David Barnett's Brand Protection Articles: March 2022

Friday, 25 March 2022

The online effects of the Ukraine war

As the war in Ukraine continues to unfold, government-led cybersecurity organisations are advising companies to strengthen their security posture, as an increase in cyber threats such as distributed denial of service (DDoS) attacks, phishing, website defacements, ransomware, and malware is likely to follow.

Observations from CSC have also shown that the general online effects of this war need to be watched as well, as some of the tactics used by fraudsters - particularly with malicious domain names and website spoofing - are magnified during a major world event. The observations below outline some of the emerging trends across a range of key online content areas and are followed by recommendations to protect against the associated threats.

Surge in domain registrations

As seen in past CSC studies, significant world events often trigger spikes in domain registrations. With the Ukraine war, we analysed the landscape based on a snapshot of all domains containing the keyword 'ukraine' that had been registered by the end of the month of the initial Russian invasion (Figure 1).

Figure 1: Daily total numbers of Ukraine-related domain registrations during February 2022 (date of the initial invasion shown as a dotted line)

This event shows a similar pattern of activity to others that CSC has monitored, with the start of the war immediately followed by a spike in activity. Entities registering these domains - whether legitimate or with criminal intent - do so to take advantage of public interest in the emerging situation and to attract the increased web traffic.

More than 700 new Ukraine-related domains were registered in the five-day period beginning February 24. These feature a range of associated keywords and content, the most potentially concerning of which are shown in Figure 2.

Figure 2: Numbers of domains registered in the five-day period beginning February 24 with names featuring keywords of particular concern

A significant proportion of the sites are directly soliciting for donations, using either traditional payment methods or cryptocurrency (Figure 3). While several may be genuine resources for supporting victims of the war, any that are not legitimate are an obvious cause for concern. They may be associated with fraudulent activity, attempting to take advantage of well-meaning people wishing to help those in need.

Figure 3: Examples of Ukraine-related domain names resolving to donation sites

Many other researchers have also noted this emergence of fake donation sites, stressing the importance of contributing via legitimate agencies like the International Red Cross, Save the Children, Doctors without Borders, or UNICEF^[1,2,3].

Fraudulent solicitations for donations - particularly using cryptocurrency - have also been reported as circulating via numerous other routes, including phishing emails and forum posts^[4]. These follow a legitimate call for donations from the Ukrainian government, posted through its official Twitter account^[5].

Interestingly, amongst the (de-duplicated) set of 170 domains featuring keywords of concern, many are registered through consumer-grade domain registrars, a trend commonly seen with non-legitimate sites.

Some of the other domains within the dataset were also found to include references to trusted charities or other key organisations, as a way of misleading Internet users and adding credibility to the site content. Examples included domains with the keyword strings 'redcrossukraine' (resolving to a site soliciting for cryptocurrency donations) and 'nato4ukraine' (resolving to a parking page with pay-per-click links at the time of analysis).

Spread of misinformation

As with any major world event, there has been an increase in misinformation appearing online following the start of the war, which has taken several different forms.

1. Recycled, out-of-context, and modified imagery - Various photos and videos purporting to show events occurring in the war in Ukraine have been circulating, particularly on social media. In many cases, these have been found to be images from unrelated events, which may have occurred many years earlier^[6,7], or are material that has been modified^[8] or falsified altogether^[9]. In many cases, these posts have gone viral, with some examples attracting hundreds of thousands of views.

From a brand protection perspective, in some instances, the original sources of the material can be identified through open-source investigation techniques (e.g. reverse-image searches). Similar approaches may be possible using screen grabs taken from video content. Furthermore, geolocation techniques can sometimes be used to verify the geographical origin of imagery^[10].

General advice for Internet users is to be mindful of the origins of information, and only to share content from trusted sources.

