ie8 fix
madison

Zero Day

Ryan Naraine, Emil Protalinski and Dancho Danchev

DHS incorrectly associates 84,000 web sites with child pornography

By | February 17, 2011, 1:19am PST

Summary: DHS Security Immigrations and Customs Enforcement incorrectly knocked out some 84,000 web sites attempting to seize domain names associated with child pornography, then glossed over the fact that it happened.

On February 15th a joint project of the Department of Homeland Security Immigrations and Customs Enforcement (ICE) and the Department of Justice termed “Operation Protect Our Children” confidently announced the seizure of ten domain names involved in the advertisement and distribution of child pornography. What they failed to mention was that they also knocked out a popular shared domain by mistake, resulting in, according to TorrentFreak, some 84,000 web sites being taken down and redirected to a banner mentioning child pornography.

What Happened?

Free DNS is a service that provides free DNS hosting, subdomain, and domain hosting among other services. The most popular subdomain offered by the service, mooo.com, was accidentally caught up in the ICE sweep of domains taken down.

Subdomains available from Free DNS.

Subdomains available from Free DNS.

That left legitimate sites such as http://greyghost.mooo.com redirecting to an ICE web page with this banner, telling visitors “Advertisement, distribution, transportation, receipt, and possession of child pornography constitute federal crimes that carry penalties for first time offenders of up to 30 years in federal prison, a $250,000 fine, forfeiture and restitution”:

The banner users were presented after the URL they visited redirected.

The banner users were presented after the URL they visited redirected.

ICE is able to force this by first getting a District Court judge to sign off on a seizure warrant, and then having the domain registrars re-point the domains to their server hosting the warning banner. At 7:07 on the 12th, the following message was posted by Free DNS after realizing what happened:

Message appearing on freedns.afraid.org on the 12th.

Message appearing on freedns.afraid.org on the 12th.

Operation In Our Sites
ICE launched their initial endeavor in domain seizures last year under “Operation In Our Sites”, aimed at seizing the domain names of those who infringe on copyrights. Legitimate criticisms of these seizure tactics included targeting web sites that claimed (with paperwork) they were not actually infringing on copyrights and investigations conducted by agents without adequate training or experience. For example, ARS Technica noted one definition from an affidavit provided by an ICE agent that read as follows: “A Bit torrent (referred to in short as ‘torrent’ or ‘torrent file’) is a files distribution system used for transferring files across a network of people.” The lack of technical understanding present in an investigator who is then providing direct input into which domains will be taken down is of concern.

Finally
Site owners in this most recent case were presented with the unenviable task of explaining to visitors that they had no affiliation with child pornography. Since these are personal web sites, blogs, and small businesses, this is material to some of the site owners.

This screw up in a well intentioned, but overreaching and ham fisted, government legal action on the Internet comes at a time when legislation requesting further capabilities, such as an “Internet Kill Switch”, is being discussed. Such screw ups, and glossing over them in reporting on the project, do not serve to strengthen ICE’s ability to be successful in future enforcement actions on what is the very serious problem of dissemination of child pornographic material on the Internet.

Kick off your day with ZDNet's daily e-mail newsletter. It's the freshest tech news and opinion, served hot. Get it.

Topics

Daniel Kennedy leads initiatives in policy and operational security management, directs strategy on risk assessment and certification, and is head of business continuity planning and disaster recovery at Praetorian Security Group, LLC.

Disclosure

Daniel Kennedy

Daniel Kennedy is a part owner of the information security consulting firm Praetorian Security Group, LLC. He has some stock in Bank of New York, and a standard 401k invested in various mutual funds.

Biography

Daniel Kennedy

Daniel Kennedy leads initiatives in policy and operational security management, directs strategy on risk assessment and certification, and is head of business continuity planning and disaster recovery at Praetorian Security Group, LLC.

Prior to Praetorian Security Group, Daniel was the Global Head of Information Security at D.B. Zwirn & Co. where he managed the firm's information security program. He was specifically responsible for the development, implementation, and maintenance of the firm's information security policies. He also managed security metrics reporting, the security awareness and education program, security incident response, security audit, and developing the firm's security technology strategy. In this role he worked closely with the firm's CIO, COO, head of compliance, head of legal, head of infrastructure, head of client services, and overseas IT managers.

