April 2010 - anti-abuse-wg - mailman.ripe.net

Abuse Finder Tool
by Mirjam Kuehne 27 Apr '10

27 Apr '10

[apologies for duplicates] Dear colleagues, If you ever wished there would be an easier way to find all abuse-related contact information for a specific network in the RIPE Database, this new Abuse Finder tool might be interesting for you: http://labs.ripe.net/content/abuse-finder As always, please let us know what you think. We are also curious to find out if there are other more customised 'use case queries' you would find useful. We set up a forum to gather your feedback: http://labs.ripe.net/content/ripe-database-api-0 Kind Regards, Mirjam Kühne RIPE NCC

4 3

Invitation from Balaji Nagalgave
by Balaji Nagalgave 26 Apr '10

26 Apr '10

Balaji Nagalgave is inviting you to join Resumark.com Post your resume (we can hide it from your boss) and make $1 every time an employer downloads it! Know anyone who is looking for a job? Get paid for inviting them. In today's economy even job search monsters are not enough. We help you find a job by doing something that hasn't been done before: We pay YOU for your resume! Count me in! How this works? Message from Resumark.com: Greetings! We've been working hard on this website to help people find jobs in this economy. We don't think it is fair for other websites to capitalize on people's resumes so we came up with an idea to share the money that employers pay for resumes with those who are looking for jobs. Doesn't this sound like the right thing to do? We appeal to you - please help us spread the word to others who can benefit from this website! Thank you! The Resumark Team Resumark.com You received this e-mail because someone you know thought you may find this website interesting. If you no longer wish to receive any e-mails from us, please go to http://www.resumark.com/block.html?env=donotinvite---OnBlock-&email=anti-ab…

2 1

Re: [anti-abuse-wg] DRAFT: RIPE proposal - implementation of an
by Jørgen Hovland 12 Apr '10

12 Apr '10

On 10/04/2010 14:32, Jeffrey Race wrote: > Legal systems are ineffective in dealing with this > type of issue for well understood structural reasons. > See > > <http://www.camblab.com/misc/univ_std.txt> > based on > <http://www.camblab.com/nugget/spam_03.pdf> > > > I disagree. It is of course more timeconsuming, but legal systems (should) give everyone a fair chance. Franks witch-hunt suggestion is exactly what I don't want. Legal systems also pursue the party that is legally doing something wrong, not the ISP or any other third party that shouldn't be bothered in the first place (of course sometimes it is the ISP etc). A lot of what you would define as spam isn't spam at all in legal terms. The company I work for block this spam too (only the spam, not the entire provider), but we would certainly not punish or file a lawsuit.

11 20

Draft Proposals and Spam Definition - A Call for a Pause
by Brian Nisbet 12 Apr '10

12 Apr '10

Afternoon, I feel, at this point, that the conversation is getting rather circular and more argumentative than we would like. It is probably best if, Frank, you take the feedback you've collected so far and consider how you wish to proceed. Based on the list traffic so far I think you have a lot to work with and some feeling of how your ideas have been received so far. For everyone else, Frank has said he has taken the feedback and is preparing a new draft, so perhaps is would be best at this point to wait for any updated proposals before proceeding further. It should be noted that considering the far reaching nature of these ideas, the full PDP process will need to be followed, should Frank decide to make a formal proposal. Frank, I'm not sure if you'll be joining us in Prague, but I would like to invite you to speak at the meeting as I am sure some discussion will take place at RIPE 60. Thanks, Brian.

1 0

Re: SV: [anti-abuse-wg] DRAFT: RIPE proposal - implementation of an
by Frank Gadegast 12 Apr '10

