prompt,
malicious
downloads
or
harvesting
your
user
credentials
and
I.
Don't
expect
any
of
you
to
read
this,
but
this
is
like
the
entire
list
of
41
domains.
F
So
if
you
have
the
slides
open
on
your
computer,
you
can
sort
of
go
over
the
slides,
and
the
only
thing
that
again,
that
you
might
be
able
to
see
is
some
of
the
patterns
that
sort
of
emerge
a
lot
of
government
domains,
a
lot
of
male
infrastructure,
a
lot
of
reuse
in
the
same
attacker
infrastructure,
which
was
surprising
but,
roughly
speaking,
this
is
a.
This
is
an
ongoing
issue
and
something
that's
actually
been
becoming
more
problematic
over
the
over
time.
F
So,
if
I
were
to
summarize
this
Target
hijacks
part
I
would
say
like
the
thing
that
we
as
a
community
need
to
sort
of
grapple
with
is
the
fact
that
the
traditional
mechanisms
such
as
DNS,
Tech
and
TLS,
don't
really
protect
against
these
DNS
infrastructure
hijacks.
Since
attackers
are
able
to
sort
of
go
and
disable
these
protections
and
that
there
is
a
need
for
more
transparency
and
proactive
measurements
to
understand
how
to
mitigate
these
future
attacks
and
I
thought.
F
Now
that
we
understood
what
the
the
big
bigger
issues
were
and
Christmas
is
near,
I
should
come
up
with
a
wish
list
and
I'm
told
that
the
ITF
Center
only
deals
with
rfcs.
So
I
thought
how
about
I
come
up
with
what
I
would
like
to
see.
So
there
were
three
things
and
the
DNS
transparency
I've
realized
after
talking
to
a
lot
of
people,
is
an
overloaded
term
and
I
think
it
should
be.
F
F
And
finally,
this
is
a
certificate
transparency
on
steroids
certificate.
Transparency
has
been
great
to
identify,
Bad
actors
and
a
lot
of
work
would
wouldn't
have
been
possible
without
a
certificate,
transparency
and,
and
it
turns
out
that
certificate
authorities
do
a
lot
of
work
when
they
issue
certificates
and
if
they
made
it
sort
of
public
or
at
least
available
to
researchers
such
as
DNS
queries
and
the
IP,
which
initiated
the
risk
requests.
F
A
So
if,
if
there
are
questions,
please
do
join
the
queue
using
mitaku
and
come
to
the
microphone
while
we're
waiting
for
people
to
join
the
queue
I'd
like,
though,
to
remind
people
of
the
masking
policy
for
the
room.
If
you're,
not
an
active
speaker
at
the
front
here,
you
need
the
community
guidelines
is
that
you
need
to
wear
a
mask
at
all
times
and
The
Mask
needs
to
cover
your
nose
and
your
mouth
and
if
you're
not
willing
to
do
that,
then
please
leave
the
room
all
right.
G
G
F
Happy
to
like
again
I'm
excited
like
people
are
interested
in
actually
making
these
updates.
So,
like
I'm,
happy
to
talk
more
on
like
what
exact
solution
like
there
are
a
few
more
solutions
that
we're
thought
through
but
again
like
it's.
It's
always
great
to
come
to
ITF
and
actually
understand
the
Practical
concentrations
of
it.
So
yeah
happy.
B
Richard
Wilhelm
PIR
one
great
talk.
Thank
you.
A
couple
couple
things
one
just
plus
one
Dwayne's
comment
on
the
on
the
dot.
All
thing:
there's
not
really
any
musts
in
that
in
that
draft
right
now
and
I.
Think
that
your
the
idea
in
the
paper
about
dot
invalid
was
probably
I
like
going
better
for
what
it's
worth
a
couple
things
you
in
the
in
the
in
the
slides.
It
had
an
example
about
the
multiple
providers
and
platform
communication
between
garage.
B
Even
at
a
single
registry
service
provider,
often
platforms
aren't
often
connected,
so
whether
it
be
at
verisign
or
Affiliates
or
whatever
the
the
platforms,
don't
necessarily
connect.
So
it's
just
a
yes
and
to
the
point
that
you
were
making
about
platforms,
not
having
communication
so
great
point
there
just
something
else
for
that
it
may
be
a
solution.
It
might
be
just
dropping
the
name.
Server
originally
Epp
had
a
requirement
of
having
two
names
for
servers
for
DNS
reliability.
As
you
know,
that
was
written
before
the
days
of
widespread
anycast
adoption.
B
So
one
might
argue
that
that's
outdated,
but
even
so
there's
Corner
cases
where
you
could
end
up
having
that
meaning
a
name
name
going
dark.
The
idea
of
communicating
all
domain
deletions
gets
very
challenging,
because
the
notion
of
when
a
domain
gets
deleted
is
remarkably
fuzzy
at
registry
platforms.
B
Then
the
last
point
I'd
like
to
make
is
just
probably
for
ever
more
for
everyone
with
an
earshot
is,
as
you
point
out
very
well
in
your
slides,
especially
the
Integrity
of
the
registrants
registrar
account
is
so
key
to
the
underlying
infrastructure,
as
you
point
out
in
your
example
there,
and
so
if
you've
got
registrations
that
are
under
your
control
or
around
you
with
your
company
wow.
If
you
don't
have
multi-factor
authentication
on
that
account
you're
just
asking
for
it.
B
F
Think
the
registrant
account
compromise,
I
think
that's
that's
a
big
problem
and
multi-factor
authentication
definitely
needs
to
be
adopted,
but
then
there
is
also
the
issue
of
registrars
themselves
being
compromised
and
we
see
like
in
in
a
lot
of
these
cases,
Epp
tokens
themselves
being
sort
of
exfiltrated
by
attackers,
nation
state
actors
and
that,
but
that
said,
like
registered
account,
security
is
an
important.
This
is
an
important
factor
in
all
of
this.
C
H
Take
out
him
great
paper
and
great
presentation,
one
of
the
things
that
occurs
to
me
when
I
read
and
watch
your
presentations.
What
we're
seeing
is
particularly
the
first
part
of
your
presentation
is
that
we're
seeing
the
Aging
of
the
internet
and
what
that
that
raises
a
question
in
my
mind
about
the
externalities
that
are
being
introduced
with
within
the
system
at
a
fundamental
level.
You
know
between
icann
and
the
Registries
relating
to.
H
Is
it
really
it
is?
Is
it
just
an
externality
at
this
point
that
we're
addressing
in
terms
of
when
a
name
goes
away?