Prior to D.B. Zwirn, Daniel was Vice President and Program Manager for the application security program at Pershing LLC, a division of the Bank of New York. Daniel's responsibilities included management of the firm's application security program, coordination of application vulnerability assessments and penetration testing, application security training, documentation of secure coding guidelines, and development of the firm's application security SDLC. He was the primary liaison for application security concerns between application development and teams such as the Information Security Office, Internal Audit, Information Risk Management (IRM), and the business teams. He served on several firm committees including the Infrastructure Security Workgroup, Security Architecture, and chartered and chaired the firm's Application Security Council, an interdisciplinary group consisting of application developers and information security subject matter experts.

His previous positions at Pershing included development management and systems' engineering positions building the firm's web applications for facilitating online brokerage. He has also been employed at Donaldson, Lufkin, & Jenrette Inc. in a technology analyst role for the Treasury area.

Daniel holds a Masters of Science degree in Information Systems from Stevens Institute of Technology, a Masters of Science in Information Assurance from Norwich University, and a Bachelors of Science in Information Management and Technology from Syracuse University. He is certified as a CEH (Certified Ethical Hacker) from the EC-Council, a CISSP, and has a NASD Series 7 license.

You can also follow him on Twitter as well as the blog Praetorian Prefect.

Related Discussions on TechRepublic

Did you know you can take part in these discussions with your ZDNet membership?
39
Comments

Join the conversation!

Just In

RE: DHS incorrectly associates 84,000 web sites with child pornography
moonlight583 17th Apr 2011
@Lerianis10
WTF!!?
0 Votes
+ -
Scary stuff
Tech watcher 17th Feb 2011
This is right out of Terry Gilliam's "Brazil." I'd say it's comical, but I don't find child pornography a laughing matter, especially if you're wrongly accused of its practice.
This article illustrates why extreme care is required in even alleging such involvement. Clearly that level of care is lacking here! Personally that possibility is enough that I have taken my personal web site off line.
0 Votes
+ -
RE: DHS incorrectly associates 84,000 web sites with child pornography
Hallowed are the Ori Updated - 17th Feb 2011
Why is the Department of Homeland Security involved in this?
@Hallowed are the Ori
That's what I was thinking, although after reading this: "...was accidentally caught up in the ICE sweep of domains taken down" - my thought was why is Immigration Enforcement in charge of a kiddie-porn investigation?
@Hallowed are the Ori

That's the first thing I wondered, too.
0 Votes
+ -
This espouses why DHS should not have this power
Lerianis10 Updated - 17th Feb 2011
They are willing to use it unconstitutionally, but not willing to do their due diligence to make sure that they are not taking down the right domain.

I also have to say that this is not a real problem. What the real problem is: the boogie-manning of pedosexuality in general. Just get off your ass and realize that it is a normal sexuality, and like any other normal sexuality, the bad things in it (forcing children into sexual encounters, etc.) is best taken care of by parents and others who watch the children to make sure that is not happening and legalization of the sexuality in question.
0 Votes
+ -
This would go against all social norms
terry flores 17th Feb 2011
@Lerianis10

So if your kid were attacked or abused, you would expect the parents to "take care of it"??? Would you expect the same if your kid was shot, run over, or robbed? I guess we don't need police after all, eh?
0 Votes
+ -
Are you SERIOUS!!??
seaczar63 17th Feb 2011
@Lerianis10

Spoken like a true pedophile,...
@seaczar63

And I bet you dismissed all of us who said that acceptance of homosexuality as "normal" would serve as the gateway to all kinds of sexual deviance becoming considered "normal"...
@Lerianis10 Wtf dude... Pedophelia should not be legal. The parents do not have the right to consent on behalf of the kid. People who do not have the mental capacity to consent to sex, namely children, are by definition being raped.

I hope you enjoy jail when the feds come for you, you sick sick puppy. You know what they do to pedophiles in jail right?
0 Votes
+ -
Actually,
midenginedrift 18th Feb 2011
@snoop0x7b

Actually, from my understanding (I did some research in to this awhile back when I was 19 and my gf was 17) the parents are the only ones who can consent for a minor. It's because they are a minor that they do not have the right to consent on their own.

Of course, anything that would considered abuse or neglect doesn't count, but what I'm trying to say is, if the parent had a problem with their daughter having sex with me, that's essentially non-consent by the parent.

There was some kind of 3 year difference leniency too, but that only applied if both kids were minors, not one being a minor and one legally an adult.
0 Votes
+ -
I hope you don't have kids
use_what_works_4_U 18th Feb 2011
@Lerianis10
If you think this is "normal sexuality" that parents need to "take care of" then I hope you don't have kids of your own because they would be in unfathomable danger. My siblings and I led a very sheltered life. Our parents were extremely protective, and yet my sister was abused by the local "Chester the Molester" while still in grammar school. I knew nothing of the incident for nearly 30 years. My mother didn't learn of the event until nearly a decade later, and my father not much before I did.