12 Apr '10

Hi, > I think the following should be the "easiest" way of reducing spam: > > 1. Adding that the ISP should have a responsibily to reduce spam to the contract between the ISP and RIPE. (If as only adding "ISP should try to reduce spam" with no other details.) Yes, but this has to be formulated a way, that the recipient decides what spam is, so that there has no definition of spam to be included. So: RIPE has to add to the members contract, that the member is responsible for receiving abuse reports and reducing the cause of these reports as much as possible. > 2. Measure how much spam originates from each ISP. Difficult to formulate this way. Better would be: RIPE has to start to messure the amount of abuse reports any member receives. Messurement systems have to include a system run by RIPE NCC and could include other reliable data from souces not related to RIPE. > 3. Give RIPE possibility to fine the misbehaving ISP or to cancel the agreement in worst case scenario. A big yes, but we will have to find consensus here, whats worse and what punishment could happen, there are a lot of possibilities. I would prefer to make this step later, after contracts are changed and a messurement system is introduced. Having facts, data and results from such a system could help defining who is really "bad". > I saw you had the same or similar idea on http://www.ripe.net/ripe/maillists/archives/anti-spam-wg/2008/msg00056.html > > >From the looks of it im suspecting we cant even get consensus on the first step, unfortunately. :( > For step number two i think the easiest way would be using spamcop or some similar system. The benefits for using spamcop is that its already an existing system. No cost for developing the system or for teaching users how to report spam. People all around the world already uses it and knows how to report spam. Spamcop has already a system for contacting the correct ISP (I think). RIPE can use the statistics provided by spamcop to see what ISPs misbehaves. (Of course RIPE must be more accepting for the amount of spam than Spamcop. Its already prepared for all other RIRs if they should follow after RIPE has begun. And if RIPE cooperates with spamcop i also assume more users would be reporting the spam there. You see, its not that old :o) > Cons. I dont know if the spamreports on spamcop are reliable or if they can be forged by spammers. I guess their shoud be some way of fixing that problem if that is the case. The system is well known, and most big provider use it and forget problems to their customers, the are even opening tickets for these cases, to not forget them. spamhaus is another very reliable source. I bet both and even others would love to share their data with a RIR. But again, to be really reliable, RIPE needs to have a own system, no judgement could be done, if RIPE ONLY counts on other resources ... > Do you think this could work? I will continue to read the archive to see if someone has found a problem with this earlier. Well, I started this discussion, so I think it would work and would help. Its only how to formulate this and how details should look like. There I do still need more input ... Kidn regards, Frank -- PHADE Software - PowerWeb http://www.powerweb.de Inh. Dipl.-Inform. Frank Gadegast mailto:frank@powerweb.de Schinkelstrasse 17 fon: +49 33200 52920 14558 Nuthetal OT Rehbruecke, Germany fax: +49 33200 52921 ====================================================================== Public PGP Key available for frank(a)powerweb.de > > Best Regards > Martin Tranefjord >

3 5

Re: [anti-abuse-wg] DRAFT: RIPE proposal - implementation of an
by Frank Gadegast 10 Apr '10