Is
it
simply
the
reputational
damage?
Isn't
there
for
The
Domain,
that's
gone
away
right,
they've
gone
away,
they
don't
care
about
their
reputation,
but
the
harm
may
may
accrue
to
others
in
terms
of
what
happens
next,
if
somebody
reuses
that
domain
and
now
there
are
two
sides
of
this
right-
you
mentioned.
There's
this.
You
know
use
of
a
domain
name
server
right.
H
There's
there
there
probably
are
some
best
practices
that
that
need
to
be
applied.
There
I
like
the
idea
of
dropping
the
name
for
that
purpose,
but
rather
the
damage
occur,
quit
more
quickly
than
and
more
transparently
than
say,
being
hidden,
but
these
other.
There
is
this
other
aspect,
I
just
tickled
in
my
head,
as
as
possibly
some
further
research
for
the
iconites
to
to
think
about.
F
Yeah
and
I
think
Rick
also
made
this
point
about,
like
dropping
the
name
server
and
like
originally
Epp
did
not
allow
it
because
of
the
requirement
of
two
name
surveys,
but
in
this
case
one
could
argue
that
the
second
name
server
is
actually
serving.
No
purpose
like
it
is
a.
It
is
a
dead.
It
is
a
lame
delegation.
It's
not
going
to
resolve
and
just
having.
There
is
a
waste
of
space,
and
actually
it
might
be
better
to
make
it
more
clear
that
this
is
a
dead
delegation.
So
yeah
good
point
thanks.
I
So
like
to
Echo
what
my
previous
speaker
said
as
one
one,
the
dot
all
is
not
the
solution.
You're.
Looking
for
the
reason,
also
in
I,
mean
resolvers,
never
would
get
asked
for
the
name,
server's
name
they
would
internally
resolve
it.
So
that's
a
different
kind
of
close
pass,
so
I
think
GoDaddy
did
the
right
thing.
They
used
as12.apa,
which
is
kind
of
like
yeah.
That's
the
sinkhole
that
we
use
for
all
things
in
DNS.
F
Right
and
so
when
we
spoke
to
other
people
about
as112.orpa,
the
the
hijackability
of
as112.orpa
domains
was
not
immediately
obvious
to
us
like,
since
there
is
a
sinkhole
server
that
is
localized.
Does
it
sort
of
expose
domains
to
some
sort
of
localized
hijacking
control
we
couldn't
say
but
but
yeah?
If.
A
A
Clearly,
jumping
the
gun
here,
so
the
second
talk
today
is
by
Karen
calf
Karen
is
a
research
affiliate
at
the
minduru
center
for
technology
and
democracy.
It's
the
University
of
Cambridge,
where
she
studies
internet
governance,
cultures,
currents
talking
today
about
the
technology
we
choose
to
create
human
rights
advocacy
in
the
ITF.
C
A
Also
available
as
I
think
it's
chapter,
seven
of
your
PhD
thesis
and
we
link
to
your
thesis
on
the
website
in
in
an
Open
Access
form.
If
you
want
to
read
the
details
again,
if
you
want,
if
you
find
this
work,
interesting
I
think
you're
talking
in
hrpc
on
Friday
as
well
see
there'll,
be
similar
topics.
I
guess.
J
Yeah
good
to
go
thanks
so
much.
Thank
you
so
much
for
for
being
here
this
morning
and
for
being
with
me,
it
is
day
three
of
the
ietf
and
I've
already
been
able
to
lose
my
voice,
so
we're
gonna
try
this
slowly
as
I
sip.
Some
water
I
really
appreciate
the
opportunity
to
be
able
to
present
my
work
today.
As
Colin
already
mentioned,
my
paper
is
called
the
technology
we
choose
to
create
human
rights
advocacy
in
the
ietf.
Now
I've
been
participating
in
the
iitf
since
2014.
J
Allah
is
an
Egyptian
British
activist
and
technologist,
who
has
been
imprisoned
in
Egypt,
unjustly
for
over
nine
years
for
his
work
on
human
rights
and
internet
freedom.
He's
a
friend
to
many
of
us,
some
of
us
in
the
room
as
well
and
I,
want
to
put
this
on
the
radar
for
you,
especially
because
we
are
in
the
UK
and
he's
a
dual
Citizen
and
if
you
have
any
of
your
representatives
or
politicians
going
or
being
at
cop27,
please
reach
out
to
them
and
see
if
they
can
plead
the
case
for
Allah
to
be
freed.
J
J
I'm
gonna
give
some
context
for
the
research
that
I
did
talk
a
little
bit
about
the
findings
in
this
paper
and
then
move
to
conclusions,
but,
more
importantly,
to
the
Q,
a
because
I'm
really
interested
in
having
the
conversation
with
the
community,
and
that's
really
why
I'm
here
as
I
mentioned
I'm
an
anthropologist
I
am
currently
a
research
affiliate
at
Cambridge.
Some
of
you
might
also
know
me,
in
the
context
of
my
day,
job
as
a
VP
of
research
at
the
open
technology
fund.
J
I
want
to
make
clear,
though,
that
I'm
presenting
this
not
in
that
capacity,
but
as
a
lapsed
or
elapsing
academic,
and
it's
interesting.
It
was
really
wonderful
to
hear
Gautam
talk
before
me,
because
I'm
going
to
riff
a
little
bit
on
the
story
that
he
was
trying
to
tell
from
10
000
feet.
So
the
story
that
I
want
to
tell
is
really
about
how
well-meaning
people
have
practices
that
sometimes
have
unintended
consequences.
J
So
for
those
of
you,
who've
never
met
me
who
don't
know
my
work.
You
might
also
know
me
as
the
Cat's
pet.
That's
get
that
gets
quoted
a
lot
on
ietf
threads
about
what
is
and
what
isn't
good
etiquette
most
recently
on
this
ITF
at
IHF
thread,
then
I'm
sure
more
of
you
than
not
don't
need
to
be
reminded
of.
J
J
So
one
of
the
things
that
I
love
to
do
in
my
talks
is
preview.
A
little
bit
of
the
key
takeaway
and
the
key
takeaway
for
this
talk
today
is
somewhat
of
a
controversial
one,
at
least
in
this
community.
If
there's
one
thing
that
I
hope
sticks
with
you
today
from
my
talk,
it
is
that
the
itf's
work
is
political.
Much
as
there
is
a
mantra
here
that
says
we
don't
do.