Parents cannot, as much as we try, protect our children from every possible danger 24 hours a day, 365 days a year. Pedophilia is an abhorrent, aberrant, and psychologically (not to mention physiologically) damaging tendency.

That you can defend such behavior sickens me.
@Lerianis10
WTF!!?
Hitler would be proud.
0 Votes
+ -
Department of Homeland Security
james347 17th Feb 2011
A complete hoax of a department created by Bush/Cheney to staff political cronies into another arm of the ever growing government. So yeah, I'm sure they can't figure out the difference between their nose-hole from a hole in the ground.
Oh please. The rank amateur currently inhabiting the White House shoulders the blame now... well, he should.
0 Votes
+ -
@james347
Your Obama is in charge now. I as well as most all of America has grown tired of your Bush conspiracy. I thought W. sucked also but when is the opposition to blame if ever ? How is this for conspiracy, maybe Bush was elected to destroy the GOP and put New World Order Bildabergers in charge. If not, when are all the benefits of electing this "professional community organizer" supposed to bear fruit. Bush had the Patriot Act and now Obama wants in charge of every known form of media known to man. Do you really feel he is any different ? Where is your proof ?
0 Votes
+ -
and it was democrats who forced Bush and republicans to create another layer of government. It was the democrats' penchant for more government that forced Bush's hand in accepting the DHS. And, with a new agency, there would come, more government jobs and more union workers, who are the bread-and-butter of democrat voting ranks.

The DHS was born during the Bush years, but it wasn't because Bush wanted it. Look up the news stories of the time and you'll learn something.
@adornoe@... Yeah, the democrats somehow, despite being in the minority in both the house and senate, forced him to do it! You tell him! Oh wait, your logic doesn't add up.
@adornoe@...
Bush built bigger government! I'm well aware of that. True conservatism would limit government, but the real problem today lies in people's insistence government can solve, or should be involved. Far from the truth !!!!!
0 Votes
+ -
argument.

It was the demonization which was in full swing right after 9/11, and the minority had as loud or louder voice in decision-making when the media was echoing all of the minority's talking points.

The logic has nothing to do with it, and what mattered more than anything else, especially to democrats, was the taking advantage of a crisis in order to get another level of government initiated and implemented. They argued vehemently about how the unions needed to retain control over many or most of the same rights that they used to have before a new agency could be created.

Like I said in my above post, look it up. It was the democrats that insisted on the DHS, and Bush and republicans mostly went along, with perceived need, at the time, for a DHS.

Don't get me wrong. Bush was the one that did the final proposal for the department, mostly because the president would be the one in charge of it, but the republicans in congress were adamantly against it since it would create yet another agency in the already bloated federal government. The feelings at the time were that, whatever work the new agency was to do, were already being done, but there was a need for better communications and exchange of information between the various federal agencies which had the responsibilities to enforce the laws and protect citizens.

Nevertheless, people forget with time, and the arguments and counterarguments, and the justifications and rationalizations are forgotten with time. History tends to record the events, but not the arguments of the times. What many people use as arguments to make their points is, who was the "leader" or president at the time. Sort of like the same way that Bush is blamed for the economic collapse because he happened to be president at the time of the collapse. Never mind the history which preceded the event, and the real and long-established causes for the event.
@james347 Also created as a unon-busting tactic.
0 Votes
+ -
What does that mean?
adornoe@... 17th Feb 2011
n/t
0 Votes
+ -
This is one of the next "War on" labels
terry flores Updated - 17th Feb 2011
"War on Poverty, "War on Drugs", "War on Terror", "War on ..."

All of these are just labels used to demonize something and justify unfettered government authority. At my kid's school it's "War on Obesity" and the latest crackdown is against junk food. "We need authority to take away candy and junk food that a child might have brought in from the outside, even if that junk food was given to the child by the parent." Needless to say, many parents are not happy that some school employee now becomes the ultimate arbiter of what their kids are allowed to eat!

Child porn is kind of like terrorism, in that it can be used to argue that the ends justify the means. It does not matter how many people are "inconvenienced" in the process, it's okay to take 84,000 unoffensive websites if it gets just one bad website off the web. And like terrorism, we're completely dependent on the authorities to tell us how bad the problem is. I've seen articles saying that the child porn industry is bigger than General Motors and affects 40 million kids a year. This is really hard to believe without some kind of proof.

