DNS Abuse SIG

Code of Conduct

While we will always do our best to resolve any disputes without having to resort to rules, sometimes it does help to have a Code of Conduct. Accordingly: all members are expected to comply with the FIRST Code of Conduct as written up here:

• https://www.first.org/about/policies/code-of-conduct

The scope of this Code of Conduct applies to all SIG activities. ("This Code of Conduct explains expectations for anyone participating in these events, including delegates, guests and speakers, FIRST staff and all others involved. It applies to physical events, as well as any online events such as video and voice calls, mailing lists and chat channels.)

It's also worth noting that prohibited behavior includes "disrespecting confidentiality, e.g. not adhering to Traffic Light Protocol (TLP) labels" and that, per above, SIG activities are understood to be TLP:AMBER unless otherwise noted.

In addition to the points detailed in the FIRST Code of Conduct, we also expect members to only speak on behalf of the SIG if the SIG has agreed beforehand.

SIG members should note that consequences are also spelled out in the FIRST Code of Conduct, including "temporary ban or permanent expulsion from the event without warning."

Other policies

Information sharing policy

The default information sharing policy is for all members to be bound by TLP:AMBER as defined here:

• https://www.first.org/tlp/

Specific documents or pieces of information can be reclassified under general consensus of the SIG. Members should mark with the correct TLP any information they share with the SIG from outside the SIG.

Affiliation Changes

If a member changes their affiliation, tell the SIG chairs. If a member transitions between a FIRST member organization and a non-FIRST member organization, or from a non-FIRST member organization to another non-FIRST member organization, the SIG chairs will evaluate the transition as application as a new member.

• DNS Abuse SIG
  • Stakeholder Advice
    • Detection
      • Cache Poisoning
      • Creation of Malicious Subdomains Under Dynamic DNS Providers
      • DGA Domains
      • DNS As a Vector for DoS
      • DNS Beacons - C2 Communication
      • DNS Rebinding
      • DNS Server Compromise
      • DNS Tunneling
      • DoS Against the DNS
      • Domain Name Compromise
      • Dynamic DNS (as obfuscation technique)
      • Fast Flux (as obfuscation technique)
      • Infiltration and exfiltration via the DNS
      • Lame Delegations
      • Local Resolver Hijacking
      • Malicious registration of (effective) second level domains
      • On-path DNS Attack
      • Stub Resolver Hijacking
  • Code of Conduct & Other Policies
  • Examples of DNS Abuse