Politics
and
I
want
to
be
really
clear
about
what
I
say
when
I
mean
political
and
politics.
J
So
for
me
that
means
that
the
work
is
infused
with
historically
contingent
power
relations
and
the
values,
the
personal
values,
the
political
values
held
by
its
participants.
So
I'm
talking
about
politics
in
terms
of
values
and
power
relationships,
not
necessarily
in
terms
of
political
parties.
Just
to
make
that
clear.
J
So
that
means
nowadays
you
will
find
us
everywhere.
We
are
studying
the
US
government.
We
are
studying
the
European
Union.
We
are
studying
Netflix
meta
Apple
wherever
we
can
enter
so
the
well-known
tech
companies,
but
also
lesser
well-known
communities
like
the
ITF
and
one
of
the
interesting
thing
is
like
iitf
Engineers
anthropologists
of
Technology
get
together
and
have
beer
and
gossip
and
trade
War
Stories,
and
the
interesting
thing
is
when
I
do
that
with
fellow
anthropologists
who
are
in
this
field,
and
we
share
our
war
stories,
I
often
get
asked.
J
How
do
you
deal
with
the
hostilities
that
many
anthropologists
experience
being
social
scientists
who
study
technical
communities
and
one
of
the
things
that
always
tends
to
surprise?
My
colleagues
is
that
I
say
I've
actually
found
the
ITF
to
be
very
receptive
of
my
work,
I'm
very
curious
about
it.
Even
if
we
don't
always
agree
I,
don't
think
I
would
be
here
receiving
this
price.
If
that
wasn't
the
case
and
I'm
very
appreciative
of
that
reality
and
I
think
part
of
the
reason.
J
In
the
time
that
I've
spent
here,
I've
interviewed
astronomers
philosophers,
other
anthropologists
people
coming
from
a
wide
array
of
academic
backgrounds
and
bringing
those
very
interesting
and
diverse
perspective
to
the
work
that
is
done
here
now.
This
is
a
quick
how
why
eventropology
slide
for
those
in
the
room
who
are
less
familiar
with
it
as
an
academic
discipline.
J
J
J
Let's
go
with
Bob
and
Alice
column,
the
First
Column
outlines
what
Ellis
said
in
the
meeting
column,
the
second
column
outlines
what
Bob
thinks
Ellis
said
or
is
trying
to
say,
and
the
third
column
outlines
what
Alice
is
truly
saying
what
she
truly
means
the
same.
So,
for
example,
in
the
first
column,
it
says
that
Alice
told
Bob
I
have
a
few
comments
and
what
Bob
heard
was
please
rewrite
this
draft
entirely.
J
So
here
we
go
so
anthropologists.
Ask
questions
like
what
do
people
care
about
what
beliefs
do
they
hold
and
how
do
these
beliefs
inform
cultural
practices,
for
instance
the
cultural
practice
of
developing
protocols
and
standards?
Now,
in
this
particular
case,
I
found
that
a
lot
of
the
people
here
care
about
Freedom
autonomy,
growth
of
the
network
and
having
the
choice
and
also
leaving
the
choice.
The
people
who
end
up
implementing
protocols
some
of
the
beliefs
that
they
hold
are
that
these
particular
things.
J
So
here
we
go
in
too
fast.
So
in
October,
2014
three
human
rights
activists
presented
a
bold
idea
to
the
ietf.
They
wanted
to
do
research
on
how
internet
standards
impacted
human
rights.
Initially
they
had
wanted
to
directly
set
up
a
working
group
in
the
ietf,
but
it
was
decided
that
it
would
perhaps
be
better
suited
to
be
a
research
group
first.
J
So
what
the
activists
try
to
do
is
that
they've
developed
guidelines
that
Engineers
could
use
to
Think
Through
the
potential
impact
of
the
work
that
they
were
doing
on
a
number
of
Human
Rights
and
to
achieve
that
goal,
the
activists
set
up
the
human
rights
protocol
considerations,
research
group
in
the
irtf.
The
group
is
still
doing
a
lot
of
work
and
I'll
be
presenting
some
of
my
research
there
on
Friday
for
people
who
are
interested
I
think
it's
the
morning
slot.
J
So
how
should
we
see
this
particular
group
within
sort
of
the
larger
history
of
the
iitf?
Now,
during
its
30
plus
year
of
existing?
There
have
always
been
people
working
alongside
industry
Engineers
here
who
come
from
organizations
that
maybe
don't
that
aren't
corporations
so
I'm
sure
many
of
you
know
dkg
who
works
for
the
ACLU
Mallory
nodal,
who
works
for
the
center
for
democracy
and
technology,
and
they
are
not.
Their
presence
here
is
not
novel
in
any
kind
of
way.
J
J
I
mean
very
few
standards
that
I've
seen
at
this
point
have
human
rights
consideration
section
like
they
do:
privacy
considerations
or
security
curations,
and
there
are
many
many
reasons
why
the
human
rights
work
face
such
an
uphill
battle.
Now,
obviously,
some
are
related
to
sort
of
the
political
economy
of
standardization,
the
Dominus,
the
dominance
of
the
interests
of
particular
technical
actors
and
Industry
actors,
whose
main
concerns
are
around
efficiency
and
costs
and
latency.
J
It's
not
just
that
the
human
rights
activists
ask
Engineers
to
do
things
that
they
didn't
think
were
technically
feasible,
but
that
they
asked
them
to
do
things
that
they
didn't
feel
comfortable
doing
because
it
didn't
align
with
their
worldview
of
what
their
role
should
be
in
the
interest
of
time.
I
will
skip
this
one,
so
that
brings
us
back
to
column.
Three
remember
the
different
columns
that
I
outlined
earlier
and
how
I
am
interested
as
an
anthropologist
in
understanding
what
people
mean
and
how
that
drives
their
work.
J
In
doing
so,
for
this
paper,
I
found
that
there
were
big,
big
differences
between
how
some
of
the
human
rights
people
interpreted
openness
or
interop
or
connectivity
versus
how
some
Engineers
understood
it,
and
these
are
some
of
the
examples
that
I
outline
in
the
paper.
So,
for
instance,
when
talking
about
connectivity,
many
of
the
engineers
talk
about
connectivity
of
machines
not
necessarily
of
humans
and
connectivity
in
a
let's
say,
fair
kind
of
manner.
So
not
too
much
oversight,
not
too
much
intervention
permission.
J
Is
innovation
really
should
not
be
centrally
organized,
but
should
be
done
because
people
choose
to
connect
to
the
network
and
openness
really
as
freedom
from
coercion,
including
sometimes
from
Human
Rights
concerns,
now
unearthing.