I don't believe there is any justification for going around the legal protections of the Constitution. The stigma attached to even an accusation is enough to destroy a person's career, family, and future. My department is tasked with checking all PCs turned in for repairs or disposal for "inappropriate use". We've fired a number of people who had porn on their computer, but thankfully we've never run across any cases of child porn. But it always makes me concerned how easy it would be to destroy somebody's life if somehow child porn magically appeared on an employee's or executive's computer.
0 Votes
+ -
Grab your junk food
Robert Hahn 17th Feb 2011
This from the same Department that wants to grab your crotch before you can get on a plane.
I say Sue them for their incompetency.
Any such action should require the signature of a VERY senior official. That official would be given 1 week of time to fire everyone who assured him/her that the information was correct and the action was justified. Then that official would resign or also be fired. Power to inflict damage without accountability does not belong in our government.
0 Votes
+ -
To a man with a hammer
CodeCurmudgeon 17th Feb 2011
Every problem looks like a nail.

To a man with an army, every problem looks like a war.
0 Votes
+ -
@CodeCurmudgeon

What I'd give for a Panzer division right now though.
Another typical government screw-up!
This is hilarious, sad, and bad. because a random domain gets taken down for no reason, resulting in an epicly hilarious fail.
0 Votes
+ -
can I haz me sum gubmint?
wizardjr 17th Feb 2011
Wow oh wow! Can we get these folks to manage our healthcare system too? Just the folks we need... Hmmm?

These hamfisted jerkoffs let 800 violent felon illegal aliens back into the Amerian streets. Now they trash 84,000 legitimate web sites and pwn them with child porn labels. What's next, randomly taking citizens off the streets for Gitmo because "someone" said they heard that "a source" said that a terrorist was in the area?
[what's that knocking at the door... whose black SUV's are those...?? oh my!]
"We're from the government and we're here to help you."
This comes as little surprise to me. This is a serious crime unfortunately most everyone that I?ve read about that were involved with the investigations are lacking in technology skills, this include the judges, prosecutors, FBI, postal agents, local police, and others. Yet the crime is so high rated this lack of knowledge has not stopped their aggressive agenda.
I?ve read of many poor souls that end up victims of this witch hunt tactic and I feel sorry for them if they truly have been hacked, and those still doing peer to peer are very vulnerable. Because this is a case where you are guilty merely by association and your name may never be cleared regardless of the outcome.
Yeah, ICE can't keep illegals from flooding across our borders, but they can spare agents, money and time to go after alleged child porn sites.

DHS is supposed to deal with the terrorist threat, not ordinary crime.
Well, according to Fabrice Prigent's list they either DO or did have some porn sites:

********.mooo.com
pleasures.mooo.com
porn.mooo.com
0 Votes
+ -
According to Fabrice Prigent's list they either do or did have some porn hosts:

********.mooo.com
pleasures.mooo.com
porn.mooo.com

There are probably more. The problem with services like this is that they can end up being trash zones without some very firm policies on what is permissible and some very active policing by the service provider. Even if you have firm policies, for example like BlogSpot.com, the only way they have of reporting objectionable content is to click on the report button. Sounds great, right? Wait until you hit the *.blogspot.com that are nothing more than malware redirectors. There is no way to report them since you are at the *.blogspot.com for only a few milliseconds! That is why they end up in block lists and it is difficult to tell whether or not the situation is cleared up or not. I do have scripts that test whether they are still active or not but the problems can remain for years. I AM NOT KIDDING! I have even had to report to Google malware that was stuffed into their cache. IOW, the matter isn't nearly as clear cut as you think it is. How in the world are you going to know what is on all 84.000 of those web sites? How many of them are in the mooo.com domain? Without some way of policiing mooo.com thoroughly you never kinow everything that is there. One person could very easily sneak in objectionable content and foul it up for all of the other legitimate people. Also one of the favorite ploys of hackers is to have legitimate web-sites that have been hacked serving up both malware and porn. Without a thorough vetting of all the subdomains in the mooo.com domain you have no idea what you have.

What could have happened is that somebody did start child porn hosting at mooo.com. It got into the DHS lists somehow. Then mooo.com found out about it by one of the members reporting it and removed it. But by then the damage is done. About the only way this will work for these free services is some pretty strict content policies and one of them is no porn, child or otherwise. If somebody wants a porn domain, tell them to host it on their own dime. That still leaves the service with the headaches of policing it. I just got complained to by one of these free content services. What was being served? Malware that had a file name that was a fully qualifed Windows XP name. I did submit it to the AV companies since Symantec didn't detect it. Even though they removed the malware their email message complained I had no right to comment since the content was not mine. That is due to the DMCA. Get the idea? What is my response going to be? From now on I will never again report malware to them again. Evidently that is what you want me to do as well.

