Deleting Your Domain? Preventing Data Leaks at TLD Scale

Preventing data leaks at TLD scale: a system called LEMMINGS detects and alerts domain owners to potential data leaks when their domains are deleted, protecting sensitive data and minimizing disruption.

Key takeaways

Data leaks due to deleted domains are still a real issue, with 0.13% of all deleted domain names using the cancel/delete process.
Deleting a domain without notice can lead to data leaks, as previous owners may not be aware that their domain no longer exists.
The process of canceling a domain, known as “cancel/delete”, is linked to a quarantine state where the domain is made unavailable to prevent further use.
A data platform using Hadoop was developed to analyze DNS data, web crawler data, and abuse feeds to detect potential data leaks.
The system, called LEMMINGS, filters out noise by using static and dynamic filters, such as IP address filters, AS number filters, and email marketing company filters.
LEMMINGS has a success rate of 80% in alerting domain owners of potential data leaks.
The system aims to minimize the number of alerts sent out to domain owners.
Not all registrants can be reached, as some use zone email addresses or privacy proxies.
There are still some questions and considerations around the system, such as how to handle domain name registration and email server linking.
LEMMINGS is designed to be used across different TLDs, but it is currently only implemented in the .nl TLD.
The system is not foolproof and may not catch all data leaks, but it has shown effectiveness in alerting domain owners to potential issues.

Deleting Your Domain? Preventing Data Leaks at TLD Scale

More talks