Enlarge / All you really have to do is set your DNS to 9.9.9.9. (credit: GCA/ Quad9)
The Global Cyber Alliance (GCA)—an organization founded by law enforcement and research organizations to help reduce cyber-crime—has partnered with IBM and Packet Clearing House to launch a free public Domain Name Service system. That system is intended to block domains associated with botnets, phishing attacks, and other malicious Internet hosts—primarily targeted at organizations that don’t run their own DNS blacklisting and whitelisting services. Called Quad9 (after the 9.9.9.9 Internet Protocol address the service has obtained), the service works like any other public DNS server (such as Google’s), except that it won’t return name resolutions for sites that are identified via threat feeds the service aggregates daily.
“Anyone anywhere can use it,” said Phil Rettinger, GCA’s president and chief operating officer, in an interview with Ars. The service, he says, will be “privacy sensitive,” with no logging of the addresses making DNS requests—”we will keep only [rough] geolocation data,” he said, for the purposes of tracking the spread of requests associated with particular malicious domains. “We’re anonymizing the data, sacrificing on the side of privacy.”
Intelligence on malicious domains comes from 19 threat feeds—one of which is IBM’s X-Force. Adnan Baykal, GCA’s Chief Technical Advisor, told Ars that the service pulls in these threat feeds in whatever format they are published in, and it converts them into a database that is then de-duplicated. Quad9 also generates a whitelist of domains never to block; it uses a list of the top one million requested domains. During development, Quad9 used Alexa, but now that Alexa’s top million sites list is no longer being maintained, Baykal said that GCA and its partners had to turn to an alternative source for the data—the Majestic Million daily top-million sites feed.
Read 6 remaining paragraphs | Comments