2. Pro-Russian content and propaganda - We found significant amounts of online content showing support for Russia. While some of this will presumably be legitimate, a significant amount (particularly on social media) appears to have been posted by Russian state-sponsored profiles or automated accounts (bots). Recent creation dates, low numbers of followers, and high numbers of likes for postings are characteristics that demonstrate profiles may fall into this latter category. Social media is a popular channel for spreading propaganda and generating political support due to the ease of creating content, combined with its wide potential reach and speed of spread (Figure 4). Many of the identified postings make use of popular hashtags (e.g. #istandwithrussia or #istandwithputin), or associate their content with other emotive issues (e.g. Israeli / Palestinian content). One study^[11] found that a significant subset of these postings were intended simply to attract traffic, in some cases driving readers to e-commerce listings or websites for other service providers.

Another significant observation is that even some mainstream Russian-based news accounts have been suspended from social media platforms in response to their pro-Russian stance and justification of military action based on reasoning unsupported by the known facts^[12,13]. Meta (the organisation behind Facebook, Instagram, and WhatsApp) announced its refusal to cease fact-checking content posted by Russian state-owned media^[14], as demanded by Russian authorities. Furthermore, on March 6, TikTok announced that it was suspending the creation of new videos in Russia. This was due to uncertainty around the safety of content creators following the introduction of Russia’s fake news law, which can impose up to 15 years’ imprisonment on those found publicly calling for sanctions, or spreading what Russia perceives to be false information about its military^[15].

Figure 4: Example of a pro-Russian viral image circulating on social media

3. Conspiracy theories and other fake information - One of the common themes identified in online commentary, particularly on social media, are claims that the war is fake^[16]. In some cases, this has been accompanied with claims that real imagery has been staged^[17]. These claims have been made by a range of entities, typically promoting pro-Russian or conspiracy theorist agendas.

An additional concerning observation is the use of fake accounts to post fake messages, such as the case of a Telegram account purporting to be that of Ukrainian President Volodymyr Zelenskyy^[18]. Several outlets claiming to offer breaking news stories have been circulating fake news, with the content on these untrustworthy channels frequently unaccompanied by sources or any other evidence^[19].

Among the other conspiracy theories circulating online are claims that the conflict is a campaign against bioweapons facilities^[20,21], and suggestions that the war with is linked with the establishment of a 'new world order'^[22]. This references a long-running conspiracy theory around the creation of a totalitarian world government. Some fake stories are less harsh in tone, such as the claim that Ukrainians are selling second-hand tanks on eBay^[23,24].

Direct effects on online businesses and organisations

The war in Ukraine has had a range of effects on corporations, from the Russian authorities blocking Internet access to several key western websites and platforms (particularly social media), to organisations withdrawing business operations in Russia. Conversely, there has also been a rise in activism against corporations who have failed to pull out of Russia, with hashtags such as #boycottcocacola and #boycottmcdonalds trending on social media in the first two weeks following the invasion.

A particularly significant effect from a brand protection point of view is the direct repercussions for both Ukrainian and Russian online organisations resulting from the business interruptions, sanctions, and economic damage that have arisen during the war. One example is the closure of a series of Ukraine-based websites and marketplaces. One affected organisation is EVO (evo.company), the Ukrainian IT company behind a range of e-commerce platforms in the region, including Prom.ua, Tiu.ru, Bigl.ua, Deal.by, and Satu.kz, among others. At the start of March, the Tiu.ru website suspended its operations in response to the war (Figure 5). This website was tailored to the Russian market but had been hosted on Ukrainian servers^[25].

These changes will have a knock-on effect on the e-commerce landscape in the region, the balance of available legitimate and counterfeit products, and may ultimately lead to the emergence of new marketplace sites to take their place.

Figure 5: Message displayed on the Tiu.ru website at the start of March 2022

Conclusion and recommendations

The Ukraine war increases the possibility of cyberattacks against Western websites and Internet infrastructure. Employing a robust domain security posture is critical. In times of global uncertainty, companies should not only have advanced security measures^[26] in place to safely mitigate threats, but should also employ a holistic online monitoring program to ensure rapid detection and allow for quick and effective takedown of any IP abuse, such as fake sites, fraudulent campaigns, or other false content or misinformation.

