Feasibility of Large-Scale Vulnerability Notifications after GDPR - Archive ouverte HAL Accéder directement au contenu
Communication Dans Un Congrès Année : 2020

Feasibility of Large-Scale Vulnerability Notifications after GDPR

Résumé

In this paper, we consider the problem of effective notifications of domain abuse or vulnerabilities to the domain owners, administrators, or webmasters. We have developed a scanner to test whether selected email aliases specified in RFC 2142 are correctly configured and whether notifications can be successfully delivered. We also test the reachability of email addresses collected from the DNS Start of Authority (SOA) records. Based on a measurement campaign of a large number of domains compared to the previous studies (4,602,907 domains), we show that domains are more reachable through SOA contacts. We find that the country-code TLD names are more reachable compared to the new gTLD names. We have also observed that the most used generic email alias is abuse (67.95%). Using regression analysis, we show the relationship between the reachability of email addresses and the fact that names are hosted on large shared platforms or have a significant value. Our results confirm that direct notification channels are currently not scalable, so we propose a scheme that preserves user privacy in compliance with GDPR and supports large-scale vulnerability notifications.
Fichier non déposé

Dates et versions

hal-03274978 , version 1 (30-06-2021)

Identifiants

Citer

Wissem Soussi, Maciej Korczynski, Sourena Maroofi, Andrzej Duda. Feasibility of Large-Scale Vulnerability Notifications after GDPR. 2020 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW), Sep 2020, Genoa, Italy. pp.532-537, ⟨10.1109/EuroSPW51379.2020.00078⟩. ⟨hal-03274978⟩
39 Consultations
0 Téléchargements

Altmetric

Partager

Gmail Facebook X LinkedIn More