10 Apr '10

Hello Leo, > > The benefit is clear: > > - it will give RIPE NCC the chance to seperate good from > > "spam-friendly" members, prepare impresive statistics > > for further discussions (e.g. with Governments) and much more > > - it will simplify the process of reporting spam > > and reacting to spam reports for everybody, querying > > whois is still too complicated and unknown to the normal > > end user and hard to automate for blacklists or other > > services, because there are about 20 different whois > > output formats worldwide (inserting an abuse-address into > > an IRT object will even make it more complicated) > > - having an easy and unique address to report to, is another > > step in standarizing the report format, what would make > > it much more easy for members that are willing to deal > > with abuse reports > > You didn't answer the question, though. Why would you proposal make ISPs want to deal with abuse reports when they are not doing so already? I did answer this a couple of times now, but ok, again. The first version will not work against members, that are not willing to do something against abuse that is coming from their networks. Working against them will need some kind of "punishment", and sure there is more to talk about first with this. But at least there will be some kind of identification, wich one needs to be educated or even "punished" with this kind of system. The consequences are still for further discussion. > As to the claim that whois is to complicated to normal end users, I would contend that normal end users should not have to try and work out where abuse actually originates from. That is something that service providers should be doing. As someone who receives abuse reports for most of the special use IPv4 addresses reserved in various RFCs I can assure you that end users have a very hard time reading mail headers or understanding the warning messages provided by their firewall software. whois is even too complicated for normal people even for ISPs or blacklist owners like we are. Or even for super-professionals. - abuse-records are mostly hidden in remark-field because the abuse-field isnt used very often, because its non-mandatory (yet). - whois is showing IP ranges and ranges are often quite small, what means that you have to look up each range, better each IP seperatly - whois has only a connection to the owner of the range and not to the member, unless you do even more queries - queries to personal objects are limited, what makes automated systems impossible, if they are not starting to cache queries or read old database dumps or have the special right to receive as many infos as they need - caching query results are causing delays, what means that the abuse contacts cant be correct all the time, because they could have changed already - if the IRT object is introduced including abuse records, you will have to look up the normal whois AND the IRT object, and what result will you prefer, if both is available ? and if you see it world-wide: - the formatting of the world wide whois systems is not equal and sometimes even hard to parse, even if they nearly have the same fields - IPv4 ranges are widely spread between all RIRs, you will need to look up arins whois first, to find out, where the range actually belongs to, and then ask that RIR - dont forget the early registration blocks spread all over the world - arins whois requires up to three queries to finally get the abuse contact hidden in several possible objects, multi-range listings with more than one correct answer. What field will you really look for in arins whois ? OrgTechHandle, OrgAbuseHandle, RAbuseEmail, OrgNOCEmail, OrgTechEmail ? - apnics whois is now spread along several other referral whois in different countries and there is not clear and often changing relocation or change in the size of the assigned blocks for those sub-RIRs - lacnic also spreads, brasil has its own whois - lacnic always includes the mains RIRs abuse contats, relevant ? yes, no, both ? - the objects changed-date is not visible on all whois worldwide - tools that should make this more easy (like jwhois for domainname) are always developed with big delays and are never accurate And many more problems, thats not what I understand as standarized .... And if there is an RFC nearly for everything, its pretty weird, that whois is not equal all over the world. (well, but the same with domain whois, at least the output format could be the same, even if every country will hide fields or not like its needed by local law or commitment) > >> A system like the one proposed would add an extra layer between the complainant and the relevant network and could well become a target for abuse itself. I am not sure how it would make network managers want to deal with abuse complaints that they are currently ignoring, though. Can you expand on that? > > > > Thats right, the possible amount of reports arriving could be a real > > problem and could use more resources than expected. The problem is, > > that the amount is not really predictable until maybe even > > a testbed is implemented. > > > > Members that are ignoring spam reports could be at least > > identified, whatever "punishment" ( starting from public > > blame reaching up to real sanctions) will appear after > > identification, is for further discussions. > > > > It could start with a blacklist filled from RIPEs data, > > lets call it the "spam report ignoring RIPE member blacklist", > > or SRIRMB ;o) > > So, if I understand your proposal correctly, you want RIPE NCC membership fees to be used to create a system that will be used to 'name and shame' RIPE NCC members. I think this brings me back to the question I asked in my last message and which you did not answer: what is the incentive for RIPE NCC members to finance this system? Yes, because the development and maintance cost are spread on all members, instead on only those, that are willing to do something, this would be one way to "punish" the others :o) And the system only has to be developed once. And it will get even cheaper for everybody, if you add more functionality in the next steps ... And no member that already receives and reads and works on abuse reports has to fear this system, that how it should be constructed. It should help members with working abuse departments to simplify their work. It should also be a starting point to get report formats standarized, to simplify the lookup of abuse contacts (or even make lookups unnessessary). It should be a start to talk about consequences if a member ignores abuse reports. Kind regards, Frank -- PHADE Software - PowerWeb http://www.powerweb.de Inh. Dipl.-Inform. Frank Gadegast mailto:frank@powerweb.de Schinkelstrasse 17 fon: +49 33200 52920 14558 Nuthetal OT Rehbruecke, Germany fax: +49 33200 52921 ====================================================================== Public PGP Key available for frank(a)powerweb.de > > Regards, > > Leo >

4 4

RE: [anti-abuse-wg] DRAFT: RIPE proposal - implementation of an abuse monitor system
by Thor Kottelin 09 Apr '10

09 Apr '10

> -----Original Message----- > From: Frank Gadegast [mailto:phade@www.powerweb.de] > Sent: Thursday, April 08, 2010 6:42 PM > To: Thor Kottelin > Cc: anti-abuse-wg(a)postboy.ripe.net > > > -----Original Message----- > > > From: anti-abuse-wg-admin(a)ripe.net [mailto:anti-abuse-wg- > > > admin(a)ripe.net] On Behalf Of Bradley Freeman > > > Sent: Thursday, April 08, 2010 4:45 PM > > > To: 'Frank Gadegast'; anti-abuse-wg(a)ripe.net > > > > > And if the only benefit is a common abuse alias, hasn't this > has > > > already > > > been suggested with an abuse@ address in RFC2142 - Mailbox > Names > > > for Common > > > Services, Roles and Functions which is not RIPE region > specific? > > > > It is not always obvious which abuse@ domain should be selected > for a particular IP address. I like the suggestion of routing > reports according to the IP address of the abuse source. > > Not getting it. I apologise. Allow me to rephrase: Any organisation to which net space is allocated or assigned may own zero, one or several Internet domains. It may be difficult to know exactly what to type on the domain side of an abuse@ address. Your proposal avoids this issue. This is an advantage of your proposal as compared with RFC 2142. -- Thor Kottelin http://www.anta.net/