CSC recommends taking the following steps.

1. Confirm that your domain registrar’s business practices are not contributing to fraud and brand abuse. The following issues are often common with consumer-grade domain registrars:

Operating domain marketplaces that drop catch, auction, and sell domain names containing trademarks to the highest bidder
Domain name spinning and advocating the registration of domain names containing trademarks
Monetising domain names containing trademarks with pay-per-click sites
Experiencing frequently occurring breaches resulting in DNS attacks, phishing, and business e-mail compromise

2. Identify trademark and copyright abuse in web content, and on online marketplaces, social media, and mobile app stores via an online monitoring service.

3. Leverage global enforcement, including takedowns and advanced techniques in Internet blocking.

4. Employ phishing monitoring and a fraud-blocking network of browsers, partners, Internet service providers (ISPs), and security information and event management (SIEM) systems.

References

[1] https://domaingang.com/domain-news/new-help-ukraine-domains-are-most-likely-not-legit/

[2] https://www.welivesecurity.com/2022/02/27/beware-charity-scams-exploiting-war-ukraine/

[3] https://twitter.com/ESETresearch/status/1497194165561659394

[4] https://www.bleepingcomputer.com/news/security/help-ukraine-crypto-scams-emerge-as-ukraine-raises-over-37-million/

[5] https://twitter.com/Ukraine/status/1497594592438497282

[6] https://www.bbc.com/news/60554910

[7] https://bbc-monitoring.co.uk/campaign/RwbbAiso/aab564822c8140a6c46681ea/b680b576f310643c916458a491cf5d77

[8] https://twitter.com/Shayan86/status/1496944075378855942

[9] https://www.cnn.com/2022/03/05/politics/fact-check-fake-cnn-ukraine/index.html

[10] https://www.youtube.com/watch?v=KtOaC0emsxY

[11] https://twitter.com/marcowenjones/status/1499312091727020032

[12] https://www.euronews.com/next/2022/03/02/ukraine-war-facebook-and-youtube-block-russia-s-rt-and-sputnik-in-europe

[13] https://www.businessinsider.com/facebook-ukraine-russia-news-state-media-2022-3

[14] https://twitter.com/nickclegg/status/1497279120853590025

[15] https://www.theverge.com/2022/3/6/22964418/tiktok-suspends-creation-new-video-content-russia-ukraine

[16] https://www.bbc.com/news/60589965

[17] https://twitter.com/hoaxeye/status/1497514958174699522

[18] https://twitter.com/Shayan86/status/1497485340738785283

[19] https://twitter.com/conspirator0/status/1496720310577602561

[20] https://twitter.com/Shayan86/status/1499031014496157697

[21] https://twitter.com/O_Rob1nson/status/1499337632022683648

[22] https://twitter.com/Shayan86/status/1498398600421941249

[23] https://www.snopes.com/fact-check/ukraine-used-tanks-ebay/

[24] https://twitter.com/Shayan86/status/1499167301614157824

[25] https://www.dk.ru/news/237164313

[26] https://www.cscdbs.com/blog/interpreting-global-guidance-on-cyber-threats-due-to-the-ukraine-crisis/

This article was first published on 24 March 2022 at:

https://www.cscdbs.com/blog/how-to-manage-the-online-effects-of-the-ukraine-war/

Friday, 11 March 2022

The rise of the NFT

The concept of the non-fungible token (NFT) began to rise to prominence in Spring 2021, with a series of news stories reporting the sale of digital artworks in NFT form. A video clip produced by a digital artist named Beeple was sold on the cryptocurrency art marketplace Nifty Gateway for $6.6 million^[1], having originally been purchased just a few months earlier for $66,666 - just 1% of the later sale price^[2,3,4]. In late February 2021, a new piece of work by the same artist was listed by auction house Christie's^[5,6], eventually selling on March 11 for more than $69 million - a new record for a digital artwork, and the third highest auction price ever achieved for a living artist^[7,8].