What
Engineers
probably
mean
when
it
comes
to
openness
and
interoperability,
and
connectivity
is
important
to
understand
the
cultural
causes
of
friction
in
research
groups
and
working
groups?
Beyond
just
the
ones
that
I've
outlined
here
today,
so
to
make
it
a
little
bit
more
concrete.
J
I
am
not
convinced
human
rights
fit
within
the
ietf.
I
am
willing
to
be
told
otherwise.
But
when
we
talk
about
the
political
world
of
Human
Rights,
what
comes
to
my
mind
quickly?
Is
the
international
telecommunications
Union,
the
Ito,
or
something
like
that
in
which
the
question
becomes
Madam.
Chairwoman
I
would
like
to
speak
about
the
gentleman
from
slobovia
who
just
said
something
with
which
I
disagree.
J
And
again,
as
one
of
my
interviewee
said,
the
problem
is
that
the
human
rights
protocol
guidelines
will
be
seen
as
didactic
by
the
community
that
it
is
trying
to
influence
and
far
from
achieving
What
It
Wants.
There
is
a
risk
that
it
could
backfire.
It
gives
ammunition
to
the
enemies
or
groups
like
hrbc
at
times.
J
So
the
tldr
of
this
is
a
lot.
A
lot
of
the
struggles
that
happen
here
are
because
of
a
clash
of
World
Views
and
those
play
out
by
way
of
protocols.
So
it's
politics
by
way
of
protocol,
something
that
Professor
Laura
denardis
has
long
focused
her
work
on
for
people
who
are
interested
in
reading
more
about
this
from
a
social
science
perspective.
J
Similarly,
I
could
have
started
my
talk
by
speaking
about
the
situation
in
Iran,
but
I
think
that
Simone
basso
from
uni
and
Masa
Ali
mardani
have
already
done
so
really
well
yesterday,
at
the
IAB
open
meeting
that
really
conveys
the
importance
of
us,
at
least
as
a
community
thinking
through
the
potential
human
rights
ramifications
of
our
work.
Even
if
the
conclusion
is
that
we
might
not
be
able
to
remedy
things
so,
instead,
I
went
on
this
note,
while
in
part
my
research
aims
to
speak
to
the
ITF
community.
J
K
J
Anthropologists
as
a
field
is
inherently
aware
of
the
fact
that
research
is
always
political,
that
my
World
Views
and
how
who
I
am
will
influence.
What
my
focus
is
in
the
research,
so
I
don't
pretend
to
be
independent
or
politically
neutral.
Instead,
what
anthropologists
and
a
number
of
other
social
scientists
do?
Is
that
we're
very
explicit
about
our
positionality.
J
So
what
you
will
find
in
my
PhD
research
is
a
positionality
statement
in
which
I,
for
instance,
outline
how
the
different
ways
in
which
I
am
seen
impact
my
research,
a
good
example
that
I
always
bring
up
is
obviously
I
identify
as
a
woman,
and
that
means
that
I'm,
a
minority
in
the
ITF
in
some
ways,
I'm
also
white.
That
makes
me
part
of
a
particular
group
within
the
ITF
as
well.
I
am
from
Europe.
J
H
Very
much
for
your
paper
and
your
work,
I
think
you
chose
a
group
at
a
moment
in
time
that
this
community
struggled
with
greatly,
quite
frankly
and
for
many
reasons,
not
just
a
single
reason.
Some
of
the
reasons
had
to
do
with
the
responsibilities
that
we
in
this
room
have
not
just
toward
individuals
such
as
the
one
you
mentioned,
but
also
towards
the
day-to-day
person
who
gets
ripped
off
from
you
know
from
fraud.
H
J
J
That
being
said,
I
did
Focus
very
specifically
on
a
certain
subset,
so
I
did
focus
on
human
rights
activists
in
particular,
because
I
do
feel
that
in
this
community,
people
who
represent
that
kind
of
end
user
in
many
ways
are
in
the
minority
and
I
feel.
The
concerns
that
you
raise
are
very
valid.
I
also
feel
they
are
well
represented
and
not
necessarily
sure
that
it
is
my
role
to
take
on
those
concerns
as
well,
given
that
everyone
has
a
limited
amount
of
capacity
and
24
hours
in
a
day,
foreign.
E
I'm,
just
a
little
too
short
for
the
stand,
my
name
is
Michaela.
Thank
you
so
much
for
your
presentation,
my
question
so
coming
from
a
human
rights
background,
so
less
of
a
technical
background.
I
am
very
interested
in
what
you
were
talking
about,
how,
in
terms
of
the
differences
in
language,
in
terms
of
how
you
kind
of
there's
ways
in
which
you
can
push
for
something
as
a
human
rights
activist
and
that
will
not
be
interpreted
always
very
well
and
so
I'm
curious.
E
J
I
mean
there's
a
there's,
a
bunch
of
different
recognitions
that
I
would
have
maybe
something
to
talk
about
offline
I
also
have
more
of
a
policy
paper
coming
out
next
year
that
specifically
focus
on
such
some
of
the
cultural
hurdles
that
the
ITF
poses
in
terms
of
its
sometimes
rough
working
practices
and
and
who
those
are
easy
for
whom
those
are
easier
to
navigate.
Another
thing
that
I've
seen
is
very
effective.
J
A
L
April
RFC,
my
my
understanding
from
reading
the
documents
that
I
understand
what
a
writer
or
the
author
of
the
mean
and
or
what
they
mean
by
as
they
they
see
it
as
a
tradition
for
ieat.
But
my
opinion
and
I
would
like
my
comment
now
to
to
know
your
opinion.
As
your
expert
is
in
Societies
or
communities
Behavior.
My
understanding
that
at
least
the
document
is
RFC,
which
is
in
the
first
of
February,
to
be
notified
that
it's
it's
let's
say
for
some
kind
of
purpose
on
the
document.
L
But
if
you
write
a
document-
and
you
just
put
the
date
and
it's
the
first
of
April-
that
as
saying
it's,
they
say
it's
a
full
date
or
fooding
date
or
funny
date
day
of
fools,
or
something
like
that.
But
in
my
as
an
academic
I
come
from
an
engineering
academic
background.
I
feel
it's
documents
shouldn't
be
be
notified
only
by
the
date
that
this
gives
some
kind
of
indication
and
write.
In
some
words
saying
this
is
in
some
kind
of
purpose,
just
like
a
title.