6 7

Re: [anti-abuse-wg] DRAFT: RIPE proposal - implementation of an
by Michele Neylon :: Blacknight 09 Apr '10

09 Apr '10

On 9 Apr 2010, at 15:19, Frank Gadegast , Dipl-Inform. Frank Gadegast wrote: >> >> Frank > > "Hello", > >> Either you are doing this intentionally or accidentally, but you keep emailing me offlist > > Intentionally, because this discussion has not much valuable feedback > to the draft, its like a discussion of personal opinions ... That is your opinion and I disagree If you're going to insist on emailing me offlist change the subject line > >>> Yes I do. And my experience is even, that things get more easy, >>> when they get bigger. >>> But its not my reputation that we should talk about. >> >> You are trying to impose your views on everyone else, so it is therefore important to understand from what stance you are speaking > > Obvious, everybody can only speak for things he believes in, he knows > about or he cares about. > > I care about reducing the spam load bothering me and my customers > and hackers misusing unattended servers to attack us and my customers. Ok, but you need to understand that not all companies will care as much about this as you do. You need to understand that not caring as much as you does not mean that they do not care > >>> If you have another perspective or other needs, simply name them. >>> In details. >> >> Read my last few emails > > No details yet, nothing with any kind of substance neither an example. > You will have to make things clear, if you want that others are > understanding your point of view. There was plenty of substance. That you failed to either understand it or chose to ignore it is another matter entirely > >>> Sure I can. >> >> >> Ok, let me put it to you in very clear terms > > Woah, Im already looking forward to this ... > >> If you ever get spam or other junk from our network and you state anywhere in public that we "caused it" I will sue you and I'm sure there are others who would too. > > Thats a point. > > And its difficult. > In Germany there is a term called "Mittaeter", lets try to explains this. > > If you have knowledge about a crime and you can easily do something against > it, you will be sued too, if you do nothing. > In fact, if you are doing nothing, you are partly a "cause" of the crime. > > So calling you a cause of a crime would not be sued in Germany I'm not in Germany. > , if > you could have prevented it. > Your reputation will be ruined already ... There you go again. .. You're not actually listening > > An example: > there is a old granny trying to walk over red lights and you are standing > near to her, you are not saying anything, you dont wave your > hands to warn the coming car driver and you dont run to the granny > to hold her back, you are not even trying to do anything and > ignore the situation against better knowledge. > > The granny is going over red lights, gets run over by the car and dies. > Somebody else is watching this from the far and the police gets you. > You will end up in prison for that in Germany. > > And there will be no harm to the one more far away if he calls you > one (one or a !) cause of grannys dead ... > > That how different things are in different countries. > > So if I would call you "a" cause of the problem, if you leave > your servers like the are and you know that they are hacked and misused, > there will be nothing happening to me Germany. But we're not in Germany. And spam is an international problem AND RIPE is not dealing with Germany ONLY > >> You need to learn that you cannot use certain terms without there being repurcussions. If you state that AS39122 / Blacknight "caused" spam then that, as far as I am concerned, is both: >> >> - false >> - damaging to us >> >> and enough of a reason for us to sue you. >> >> Clear enough? > > Yes, but not true in Germany. Maybe you need to talk to the German RIPE members only then? > > I could call you that even, if you have enough knowledge and manpower to prevent > spam and hacks coming from your networks even without being informed > through third parties and still are doing nothing (where I personally > think, the knwoledge should be part of it). > > Lets say, one of your servers is hacked and the hacking of one of > our servers started from your IP. > I could sue against "unknown" AND you as being a "Mittaeter", because > you could have monitored your server better (as a big and experiences > ISP you should have the possibility to monitor your traffic and servers > easily). > > Surely only if your company is located in Germany. > > > Thats why I can call everybody that could do something against > spam and hacks easily "a" cause of the problem, if he doesnt > do anything after he gets informed. > And thats why it is that important to have the possibility to inform > every RIPE member from a German view. > If they have knowledge, it is even more easy to sue them, if they > didnt do anything. > > And thats why all bigger German ISPs have a working abuse department. > They would be sued to often, if they would totally ignore the reality. > Sure there is spam also coming from German networks, but its dropping > and more and more ISPs implement usefull ssystem to prevent abuse. > And according to the amount of Germans activley using the Internet > and the amount of servers hosted in Germany, I personally think, > that the rate isnt that bad. > > The only problem here is still, that you have to sue them > for every single incident and not in a more general way, > and that you have to proove how much you lost, because > of the incident, but the later is possible in most cases. > > > Kind regards, Frank > -- > PHADE Software - PowerWeb http://www.powerweb.de > Inh. Dipl.