- M3AAWG Malware playlist on YouTube
- Selected Training Videos (also available on www.youtube.com/maawg)
- Selected Keynote Videos (also available on www.youtube.com/maawg)
1
Below are the M3AAWG published materials related to our work on preventing and mitigating malware. There is also a Malware video playlist on our YouTube channel at www.youtube.com/maawg and there are a few selected videos on our website in the Training Videos and Keynotes Videos sections under the Meetings menu tab.
Best Practices
PDF
March 01, 2018
M3AAWG Compromised User ID Best Practices, Version 1.0.1
Updated in March 2018, this document addresses problems associated with compromised user accounts. It discusses mitigation techniques and methods of identifying compromised accounts, including recommendations to ensure the long-term security of accounts to prevent “re-compromise.”
PDF
January 31, 2018
M3AAWG Recommendations for Preserving Investments in New Generic Top-Level Domains (gTLDs)
Over a thousand new generic Top-Level Domains (gTLDs) have been, or are in, the process of being created under ICANN’s new gTLD program. This paper is written for current Registry operators and for companies interested in applying for new gTLDs, and outlines the risks and some relatively simple recommendations that can help correct these problems.
PDF
May 20, 2017
M3AAWG Introduction to Reflective DDoS Attacks
Many thousands of individual Distributed Denial-of-Service attacks take place each day. While many of these are relatively small, they are sufficient to take unprepared sites offline and threaten connectivity over large regions of the internet. It is in everyone’s interest to take all possible precautions to thwart these damaging DDoS attacks. This paper provides an overview of how this very common form of attack works, what measures can be taken to help eliminate it and pointers to some of the many technical documents that can provide more detail. Also see the video Understanding and Preventing Reflective DDoS Attacks with M3AAWG Senior Technical Advisor Dr. Richard Clayton of Cambridge University explaining reflective DDoS attacks and some of the actions the industry can take to protect against them.
PDF
March 15, 2017
M3AAWG Initial Recommendations: Arming Businesses Against DDoS Attacks
Distributed Denial of Service attacks continue to be a major concern. This guide helps businesses prepare for DDoS attacks and, as a side benefit, some of these same techniques can also help businesses that suddenly see a large increase in legitimate customer web traffic.
PDF
August 12, 2016
M3AAWG Best Current Practices For Building and Operating a Spamtrap, Ver. 1.2.0
Updated in August 2016 as Version 1.2.0, this document is for spamtrap operators who generally use data generated from spamtraps for purposes such as research, evidence collection, infected machine mitigation or mail list leakage and list quality control.
Pages
Public Policy Comments
April 13, 2018
WHOIS Tiered Access and Accreditation Program
M3AAWG submitted these short comments to ICANN stating that an expert group from the Anti-Abuse community should be created to facilitate the certification of qualified applicants from the security field.
January 10, 2018
Comments on The Competition, Consumer Trust and Consumer Choice Review Team–New Sections Draft Report of Recommendations
M3AAWG provided input on the new sections added to the draft ICANN report. The comments can also be found on the ICANN site at http://mm.icann.org/pipermail/comments-cct-recs-27nov17/attachments/20180107/9b99c6d2/M3AAWG-ICANN-CCT-NewSections-2018-01-0001.pdf
July 14, 2016
Using Generic Top Level Domain Registration Information (WHOIS Data) in Anti-Abuse Operations
WHOIS information plays a key role in determining where to report instances of abuse involving domain names. This paper explains some of the important WHOIS elements used to fight spam, phishing, malware distribution and other threats.
September 26, 2014
Comments on Implementation of CSRIC III Cybersecurity Best Practices
M3AAWG submitted these comments with the new M3AAWG Bot Metrics Report in response to the U.S, Federal Communications Communications request for comments on the status of the implementation of CSRIC III best practices.
August 04, 2014
Additional Responses from Dr. Paul Vixie to the U.S. Senate Hearing on "Taking Down Botnets: Public and Private Efforts to Disrupt and Dismantle Cybercriminal Networks"
Dr. Vixie's August 4th written response to additional questions requested after the hearing on botnet takedowns is also available from the official U.S. Committee on the Judiciary Committee hearing website at
www.judiciary.senate.gov/download/vixie-qfrs-71514 .
Pages
M3AAWG Reports
DM3Z Blog
Updates and Commentary from the Messaging, Malware and Mobile Anti-Abuse Working Group
None at this time.
News
News Releases
HTML
February 18, 2019
Dave Piscitello Receives M3AAWG Mary Litynski Award for a Lifetime of Fighting DNS and Online Abuse
HTML
October 31, 2018
First Japan Anti-Abuse Working Group General Meeting Shares M3AAWG Work with Emphasis on Regional Issues
HTML
October 23, 2018
ICANN GDPR WHOIS Policy Eliminates Pre-Emptive Protection of Internet Infrastructure Abuse; Obstructs Routine Forensics to Cybercriminals’ Advantage
Pages
Articles About M3AAWG
HTML
October 07, 2019
Technology, law, and the world to protect the Internet: Interview with the standards organization JPAAWG
https://www.atmarkit.co.jp/ait/articles/1910/07/news010.html
Japan Anti-Abuse Working Group (JPAAWG) launched in May 2019 and works with M3AAWG to focus on Internet security in Japan. ITmedia spoke with Mr. Shuji Sakuraba and Mr. Nobuhiro Suemasa of JPAAWG about the group’s work, including collaboration with M3AAWG.
HTML
October 03, 2019
AI’s Place in Preventing Piracy
https://www.cablefax.com/technology/rough-seas-ais-place-in-preventing-piracy
Cable operators are working to prevent disruptions to their networks caused by the streaming of pirated content and DDoS attacks. The article calls out CableLabs’ work with M3AAWG on the DDoS Information Sharing Project.
HTML
October 02, 2019
Is a DMARC policy really right for everyone?
https://www.valimail.com/blog/dmarc-enforcement-for-everyone/
Valimail makes the case for DMARC enforcement and notes that M3AAWG recommends enforcement as a deliverability best practice.
URL
September 03, 2019
Solving extreme email deliverability mysteries
https://postmarkapp.com/podcast/solving-extreme-email-deliverability-mysteries
Anna Ward, Postmark’s head of deliverability, discusses her path to becoming an email deliverability expert and the impact of being a part of the M3AAWG community on her work.
Pages
Videos