So
I
want
to
know
your
comment
on
that.
J
I
am
not
100
sure
I
could
follow
that
because
it's
really
hard
to
hear
remote
questions
when
you're
up
on
the
stage,
but
I
think
the
question
was:
why
did
I
organize
to
talk
along
certain
dates
for
key
documents
or
I?
Don't
have
anyone
else
in
the
room
could
hear
what
the
actual
question
was,
of
course
about.
Could
you
repeat
it
I.
M
N
This
was
a
this
is
a
great
talk
and
and
I
in
the
great
tradition
of
the
ITF.
I
did
not
read
your
paper
before
coming
to
the
microphone
to
comment
on
it,
but
that
doesn't
stop
anybody
anyway.
So
I
I
liked
the
principles
you
identified
for
like
much
people,
you
know
believe
the
ITF
is
about
the
one
thing
that
I
also
think
is
is
maybe
in
your
paper,
which
I
don't
know.
N
A
little
bit
right
because
it
can't
just
be
lip
service
but
and
I,
was
sort
of
excited
when
those
participants
showed
up,
because
that
was
an
angle
we
really
haven't
had
before
and
I
think
it
has
made
the
ITF
stronger
and
I'm
wondering
to
come
to
my
question.
If,
in
your
interviews
and
your
experience
here,
if
you
would
say
that
we
are
really
like
believe
in
multi-stakeholderism,
and
it
is
a
foundation
for
the
work
or
whether
we
pay
lip
service
to
it.
J
N
N
Think
that's
why
it's
not
so
widely
used
and
other
organizations
have
sort
of
now
jumped
on
the
bandwagon,
let's
say
and
are
trying
to
portray
themselves
as
very
open,
I
think
there's
an
argument
to
be
had
whether
they
actually
are
quite
as
open
as
they
claim
to
be
right,
because
it's
becoming
a
political,
politically
reason
to
to
be
that,
but
I
sort
of
wonder.
If
sort
of
you
know
if
the
iitf
I
think
we've
always
had
this.
J
The
interesting
thing
is
that
I
found
that
there
is
a
conflation
within
the
ITF
between
being
culturally
welcoming
and
procedural
openness,
so
I've
had
a
lot
of
people.
Tell
me
to
quote
one
particular
person
who
said
any
effort
with
an
email
can
sign
up
to
a
mailing
list.
That
is
procedural
openness,
but
then
a
lot
of
the
folks
that
I've
spoken
to,
who
are
women,
who
are
non-binary,
who
are
people
of
color,
not
from
the
EU
and
the
US,
have
said.
J
J
H
A
B
O
O
Is
there
any
initiative
to
keep
this
work
alive
inside
the
ITF,
like
we
have
a
little
bit
of
research
work
now
trying
to
find
out
how
the
process
of
ifcs
get
adopted,
accepted
or
evolved.
So
if
do
you
have
any
any
plans,
or
is
there
anybody
inside
the
ITF
that
she's
interested
in
having
your
work
alive
or
keep
it
alive?.
J
P
J
There
there
are
I
mean
obviously,
eigen
has
a
has
a
also
a
long
history
of
people.
From
a
not-for-profit
and
a
public
interest
perspective
participating,
they're
divided
into
stakeholder
constituency.
There
is
a
the
ncuc
which
stands
for
the
non-commercial
users.
Community
someone
from
icon
is
going
to
throw
something
at
me
right
now.
The
itu
is
trickier
because,
obviously
you
have
to
be
on
a
national
delegation
to
participate.
J
M
I
I
loved
how
you
said
when
the
IDF
chooses
to
be
political
and
and
when
not.
My
question
was
in
your
interviews,
so
another
cultural
practice
is
that
people
sometimes
represent
themselves
as
individuals
and
you
know
hide
their
affiliation
in
your
research.
Did
you
find
that
and
not
just
on
human
rights?
But
maybe
you
can
answer
that
people
had
a
different
position
when
speaking
to
you
in
private,
where
they
sort
of
didn't
have
to
you
know,
represent
a
company
or
have
an
affiliation
that
everyone
knows
about
that.
J
D
D
I
believed
in
multi-stakeholderism
in
the
ietf
for
more
than
two
and
a
half
decades
now
and
Technology
shares
this
Duality,
both
by
being
neutral
in
and
of
itself,
but
completely
greasing
the
skids
for
a
particular
political
agendas
and
one
of
the
the
main
reason
I
want
to
get
up
to
ask
a
question
was:
how
do
we
get
additional
input
from
the
other
stakeholder
groups?
Do
we
need
an
Outreach
organization?
Are
they
already
aware
and
trying
to
make
inroads
here
like
how?
How
do
we
further
develop
the
inputs.
J
It
though-
and
there
is
the
obvious
difficulty
that
a
lot
of
that-
what
we
do
here
takes
a
lot
of
technical
capacity
that
isn't
necessarily
present
in
the
same
way
within
Civil
Society,
plus
the
fact
that
there
are
many
different
challenges
when
it
comes
to
technology
and
obviously
for
many
people,
the
most
visible
parts
of
the
internet
are
the
most
obvious
ones.
So
a
lot
of
Civil
Society
organizations
will
focus
on
artificial
intelligence,
social
media
and
the
things
that
we
see.
A
J
A
A
A
Excellent
talk,
excellent
questions,
we're
running
a
little
behind
time,
I
I,
hope,
I,
hope
you
will
give
us
the
the
grace
to
run
slightly
over
this
session.
The
last
speaker
today
last,
but
by
no
means
least,
is
Daniel
Wagner,
we'll
be
talking
about
his
paper
United
We,
Stand,
collaborative
detection
and
mitigation
of
amplification
DDOS
attacks
at
scale.
Q
Well,
there's
basically
nothing
to
add
to
that
what
Colin
said
so
I
do
not
need
to
introduce
myself
I,
think
I'm
now
in
control
of
the
slides,
yes
control
well.
First
of
all,
thank
you
all
very
much
for
making
all
of
this
possible.
Thank
you
for
these
kind
of
price
that
you
are
awarding
here.
It's
amazing
I
did
not
imagine
ever
to
received
something
like
that.
So
thank
you
all
very
much,
and
also
thanks
to
my
co-authors.
Q
Without
these
guys,
nothing
of
that
would
have
been
possible,
so
I
thank
very
much
Daniel
Kopp
and
csvicta,
who
were
Christoph
dietzel,
my
fellow
colleagues
at
dkx,
as
well
as
Oliver
who
Feld
from
the
btu,
go
to
Georgio
smart
Takis
from
Tio
delft
and
my
doctoral
supervisor,
Anya
feltman
from
the
max
Bank
Institute
all
right.