-Inform. Frank Gadegast mailto:frank@powerweb.de > Schinkelstrasse 17 fon: +49 33200 52920 > 14558 Nuthetal OT Rehbruecke, Germany fax: +49 33200 52921 > ====================================================================== > Public PGP Key available for frank(a)powerweb.de > >> >> >>> >>> There is a lot of members that actively host spammers. >> >> Define "a lot" >> >> Define "spammers" >> >>> That make money on it. >>> That make money with things that are illegal in other countries. >> >> That's an inane comment. >> >> Lots of things are illegal in lots of countries. >> >> You cannot honestly expect an Irish ISP to impose a German law on its Irish customers, can you? >> >> >>> That dont care about hacked servers or hacked dialin customers. >>> >>>>>> The only people who seem to benefit from lots of data are vendors trying to sell "solutions" >>>>> >>>>> Why that ? >>>>> RIPE will not have to buy any "solution". >>>>> RIPE NCC has a own programmers team. >>>>> They will have to buy servers and bandwidth, thats it. >>>> >>>> Please actually read what I wrote >>> >>> Well, your comment was out of scope >> >> Why? >> >> Just because you are having difficulties understanding my reasoning does not render my comment "out of scope" and in any case, who are you to decide what is "in scope" and what isn't? >> >> >> >>> , so you mean, that a system like >>> I described will cut the revenue of vendors selling antispam or >>> antivirus solutions ? >>> >>> Well, who cares ? >>> Internet is free. >> >> No it isn't >> >> >>> And business is, when you can sell something. >>> >>> If there is no oil anymore tomorrow, well sell electric cars ... >>> >>>>>> Not all RIPE members offer connectivity in the same way nor do they have the same types of services. >>>>> >>>>> Do you mean Universities or others with free access ? >>>> >>>> Have a look at the full list of RIPE members and have a look at what each and every one of them is doing. >>> >>> Come on, I you that wise, please let me participate at your knowledge ... >> >> You are the one proposing a well meaning, but very badly thought out concept. >> You have not taken into consideration a lot of factors that you probably should. >> >> >> >>> >>>>> Where a needed abuse team would cause additional costs ? >>>>> >>>>> Come on, if any non-provit organisation is not taking into account what they >>>>> cause by ignoring the risks they cause, there is something wrong in the calulation >>>>> anyway. >>>> >>>> I never said anything about non-profits >>> >>> Yes, buts the only organisation form I can think of, that will have a problem >>> in developing an abuse team. >> >> >> Then maybe you need to broaden your mind. >> >> As I already suggested, have a closer look at the RIPE member list >> >> >>> >>>>>> You assume that my comment about business models infers that people would ignore an issue. This is not in the least bit helpful >>>>> >>>>> Well, a lot are ignoring it, and even worse, a lot make profit with it >>>> >>>> Again - accusing RIPE members of profiting from something that you consider to be criminal is NOT helpful >>> >>> Why not ? >>> Naming things is always helpfull. >> >> Being sued isn't .. >> >>> >>> Do you think that RIPE is a cleaner region than others ? >>> Look at the worsed spammer at spamhaus, where are they located ? >>> USA, Russia, Korea ... oops, Russia is the RIPE region. >>> >>> >>> Kind regards, Frank >>> >>>> >>>> Please tone it down >>>> >>>> >>>> >>>>> (if its only, that they charged the traffic and are happy about every >>>>> spam that comes out of a spambotted PC). >>>>> >>>>>> What you need to understand is that not every single RIPE member is going to be doing the same thing and may not be aware of or need to be aware of certain things. >>>>> >>>>> Thats the basic problem, like I wrote an hour ago. >>>>> >>>>> Is the community willing to accept the fact, that there are members causing >>>>> a lot of problems, that they harm others, that they create costs for others >>>>> and even act against laws in other countries, just because they are >>>>> not willing to take responsibility for the services they get from RIPE ? >>>>> >>>>> And is RIPE willing to do nothing against those members ? >>>>> >>>>>> Lack of awareness does not equate with anything more than lack of awareness, however you seem to think that a bit of ignorance equates with culpability. >>>>> >>>>> Missing awareness could be changed with education ... >>>> >>>> >>>> Yes, but your concept of education would not be conducive to anyone actually wanting to learn .. >>>> >>>>> >>>>> >>>>> >>>>> Kind regards, Frank >>>>> -- >>>>> PHADE Software - PowerWeb http://www.powerweb.de >>>>> Inh. Dipl.