Disclaimer. I have no affiliation with the DHS, or any other government organization, US or otherwise. All I have is filters that nobody uses provided under the GPLv2 license:

http://SecureMecca.com/
http://HostsFIle.org/
0 Votes
+ -
There is a little bit more to this than you think. Here is an incomplete analysis of just mooo.com using the hosts in the domain in the lists from my friend Airelle in France and the detached sig file proving that yes, it is not the spammers on the same web service I am at that put it there:

http://securemecca.com/public/mooo_mooo.txt
http://securemecca.com/public/mooo_mooo.txt.sig

Very likely one or more of the subdomains at mooo.com was serving child porn because several were serving malware. I have NO affiliation with the DHS or any other governemen organization. I just make free filters under the GPLv2 license.

But you have another problem. The anti-bot malware software from Dambala is now doing the same thing (censorship) at Comcast that DHS just did. I am attached to the Internet via Comcast. But that gives me a chicken versus the egg problem. I cannot verify instantly whether the blocking I am getting is Dambala, or the service (see the note on looo.mooo.com) giving me that error page right off hand. mtr just assured me it isn't Dambala this time. The problem is I don't have time to fire off mtr on every web-site out there. This time there is some sort of path problem preventing me from getting there. But I don't have time to look at each one in minute detail. My block list is quite short but I have no idea how Airelle handles a million hosts. I just hope mooo.com and the others that really do have a problem look at their problems and fix them. Maybe this was needed just like shutting down the entire California state because CALTRANS wouldn't listen to a security researcher. That gives me a breather. I hope Dambala is getting it right because I am NOT going to fight them to determine whether or not something is still bad. Thus my filters are going to be dependent on MalwareDomainList getting it right because the PAC malware rules will come from what they have. If the rule gets in your way, white-list your way out of it or delete the rule and live more dangerously. I am going to concentrate on trackers, web-bugs and ad servers. Dambala lets those through.

All I wanted to say is that it is very likely with a 70% turn around of hosts at MalwareDomainList being marked as bad being either fixed or gone in 30 days, I strongly suspect that is what is going on here is that many of these hosts were infected or serving child porn for a brief amount of time. For most of them it may have been unintentional. But if the DHS has the same problem I have, almost nobody replies. If they don't care about fixing the problem, what am I or the DHS supposed to do? Listen to them crying foul because they didn't want to fix the problem before now? Oh yes, just because the DHS marks a domain as serving porn doesn't mean much too me. I wget porn stuff to prove the issue anyway. Wo unto those hosting porn that wander into my lists due to malware! They end up staying in my lists. BTW, my PAC filter blocks this URL. So the user has to decide, do I white-list ZDNet and allow their trackers (I have all of them I think) through or do they drop that "porn" PAC filter rule from URL to host status? I would NOT dump it! It is there to block not porn but malware and has hundreds of times in the past for me. But it causes FPs! The reason for a GPLv2 licensing is so you can intelligently adapt the PAC filter to meet your own individual needs. Au Revoir.
0 Votes
+ -
CENSORSHIP at ZDNet!
hhhobbit 20th Feb 2011
You have blocked two of my comments on this subject that is ignoring the facts that I am presenting. Because you are blocking what I am trying to post I am taking it out of this FASCIST forum and putting it on my blog here:

http://SecureMecca.BlogSpot.com

Even an idiot can look at those comments and see that censorship is taking place here. I am sending this on to SANS and others. We are not going to get to the bottom of this with some outright blatant lies being put out by ZDNet! It seems my comments are being blocked solely because it doesn't agree with what this writer wants to do. Give me the list and I will analyze just how good they really are. What I suspect is that most of them may at one time unintentionally hosted something bad due to the web server where they were at being hacked.

I am getting really mad at this blatant outright fascist refusal to consider the facts on the part of ZDNet and especially Daniel Kennedy.
@hhhobbit I don't get to moderate the comments.

Join the conversation!

Formatting +
BB Codes - Note: HTML is not supported in forums
  • [b] Bold [/b]
  • [i] Italic [/i]
  • [u] Underline [/u]
  • [s] Strikethrough [/s]
  • [q] "Quote" [/q]
  • [ol][*] 1. Ordered List [/ol]
  • [ul][*] · Unordered List [/ul]
  • [pre] Preformat [/pre]
  • [quote] "Blockquote" [/quote]
ie8 fix
Click Here
ie8 fix

The best of ZDNet, delivered

ZDNet Newsletters

Get the best of ZDNet delivered straight to your inbox

Facebook Activity

White Papers, Webcasts, & Resources
ie8 fix
ie8 fix