So
the
topic
is
once
again
about
DDOS
attacks,
we're
going
to
talk
about.
Why
is
that
still
a
Hot
Topic?
Q
Q
This
is
a
volume
that
can
take
like
also
the
very
big
players,
at
least
or
for
their
scrubbing
services,
to
an
enormous
test
for
reference.
A
gigabit
usually
is
enough
to
knock
off
some
day.
Services.
I,
don't
know
like
some
some
stores
web
services
stuff
like
that,
and
this
also
targets,
basically
everything
that
is
hosted
online,
so
more
and
more
influencing
more
daily
lives.
For
example,
financial
services
and
even
Health
sector
is
affected
or
can
be
affected
by
that.
Q
So
what
is
what
is
the
kind
of
Adidas
attack?
We
are
going
to
dig
into
there's
a
special
kind
of
those
attacks.
There
are
many
difficult
different
types
of
that
we're
looking
at
the
amplification
data
attacks,
which
work
basically
as
follows:
we've
got
an
attacker
to
the
left
and
he
sends
small
packets
to
a
set
of
exploitable
devices
or
services
online.
Q
That
act
as
a
reflector
and
the
attacker
sets
a
spoof
Source
address
so
that
the
response
of
the
reflectors,
which
is
larger
than
the
initial
request,
so
say
it's
an
amplification-
can
be
directed
to
any
Target
basically,
and
the
target
is
then
the
service
that
the
attacker
wants
to
knock
offline.
So
usually,
what
is
being
done
to
defend
oneself
from
that
is
that
these
services
that
want
to
remain
alive
they
deploy
a
local
scrubbing
service.
Q
I
depict
this
in
this
figure
as
this
purple
box
to
the
right,
and
if
we
assume
that
this
scrubbing
service
did
a
perfect
job
well,
maybe
they
are
doing
a
very
great
job,
but
never
they're,
never
perfect,
and
even
if
they
did
a
perfect
job,
we
have
lots
of
unwanted
traffic
along
the
paths.
These
are
the
these
blue
arrows
pointing
to
the
right
to
the
Target.
They
are
still
carrying
all
of
that
unwanted
traffic
that
has
no
use
just
but
to
be
dropped.
Q
Q
Some
of
the
paths
of
the
attack
traffic
are
going
around
this
ixps,
but
along
some
of
these
past
paths,
the
isps
are
located
and
that's
that
we
were
measuring
about
the
about
the
the
position
of
the
ice
piece
along
the
path
and
also
what
could
be
the
benefit
of
dropping
the
traffic
earlier
than
at
the
local
scrubbing
service
at
the
Target.
They
have.
Q
Q
So,
first
of
all,
let's
leverage
some
data
we
partnered
with
11xp
across
the
globe
plus
well,
that's
way
too
much
to
say
it
was
in
Central
and
South
Europe
and
the
North
American
countries,
ranging
from
very
different
types
of
traffic,
lots
of
different
numbers
of
peers.
There
different
Peak
volumes
and
different
amount
of
flows.
We
could
get
from
them
and
the
time
range
we
were
looking
at
was
a
half
a
year
in
2020..
Q
We
were
filtering
for
UDP
only
because
that
is
what
the
most
common
amplification
Adidas
attacks
are
using
as
a
transport
protocol,
and
then
we
were
filtering
further
for
prominent
abusable.
Let's
say
like
that
protocols
that
were
derived
from
previous
related
work.
These
are
this
is
a
list
of
the
protocols
we're
looking
at
in
the
port
number
and,
lastly,
we're
also
filtering
for
prominent
packet
sizes
that
are
most
mostly
transmitted
when
a
exploited
answer
is
being
transmitted.
So
this
is
also
for
the
protocols,
a
a
certain
thing.
Q
We
want
to
look
for
next
on
the
filtered
data
we
apply
the
detection
mechanism,
meaning
that
we
are
looking
now
for
flows
that
are
targeting
the
same
IP
address,
but
originate
from
at
least
10
different
sources
that
are
the
reflectors
and
the
absolute
volume
measured
by
that
are
in
some
needs
to
exceed
one
gigabit
of
traffic.
If
we
detect
such
an
event,
it
is
likely
to
be
Adidas
attack,
which
shows
our
thresholds
to
be,
let's
say
rather
conservative,
in
order
to
reduce
the
number
of
false
positives.
Q
When
we
did
so.
First,
look
at
the
data
we
had.
We
had
half
a
year
for
data,
and
this
is
what
it
looks
like.
So
the
basic
takeaway
here
is:
there
are
more
than
thousands
of
texts
every
day,
even
though
we
had
a
very
conservative
filtering
filtering
criteria
up
front,
we
had
also
case
study.
We
could
correlate
events
that
we
had
in
our
data
with
reports
that
were
on
the
on
the
news.
Q
Another
takeaway
here
is
basically
that
we
have
a
site
at
which
the
traffic
volume
exceeds
well
beyond
10
gigabits
per
the
attack
Vector,
so
that
is
locally
easy
to
detect
as
such,
because
that
is
very
likely
to
be
unwanted
traffic,
but
for
the
other
sites,
for
example,
we
have
here
ce2
Central,
European
2,
the
ixp
there,
where
the
local
detection
would
not
be
feasible,
but
still
it's
carrying
the
attacks
traffic.
That's
basically
my
motivation.
We
have
to
we
have
here
further.
Q
You
can
see
the
complexity
of
the
attack
vectors
themselves,
so
you're
using
a
couple.
Ports
like
53,
cldap
and
other
protocols
like
they
are
very,
very
much
mixed
and
very
different
protocol
attack
vectors
involved
in
one
attack
all
right.
The
question
is:
how
accurate
are
we
with
that?
Because
we
wanted
to
reduce
the
amount
of
false
positives,
so
we
we
compared
what
we
found
to
be
an
attack
event
with
the
benign
data
that
was
all
the
data
that
was
not
caught
that
was
caught
by
a
filter.
Q
We
find
that
all
the
three
lines
for
the
benign
data
are
stuck
to
the
top
left
corner,
whereas
the
attack,
the
data,
shows
a
more
I
would
say,
a
more
diverse
picture,
meaning
that
there
are
more
sites
involved
with
more
different
plot
combinations
involved.