An NFT is a cryptographic collectible comprising any of several types of asset or media. Key to understanding the NFT is the concept of blockchain (the technology underlying cryptocurrencies like Bitcoin) - a publicly accessible digital ledger in which transactions are recorded. Blockchain is cryptographically sealed and cannot be modified after its contents are recorded, making it relevant to several applications. Examples of its use include the maintenance of an audit trail of a brand owner's supply chain and shipping to guard against non-legitimate trade (as in the Aura Blockchain Consortium founded by Prada, LVMH, and Cartier in 2021^[9]), or even assigning NFTs to mortgages^[10,11]. For NFTs, ownership of the asset is also recorded on a blockchain (currently, most NFTs are associated with the blockchain used for the Ethereum cryptocurrency). They are designed so every example is unique and cannot be exchanged for alternative identical copies, and therefore are 'non-fungible'.

Theoretically, any digital file can be converted into an NFT - a process known as 'minting'. Although the file content can potentially be viewed by anyone, the association of the NFT with blockchain means there is a definitive original version of the file (or one of a series of authorised versions), whose ownership is recorded, making it a tradable collectible. The analogy is that "anyone can buy a Monet print, but only one person can own the original"^[12]. As a result, noteworthy digital items of a range of different types have been sold as NFTs, including various famous meme images (e.g. 'Doge' - an image of a dog, associated with the Dogecoin cryptocurrency - selling for $4 million)^[13], and the first tweet by Twitter CEO Jack Dorsey, which sold for nearly $3 million^[14]. Overall, NFT sales reached $25 billion in 2021, up from just less than $100 million the previous year^[15].

From a content producer's point of view, the concept of the NFT presents the potential to produce and sell a range of commodities. For example, on March 3, 2021, the band Kings of Leon announced their upcoming album would be released in NFT form (alongside standard formats), becoming the first band ever to do so. The NFT, priced at $50 and made available via the YellowHeart marketplace, included enhanced media (e.g. album artwork) together with the digital download of the music, and was available for a limited period. After this, no further versions were made, with the NFTs becoming tradable collectibles. Additional premium 'golden ticket' tokens were also released, including one version that included benefits like VIP concert tickets for life^[16]. The key idea is the use of blockchain technology to generate improved returns for the music industry in an era where digital sharing and streaming - and the COVID pandemic - is adversely affecting revenue streams^[17].

Applications

Virtual items

One application of NFTs is the production and sale of official virtual merchandise by brand owners. For example, luxury brand Gucci was one of the first players in this space, launching a series of sneakers in augmented reality, which can be purchased to be worn in virtual reality (VR) chat or the online game Roblox. Other brands experimenting with distributing branded products as NFTs include Dolce & Gabbana and Rebecca Minkoff^[18]. More recently, the Coach brand released a collection of NFTs as part of a holiday campaign^[19].

Although luxury collectables account for less than 1% of all NFT transactions in 2021, they are projected to evolve into a $25 billion business by 2030, or 10% of the total luxury market^[20].

With the emergence of the metaverse - the name given to the connected environment of 3D virtual worlds - this type of business model may become more mainstream^[21]. In February 2022, it was reported that McDonald's and Panera Bread had both filed trademarks for NFTs in the metaverse, setting the scene for virtual restaurants in online environments, tied to real-world deliveries for customers^[22]. Brand owners in a range of other industries have also filed trademark applications covering virtual or digital goods and services, across a variety of product areas, including Nike, The Brooklyn Nets, Walmart, Crocs, Skechers, Jay-Z, and The Coachella Valley Music and Arts Festival^[23].

Also in February 2022, the Playboy brand announced plans to offer digital subscriptions and a new virtual Playboy Mansion in the metaverse, following its prior release of a range of NFT imagery based on the bunny logo^[24].

