Show notes
According to a Microsoft research, a new type of domain name is ripe for fraudsters to abuse.
Microsoft's new Digital Defence Report features a rogue's gallery of cyberthreats such as phishing, ransomware, and supply-chain intrusions. However, it introduces a new foe to the mix: blockchain domains.
In Microsoft's latest annual security report, domain names inscribed into a distributed ledger maintained across a constellation of machines rather than housed in a traditional, centralised registry are referred to as "the next major threat."
When domain names are stored on a blockchain, they can be difficult to shut down or to trace to their owners. It also renders them unavailable without the use of specialised software or configuration.
"In recent years, we have observed blockchain domains incorporated into cybercriminal infrastructure and activities," the paper states, referring to Microsoft's experience dismantling a botnet known as Necurs last spring.
That botnet employed a domain-generating algorithm to generate new hosts in bulk, including under the.bit blockchain top-level domain, rendering them unpoliced in the same way that a.com or other standards-compliant domain would be.
Because of the possibility of abuse, a group called OpenNIC, which advocates alternatives to the existing domain-name system, voted in 2019 to prohibit the.bit domain, fearing that the organisation would be "directly responsible for the birth of a whole new kind of malware."
"This trend of dangers employing blockchain domains as infrastructure with the means to establish an undeniable criminal network should be taken carefully," adds Microsoft's research.
CAN'T GET THEM TO STOP
Meanwhile, among supporters of a decentralised internet, there is a popular answer to the criticism that blockchain names cannot be removed: That's exactly right.
According to the sales pitch on the webpage of one blockchain-domain registrar, Unstoppable Domains, "Unlike traditional domains, Unstoppable Domains are totally owned and controlled by the user with zero renewal costs ever (you buy it once, you own it for life!
It lists one-time registration rates ranging from $20 to $100 for blockchain top-level domains like as.crypto,.wallet,.coin,.888, and.x, but costs can skyrocket for shorter, more memorable domains. Potomacriver.x, for example, would cost $100, whereas potomac.x would cost $7,500.
Unstoppable Domains CEO Matthew Gould responded via email, dismissing the notion that his San Francisco-based company is an irresponsible actor. He mentioned the company's trademark-compliance regulations (it wouldn't let me start registration fastcompany.x because it said it was "protected") and applicant-screening procedures.
"We have also prevented the registration of domains associated with known pirating software or other types of IP theft and fraud," he wrote, adding that Unstoppable can even take back a domain if registrants park it with its custody service rather than transferring it to their own cryptocurrency wallet—the former being an easier route that roughly 75% of registrants take today.
Gould also argued that blockchain domains would improve trust in cryptocurrency transactions rather than decrease it.
"Anonymous people like to generate new addresses every time since it is great practise," he wrote. "Domains establish a single memorable non-changing endpoint, which reduces the anonymity of cryptocurrency payments."
Microsoft refused to comment further on the report's conclusions.
REQUIRES A SPECIAL BROWSER
While blockchain domains have been exploited for malware, Sean Gallagher, senior security researcher at Sophos, stated in an email that their need for bespoke routing rendered them an ineffective option for such assaults, because malware can't spread via standard web browsers that don't support the domains. He also pointed out that blockchain domains provide less privacy than Tor, the cloaked routing method used to avoid many censorship regimes: "They don't provide anonymity for the destination."
The simplest method to navigate to a blockchain domain, such as brad.crypto—Unstoppable Domains cofounder Bradley Kam's online space—is to utilise one of the few browsers that already support that namespace, such as the Chrome-based, privacy-optimised Brave. Enter brad.crypto into Brave's URL bar, click to accept the blockchain routing, and you should view Kam's gallery of non-fungible token (NFT) artwork.
Kevin Werbach, a professor at the University of Pennsylvania's Wharton School, said he doubted browser support for blockchain domains would spread anytime soon, despite the fact that he'd recently registered kwerb.eth (that suffix references another blockchain domain system, the Ethereum Name Service).
"Google, Apple, and Microsoft aren't going to provide native support unless they're confident that those concerns will be addressed," he wrote. As a result, adoption will be contingent on people's willingness to switch browsers, instal browser extensions, or custom-configure DNS settings—the latter two practises being the types of fiddling that malware occasionally exploits.
"DNS has security flaws that are partly related to its centralised structure," Werbach explained, "but putting domain names on a blockchain introduces a new set of security issues." "I don't believe we know enough about the size of the relative dangers to make categorical claims."
The current frothiness of cryptocurrency and blockchain mania is cause for concern.
Mike Masnick, founder of the Techdirt tech-policy blog and proponent of a more decentralised social internet, praised the potential for blockchain domains to "create both a different kind of incentive structure and one in which users may retain more control over their own information."
However, he went on to say that the blockchain space today is "almost entirely populated by mercenary folks looking for profit, which has some useful elements—in terms of bringing in funding and incentivising certain behaviours—but also has the real potential for prioritising pure profit over societal benefit."
Masnick didn't draw any comparisons between his work and today's commercial social media. However, why should he?
Support us!
Our TOPPODCAST Picks 
Stay Connected