-Inform. Frank Gadegast mailto:frank@powerweb.de >>>>> Schinkelstrasse 17 fon: +49 33200 52920 >>>>> 14558 Nuthetal OT Rehbruecke, Germany fax: +49 33200 52921 >>>>> ====================================================================== >>>>> Public PGP Key available for frank(a)powerweb.de >>>>>> >>>>>> >>>>>>> >>>>>>> An example please. >>>>>>> >>>>>>>>>>> "Bad providers" could be even published by RIPE :o) >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> Are you insane? RIPE cannot open itself up for that kind of liability >>>>>>>>> >>>>>>>>> Why not, blacklists are doing the same, whats the difference ? >>>>>>>> >>>>>>>> Ask a lawyer. >>>>>>> >>>>>>> More details please. >>>>>> >>>>>> Seriously - if you cannot understand why RIPE (or anyone else) publishing a list of companies that are described as "bad" does not open it up to liability then you really need to talk to your legal team (if you have one) >>>>>> >>>>>> Spamhaus et al get hit with legal threats on a regular basis. >>>>>> >>>>>> As a sponsor of Spamhaus we've had people try to get us involved in the past .. >>>>>> >>>>>>> >>>>>>>>>>> Well, thats only work at RIPE NCC, its not that complicated to >>>>>>>>>>> automated bounces ... >>>>>>>>>> >>>>>>>>>> So you say .. >>>>>>>>> >>>>>>>>> Yes, its quite easy. >>>>>>>> >>>>>>>> No it isn't. >>>>>>> >>>>>>> It is, we developed our own blacklist, and that wasnt that much work. >>>>>> >>>>>> You obviously have a lot of technical staff. Not every RIPE member does nor needs to. >>>>>> >>>>>> You need to understand that just because something is "easy" for you due to your particular setup does not mean that it is going to be as "easy" for everyone else >>>>>> >>>>>> >>>>>>> A powerfull organisation with competent workers like RIPE would create >>>>>>> that in really short time. >>>>>>> >>>>>>> Please give me arguments, why its soo complicated. >>>>>>> >>>>>>> Mailtools are wellknown, open source and available for nearly everything >>>>>>> you might want to do with mail. >>>>>>> It is easy, I was even already thinking about to use our own >>>>>>> blacklist as testbed, we not all available abuse contacts anyway >>>>>>> and to setup a general formatted email address is two lines >>>>>>> in the mailserver config and to pump that in a script that >>>>>>> forwards the mail after looking up the correct address is a >>>>>>> ten-liner in perl. >>>>>>> >>>>>>> Im still thinking about this testbed, the only problem is: >>>>>>> - our abuse addresses we have might not be as reliable >>>>>>> than RIPE will have them and it would be really bad to accuse >>>>>>> the wrong person or even expose details to the wrong >>>>>>> person >>>>>>> >>>>>>> If I would get complete access to all personal objects at RIPE in >>>>>>> a live process, a would think about the testbed again ... >>>>>>> >>>>>>> I could even sign whatever non-disclosure to ensure, that we >>>>>>> are not doing anything wrong with this data. >>>>>>> >>>>>>>> Either: >>>>>>>> >>>>>>>> - learn how to discuss this with other RIPE members >>>>>>>> or >>>>>>>> >>>>>>>> keep on with your stupid attitude and see how far it gets you >>>>>>> >>>>>>> Hm, Im not starting with words like "stupid", so please do not >>>>>>> reglement my tone and cool down first. >>>>>> >>>>>> >>>>>>> >>>>>>> You seem to fight heavily against any idea arriving here. >>>>>>> What are you so frightened about ? >>>>>> >>>>>> If you present what could be potentially be a positive thing in this manner it will not be accepted by people for a multitude of reasons, not least your tunneled view of the world. >>>>>> >>>>>> >>>>>> >>>>>>> >>>>>>>>>> You cannot speak for all providers / RIPE members. >>>>>>>>> >>>>>>>>> Thats one of the reasons for a centralized system located at RIPE. >>>>>>>>> The system only needs to be implemented once, there will be nearly >>>>>>>>> no costs on the members side (except that they have >>>>>>>>> to deal with report, but they can still ignore them and except >>>>>>>>> the costs that might be added to RIPEs fees, but that should not be that >>>>>>>>> much. >>>>>>>> >>>>>>>> You do not know that. >>>>>>>> >>>>>>>> You have no way of knowing how much of a load would be placed on RIPE's systems >>>>>>> >>>>>>> Sure, but RIPE is using millions of EUR yearly to get everything going. >>>>>>> You are an ISP yourself, make a guess, how much that costs >>>>>>> if you do not have to make provit. >>>>>>> >>>>>>> I quick guess: >>>>>>> - a redundant mailserver environment capable of what ? deliver 50 mio mails a day ? >>>>>>> - a would say 100GB traffic/day and 25 highend server >>>>>>> - thats about 3000 EUR traffic-costs a month >>>>>>> - and about 50 thousand one time invest for the servers >>>>>>> >>>>>>> - plus the development, I would implement something like this with >>>>>>> one month work, ok 5.000 >>>>>>> - plus hirering one person to take care about hardware and special cases, that >>>>>>> 3.000/month >>>>>> >>>>>> OK, but centralising anything like this has a lot of negative consequences that other list members