Blockchain domains

A related idea is the concept of the blockchain domain. Like regular domain names, they consist of a second-level domain name and an extension, but there are a few key differences. Specifically, blockchain domains:

Are recorded, together with their ownership details, on a blockchain (i.e. not hosted on a server, or recorded in a regular registry zone file)
Do not resolve to websites in regular browsers, instead requiring dedicated browsers like Brave, or browser plug-ins
Are associated with specific domain name extensions (e.g. .eth, .crypto, .bit, etc.)
Are offered only by specific providers ('registrars')
Have a one-off purchase fee and are then owned permanently

They can be used for a variety of purposes, including personalised addresses for sending and receiving cryptocurrency, providing hosting for programs that can be run as apps, or building decentralised websites (e.g. on peer-to-peer hosting platforms)^[25]. However, it is becoming clear that they may also be associated with specific threats, including the inability to tie them to real-world ownership details, and their observed use in creating botnets or distributing malware^[26].

Additionally, blockchain domains are not governed by ICANN (the Internet Corporation for Assigned Names and Numbers), which could be a regulatory cause for concern. Some providers are also reserving branded domain names on behalf of brand owners, and charging them to un-reserve them and thereby take ownership (similar to a review fee).

From a monitoring point of view, blockchain domains can be extremely hard to identify, both because of the absence of zone files, and that the domains do not resolve to websites in regular browsers. One technique to circumvent this difficulty can be to search for references to the domain names being traded in NFT marketplaces (Figure 1).

Figure 1: NFT marketplace listing offering the sale of a blockchain domain name.

Enforcement options are currently limited, with one option being just to take down infringing listings from the marketplaces - although this does not deactivate the domain name itself or change its ownership. However, some blockchain domain providers are becoming more mindful of the risks posed by cybersquatters^[27], and offer brand owners the ability to block third-party registrations (similar to the Trademark Clearinghouse (TMCH) program for new top-level domains (TLDs)) or to claim ownership of trademarked names. Brand owners may also consider proactively registering key domain name keyword strings across relevant extensions.

Emerging threats

There appear to be several key areas where NFT-related infringements exist and could become areas of concern for brand owners. The most obvious include the trade in branded blockchain domain names, or other digital files featuring brand-related content, such as logos or other official imagery - with the logo of one fashion brand reported as being offered for sale for over $3 million at the start of 2022^[28]. Currently, this trade appears primarily focused on a range of dedicated NFT marketplaces, including OpenSea, Rarible, Nifty Gateway, Binance, and SuperRare, and with new marketplaces, like Folio^[29] and N.Fungible^[30], launching regularly. However, there remains scope for the development of additional distribution channels in the future, with social media likely to become one.

The growing popularity of NFTs also gives scope for other more familiar types of online scams and infringements, like registering domain names containing 'nft' to capitalise on the interest by Internet users. A 2022 study looking at over 34,000 NFT-related domains found that significant numbers may be associated with NFT scams, attack vectors for malware distribution, or cybersquatting^[31,32]. Scams take a variety of forms, including phishing, advance-fee frauds (e.g. the investor scam), and harvesting cryptocurrency. NFTs themselves can also have security implications, with a report in January 2022 of a type of NFT that could harvest viewers' IP addresses^[33].

The trade in NFTs can itself be subject to fraudulent activity. 'Wash trading', for example, is becoming increasingly widespread^[34]. This is where an individual NFT is repeatedly traded between multiple accounts owned by the same seller, as a means of artificially inflating its price. In February 2022, the first associated law enforcement action in the UK was taken in response to a VAT (value-added tax) repayment fraud involving 250 fake companies^[35].