But
if
it's
just
a
single
site
involved
and
it's
benign
data,
it's
the
top
left
so
now
slides
of
flip.
Next,
we
fired
up
self-attacks
and
I'll
get
some
ground
truth,
so
we
attacked
our
own
infrastructure.
There's
an
ethical
consideration
section
on
the
paper
on
that.
Q
We
can
definitely
chat
about
that
if
you're
interested
in
what
we
actually
did
to
derive
actual
attack
data
and
compare
it
to
what
we
classify
as
such.
So
by
that
we
derived
lots
of
features
here
on
the
left.
You
have
got
some
exemplary
ones.
We
have
1146
features
derived
different
statistics
like
the
amount
of
ports,
the
duration
of
the
attack
and
so
forth,
and
then
we
did
in
a
principal
components,
analysis
on
the
features
that
were
resulting
to
the
right.
Q
You
can
see
the
top
three
pcas
being
plotted
and
we
did
clustering
on
that
and
what
we
see
is
a
clear,
visible,
visual
separation
of
the
benign
tags.
That's
a
small
green
bump
somewhere
in
the
middle
and
all
the
attacks
are
very
well
clustered
and
all
of
the
self-a
text
fall
exactly
into
what
we
call
attacks.
Q
Q
In
the
center
of
the
figure,
we
can
see
a
very
strong
correlation
between
the
blue
and
the
and
the
red
packet
sizes
that
we
observed,
whereas
the
benign
data
is
basically
all
over
the
place
so
once
again,
a
clear
separation
of
our
a
clear
visual
separation
of
what
we
call
the
line
and
what
we
call
attack
traffic
so
another.
Now
that
we
are
confident
with
our
data,
we
can
now
measure
what
we
actually
want
to
answer.
Q
First
of
all,
we
dug
into
the
distance
analysis,
so
that
is
seen
from
the
route
server,
so
we
have
a
flow.
We
we
consider
to
be
an
attack
and
seen
from
the
route
server
of
the
ixps.
We
were
counting
the
Hops
that
it
took
from
this
IP
address
from
the
reflector
to
get
to
the
XP
and
then
to
whatever
IP
address.
It
is
destined
how
many
hops
were
there
from
the
route
service
view
to
get
there.
Q
I
know
that
this
is
assumes
some
kind
of
some
some
some
caveats
or
some
some
drawbacks
like
semantic
routing
routing,
but
so
these
numbers
need
to
be
taken
with
a
grain
of
salt.
Nevertheless,
if
we
assume
that
all
of
the
peers
adhere
to
what
the
route
service
are
saying,
we
could
derive
that
at
least
for
45
of
the
attack.
Q
The
the
volume
originates
from
a
direct
member
of
the
ISP,
so
the
isps
are
very
close
to
the
reflector,
meaning
that
they
are
a
very
good
strategic
position
to
drop
the
traffic
early
and
also
for
about
70
of
the
attacks.
We
found
that
the
the
target
is
just
two
hops
away,
so
also
meaning
that
we
are
close
to
the
Target.
Q
Well,
let's
take
take
away
that
we
are
well
connected,
I
guess
all
right.
Next
thing
we
were
measuring
the
collaboration
benefits.
So
now
we've
got
lots
of
data.
We
can
now
pull
it
together
and
see
what
would
have
been
locally
seen
and
detected
as
an
attack
with
a
local
threshold
compared
to
if
we
combine
all
of
the
data
and
then
apply
the
same
threshold
and
then
look
at
what
exp.
Now,
with
the
global
view
of
that,
traffic
had
been
detected
as
an
attack.
Q
So,
first
of
all
here's
a
graph
that
is
the
ground
truth.
If
we
combine
all
of
the
data,
we've
got
for
each
of
the
isps
that
we
have
to
the
very
left.
We've
got
all
of
them
combined,
so
that
is
the
100
000
attacks
that
we
could
or
events
we
could
derive
from
our
data.
Next,
we've
got
all,
but
the
largest
one
that
is
ce1
just
for
a
comparison,
and
then
we've
got
all
the
individual
sites
which
are
actually
carrying
attack
traffic
as
per
the
global
detection.
Q
For
example,
you
can
see
The
prominent
ones,
I
think
is
ce3
where
basically
none
of
the
actually
with
the
global
view,
detectable
attacks
are
being
detected,
not
even
by
100
megabits
threshold.
For
the
very
for
the
far
right,
one
C1,
because
it's
the
largest
one,
it
sees
basically
as
much
as
we
see
with
the
combined
data
for
sure,
but
C3
and
C4.
They
basically
do
not
detect
any
of
the
attack
traffic
that
they
are
actually
carrying
as
such.
Q
So
what's
a
collaboration
benefit
for,
let's
say
100
megabits,
with
the
global
threshold
compared
to
a
local
one,
and
this
graph
depicts
the
amount
of
missed
traffic.
So
now
they
are
reordered
for
the
ones
to
the
left
that
missed
the
most.
If
I
compare
this
to
to
the
to
the
globally
detectable
traffic,
we
find
that
for
some
sites
we
we
see
that
80
of
the
traffic
is
locally
undetectable
for
this
certain
threshold
and
then,
if
we
apply
other
thresholds,
we
even
find
a
worse
picture
for
se3.
Q
Next,
in
order
to
exchange
all
the
information,
we
are
proposing
an
exchange
platform
on
that
this
is
the
overall
picture:
let's
go
through
this
slowly
and
start
with
the
top
part,
which
is
basically
what
it
matters
or
a
similar
Endeavors
are
doing
to
date.
There
is
a
government's
body
on
top
because
we
do
not
believe
that
things
like
trust
models
and
stuff,
or
things
like
that
can
be
carried
out
by
machines
only
so
this
needs
manual
or
human
involvement.
Q
So
that's
why
we
propose
this
government
body
that
lives
on
top
of
it
and
they
Define
filters
and
thresholds.
They
are
more
or
less
building
a
community
just
likewise
to
the
ixps
community,
because
you
know
more
more
peers
accumulate
an
ISP.
The
more
community
grows
and
more
attractive
becomes
for
other
peers
same
as
same
economy
systems
envisioned
here.
So
the
more
people
are
involving
in
the
DDOS
information
exchange,
point
the
dxp,
the
more
value
or
more
attractive
it
might
become
to
others
to
join.
Q
We
believe
that
there
there's
a
need
for
contracts
in
order
to
get
off
this
running
smoothly,
so
the
government's
body
handles
slas
and
also
processes
abuse
cases
for
a
center
part.