have outlined. >>>>>> >>>>>>> >>>>>>> All together, lets say 6.000 per month plus the invest. >>>>>>> And now devide this to all members with the usual scale >>>>>>> (small pay less than big members), how much would that add >>>>>>> to the normal yearly membership costs ? >>>>>>> Could somebody could quickly compare that to the last yearly costs at RIPE ? >>>>>>> >>>>>>> You can save that if you only cut 30 peoples journeys to nice holiday locations >>>>>>> for "meetings" that could be done via modern comunication techniques anyway >>>>>>> per year. >>>>>> >>>>>> Face to face meetings work better for a LOT of people. >>>>>> >>>>>> >>>>>> >>>>>>> >>>>>>>>>>> Well, the monitoring system could send always the same backlink >>>>>>>>>>> for the same IP, so that the ISP could still count the amount >>>>>>>>>>> of incoming reports for one IP automatically and then >>>>>>>>>>> "answers" it as being closed with just clicking ONE link. >>>>>>>>>>> >>>>>>>>>>> Good idea ? >>>>>>>>>> >>>>>>>>>> So you expect RIPE members to completely rework their abuse desks to fit into your view of the world? >>>>>>>>> >>>>>>>>> Not MY VIEW, a standarized view. >>>>>>>> >>>>>>>> You're not a very good listener, are you? >>>>>>> >>>>>>> Might be because Im not english-speaking ... (like I noted when I was sending the draft). >>>>>>> >>>>>>> But, like I outlined above, a rework is not really neccessary. >>>>>>> Currently members are receiving lots of different formatted reports >>>>>>> to their abuse desk (if they have one) and have to read them all manually. >>>>>>> It isnt that bad, if you will get reports, that are more standarized. >>>>>>> >>>>>>>>> Thats the goal. >>>>>>>>> >>>>>>>>> Lets see it this way: providers have to change their infrastructure >>>>>>>>> regulary for a couple or reasons and always have done. >>>>>>>>> Serverhousing changed pretty much during the last years. >>>>>>>>> There was the change from ISDN to DSL dialin, there are new >>>>>>>>> technologies for HTML, Flash and Mail every day. >>>>>>>>> >>>>>>>>> And do not forget IPv6, EVERY member has to change that in the new future. >>>>>>>>> >>>>>>>>>> I can't see that happening, because not all RIPE members are the same or work in the same way. >>>>>>>>> >>>>>>>>> Well they work on the same basics, what are allocations and other resources. >>>>>>>>> Resources cause traffic, and every members uses resources like nameservices, >>>>>>>>> webpages and email. And spam problem comes into play with the later. >>>>>>>>> >>>>>>>>> The difference isnt that big. >>>>>>>>> Business models have nothing to do with how to deal with resources the got from RIPE. >>>>>>>> >>>>>>>> Yes it does >>>>>>>> >>>>>>>> If you think that you can live in a world where business models have zero impact on reality then you are deluded >>>>>>> >>>>>>> Example, please give an example .... >>>>>> >>>>>> I don't need to >>>>>> >>>>>> It's a simple fact. >>>>>> >>>>>> The fact that I've raised it (more than once) is enough (we are a RIPE member among other things .. ) >>>>>> >>>>>> >>>>>> >>>>>> Mr Michele Neylon >>>>>> Blacknight Solutions >>>>>> Hosting & Colocation, Brand Protection >>>>>> ICANN Accredited Registrar >>>>>> http://www.blacknight.com/ >>>>>> http://blog.blacknight.com/ >>>>>> http://mneylon.tel >>>>>> Intl. +353 (0) 59 9183072 >>>>>> US: 213-233-1612 >>>>>> UK: 0844 484 9361 >>>>>> Locall: 1850 929 929 >>>>>> Direct Dial: +353 (0)59 9183090 >>>>>> Twitter: http://twitter.com/mneylon >>>>>> ------------------------------- >>>>>> Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty >>>>>> Road,Graiguecullen,Carlow,Ireland Company No.: 370845 >>>>>> >>>>>> >>>>> >>>> >>>> Mr Michele Neylon >>>> Blacknight Solutions >>>> Hosting & Colocation, Brand Protection >>>> ICANN Accredited Registrar >>>> http://www.blacknight.com/ >>>> http://blog.blacknight.com/ >>>> http://mneylon.tel >>>> Intl. +353 (0) 59 9183072 >>>> US: 213-233-1612 >>>> UK: 0844 484 9361 >>>> Locall: 1850 929 929 >>>> Direct Dial: +353 (0)59 9183090 >>>> Twitter: http://twitter.com/mneylon >>>> ------------------------------- >>>> Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty >>>> Road,Graiguecullen,Carlow,Ireland Company No.: 370845 >>>> >>>> >>> >> >> Mr Michele Neylon >> Blacknight Solutions >> Hosting & Colocation, Brand Protection >> ICANN Accredited Registrar >> http://www.blacknight.com/ >> http://blog.blacknight.com/ >> http://mneylon.tel >> Intl. +353 (0) 59 9183072 >> US: 213-233-1612 >> UK: 0844 484 9361 >> Locall: 1850 929 929 >> Direct Dial: +353 (0)59 9183090 >> Twitter: http://twitter.com/mneylon >> ------------------------------- >> Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty >> Road,Graiguecullen,Carlow,Ireland Company No.: 370845 >> >> > Mr Michele Neylon Blacknight Solutions Hosting & Colocation, Brand Protection ICANN Accredited Registrar http://www.blacknight.com/ http://blog.blacknight.com/ http://mneylon.tel Intl. +353 (0) 59 9183072 US: 213-233-1612 UK: 0844 484 9361 Locall: 1850 929 929 Direct Dial: +353 (0)59 9183090 Twitter: http://twitter.com/mneylon ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,Ireland Company No.: 370845