It is worth noting that NFT ownership does not necessarily grant ownership of copyright for the content, and more generally, NFTs can also raise questions about the associated intellectual property (IP) rights. In November 2021, production company Miramax sued writer and director Quentin Tarantino over his sale of a collection of NFTs related to the movie Pulp Fiction. While Tarantino had retained limited contractual rights for the film, Miramax alleged that his sale of the NFTs violated the company's copyright and trademark rights^[36,37]. Cases become more complicated when content is moved from one blockchain to another, as it was in the recent Quantum NFT case^[38].

Growth in the sale of counterfeit versions of branded virtual items, like clothes and accessories for avatars, has also been noted as an emerging trend for various luxury brands. At the start of 2022, luxury brand Hermès took legal action for a trademark infringement against digital designer Mason Rothschild, following his release of a series of 100 designs of 'MetaBirkins' in NFT form. These "depict imaginary, fur-covered Birkin bags", in homage to the highly exclusive Hermès Birkin handbag. Following an initial sale price of 0.1 ETH (around $300), some MetaBirkin NFTs sold for up to $50,000 shortly afterwards - equal to or greater than the price of a real-world Birkin^[39,40]. The following month, Nike filed a lawsuit against shopping platform StockX for distributing NFTs featuring their logo and branding^[41]. StockX operates a system whereby 'Vault NFTs' can be redeemed for physical items, with Nike alleging that the association of the NFTs with their brand constitutes "trademark infringement, false designation of origin, and trademark dilution, among other violations"^[42].

Elsewhere in the digital content landscape, representatives of artists in the music industry expressed anger at a company named HitPiece, which appeared to be selling single and album artworks as NFTs^[43]. A few days later, reports emerged alleging that another platform, NFT Music Stream, was hosting unlicensed music content, apparently sourced from YouTube Music, on the blockchain^[44]. Instances have also arisen of artwork (such as that posted on online platforms such as DeviantArt) being stolen by third parties, converted to NFTs, and sold on marketplaces like OpenSea. In one instance, an artist's collection was offered for sale as a set of nearly 86,000 NFTs, through a practice known as 'lazy minting', where sellers list NFTs without writing them to the blockchain, in an effort to avoid paying fees until a sale is made^[45]. This follows a high-profile case where a scammer sold an NFT purporting to be by street artist Banksy for over $300,000^[46].

In fact, in response to the high volume of unauthorised sales, counterfeits and other scams, the Cent NFT marketplace suspended much of the trade on its platform in February 2022^[47]. OpenSea, the largest NFT marketplace, had also previously claimed that more than 80% of the NFTs minted on their own platform were "plagiarised works, fake collections, and spam"^[48].

Enforcement against infringing content can sometimes be carried out by submitting a DMCA (Digital Millennium Copyright Act) notice, generally resulting in high compliance. Additionally, some NFT marketplaces have specific processes for submitting takedown requests against IP-infringing content^[49]. However, the exact legal status of IP protection in the metaverse is unclear and the landscape appears to be evolving rapidly^[50].

References

[1] https://www.cnbc.com/amp/2021/03/03/what-are-nfts-all-you-need-to-know-about-crypto-collectibles.html

[2] https://observer.com/2021/02/beeple-record-breaking-christies-nifty-gateway/

[3] https://twitter.com/TheHustle/status/1366432385747804160

[4] https://www.coinspeaker.com/new-record-nft-beeple/

[5] https://www.cnbc.com/2021/02/18/christies-to-auction-beeple-nft-art-and-will-accept-ether-as-payment.html

[6] https://twitter.com/ChristiesInc/status/1365100549385957378

[7] https://www.nytimes.com/2021/03/11/arts/design/nft-auction-christies-beeple.html

[8] https://twitter.com/ChristiesInc/status/1370027970560106497

[9] https://www.pradagroup.com/en/news-media/news-section/aura-blockchain-consortium.html

[10] https://www.forbes.com/sites/kamranrosen/2021/11/18/this-company-wants-to-turn-your-mortgage-into-an-nft/?sh=67d405e037fe

[11] https://circleid.com/posts/20211209-protecting-your-brand-in-the-new-world-of-nfts