We
have
two
dxp
members
to
the
left
and
to
the
right
in
the
center.
We've
got
the
information
exchange
point
for
itself
and
what
they
basically
do
is
when
they
choose
to
collaborate
with
the
with
the
dxp,
so
they
become
a
member
of
it.
Q
That
is,
the
solution
destination
IP
address,
as
well
as
the
volume
and
the
attack
vectors
of
the
ongoing
attack.
Lastly,
we
quantify
the
benefit
of
that
to
the
left.
You
can
see
an
evaluation
of
the
scenario
of
a
low
trust
information
exchange
and
what
we
see
is
a
clear
benefit
for
all
of
the
sites.
We
have
once
again
the
red
bars
that
show
the
ground
truth:
data
of
the
actual
attacks
going
on
and
compared
to
what
we
saw
before
now.
Q
There
are
lots
of
more
bars,
otherwise
you
covered
than
red
appearing,
meaning
that
they
can
now
see
more
than
before,
more
of
the
attacks
than
before,
just
by
exchanging
the
information
short
hint,
maybe
on
the
boosted
factor
to
the
left.
What
does
that
mean
is
because
the
ixps
only
see
the
reflector
IPS,
as
I
just
explained,
they
might
not
see
all
of
the
traffic,
because
maybe
the
shared
reflector
IPS
are
not
in
not
visible
at
alert.
It
is
local
ISP.
Q
Q
Next,
we
found
that
80
of
the
globally
detectable
attacks
would
have
not
been
detected
locally
because
of
the
various
ISP
sizes,
and
we
found
that
about
45
of
reflectors
are
just
the
next
half
of
the
ixp,
so
that
once
again,
emphasis
emphasizing
on
the
Strategic
role
or
the
useful
role
in
the
position
of
the
ISP
and
along
the
path
that
dropped
the
traffic
early.
And
lastly,
we
post
the
dxp
will
show
that
90
of
more
attacks
can
be
detected
local
to
due
to
the
collaboration
of
the
sites.
Q
I
hope
that
this
somehow
gave
you
some
interesting
thoughts
on
on
collaboration
and
exchanging
information
and
exchange
information
between
ixps
in
order
to
maybe
have
a
chat
on
that
and
maybe
standardize
some
things.
I
know
that
they're
here
in
the
ietf
there
are
some
Endeavors
ongoing
on
such
information.
Exchange,
proposals
or
Protocols
are
alike,
I'm
very
happy
to
have
any
conversations
on
that
and
hope.
I
finished
more
or
less
in
time,
because
I
know
all
of
you
are
hungry
and
no
one
gets
something
to
eat
and
by
that
I
want.
Q
A
A
R
B
Q
Q
Q
Now
this
is
once
again
confirmation
confirmation
but
sensitive
data
that
needs
to
be
governed
and
there's
need
for
an
exchange
and
of
information
on
on
that
again,
but
the
overall
Endeavor
is
to
mitigate
or
be
prepared
for
Adidas
attacks
before
they
even
arise,
derived
from
scanning
activity
that
we
can
see
at
the
ixt.
Please
don't
steal
my
ideas
not
published
yet
thanks.
C
Hi,
so
from
what
I
understood,
it
looks
more
like
you're
looking
at
volumetric
attacks
at
this
point
of
time,
where
this
kind
of
a
thing
would
work
so
any
thoughts
on
application
layer
attacks
because
from
DDOS
the
volumetric
is
kind
of
deviate
you
and
then
the
real
Attack
is
your
application
layer
attack
where
the
scrubbing
Center
comes,
plays
a
major
role.
So
that's
my
first
question:
can.
Q
I,
pull
up
come
on
after
that,
because
I
don't
like
double
questions.
I
always
forget
the
first
one.
Very
shortly
is
yes,
we
are
looking
at
volumetric
attacks
that
is
amplification
data's
attacks,
because
the
type
of
data
we
can
get
at
the
ixps
like
very
hard
sample,
huge
sampling
factors
and
usually
aggregated
so
things
like
packet,
packet
attacks
or
student
attacks
in
floods,
or
some
case
like
that
they
are
just
not
visible
with
the
database
that
we
have.
Q
We
are
looking
at
volumetric
attacks
because
they
are
from
the
database
that
we
have
more
or
less
the
easily
I
wouldn't
say
easy,
but
they
are
derivable
at
all
other
attack
vectors
are
either
invisible
or
our
sampling
methods
that
we
have
to
apply.
They
just
do
not
allow
for
any
specific
other
things
like
that.
So
amplification,
Adidas
attacks
are
the
the
low
hanging
fruit
to
look
at
up
front.
Q
We
might
someday
maybe
invest
more
time
in
digging
into
other
stuff
or
GPU
other
layers
problem
with
other
layers
is,
we
do
not
see
them
at
all,
so
application
layer
is
absolute
no-go.
It
has
no
way
to
get
there
layer.
4
information
is
what
it
was
quite
a
bit
of
a
struggle
to
to
achieve,
but
we
could
do
this
now
eventually,
but
layer
7
is
no
way
for
us
to
have
any
information
on
that
second
question:
please.
C
And
I
think
you
kind
of
answered
it
because
my
question
was
more
on
with
increasing
encrypted
flows,
quick
adoption
and
all
of
that
the
visibility
is
actually
going
to
be
much
lesser,
even
for
isps
so
in
that
context,
where
do
you
see
the
DDOS
attack
detection
going
and
any
thoughts
or
any?
Do
you
have
any
plans
on
how
to
handle
that
problem
like
given
that
you
don't
have
visibility
at
this
point?
Yeah?
Maybe.
Q
Yeah
I'm
not
sure,
with
regard
to
extending
the
visibility.
I
think
this
is
yeah.
Basically
not
nothing.
I
can
influence
I
think
we
also
can't
do
this
with
our
members.
We're
just
not
allowed,
because
it's
due
to
laws
and
I,
say
I
would
use
what
we
have
so
far
and
make
the
best
of
it
and
other
layers.
On
top
of
that,
I
don't
think
we
will
ever
look
into
that
got.
D
D
A
All
right,
thank
you,
Daniel.
Thank
you
to
all
of
the
speakers.
Three
fantastic
talks
this
time,
a
reminder
that
the
nominations
for
the
2023
applied.
Networking
research
prize
are
open.
So,
if
you
know
of
any
good
work,
any
interesting
people
any
interesting
papers,
please
do
nominate
nominations
closed
at
the
end
of
next
week.
Thank
you.
Everybody.