1 0

Re: [anti-abuse-wg] DRAFT: RIPE proposal - implementation of an abuse
by James Davis 09 Apr '10

09 Apr '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dipl-Inform. Frank Gadegast wrote: > You dont need to know the real one until you have one for every IP. As I mentioned, you might simply want to contact the abuse team regarding a more general issue. Quite often if I can't find a published abuse contact for foo.com so I'll dig www.foo.com and then lookup the returned address in the RIPE DB - I'm not at all interested in an address specific to that IP address though. > Metric ? Metric as in a standard of measurement. Sorry that probably wasn't very clear language on my part. > And that prooves what ? I have 17 million+ users, and a remit to provide very open network access to them. It's inevitable that somewhere on the network someone is sending large volumes of spam, what's important is how quickly and effecitvely we react to that incident. Someone from RIPE calling us, to offer us a training course we don't need, because last year we had a few hosts sending 100,000+ spam e-mails isn't a useful use of anyone's resources. This, and my comment about NAT, are just illustrations of how you need to be careful over deciding what you consider to be a large volume of reports. > Well at least you will hear about incidents with the new system > and thats more thats currently happening. We already hear about incidents. Almost all the address space used on our network has an irt object published and reports reach us at the correct address. I'm not convinced that any abuse team who really wants to make themselves contactable has problems doing so (whether they are aware of the irt object or not is another matter). The difficulty is in convincing network owners that they need abuse teams that take the issue seriously :) > Yes, thats why I stated that. > A solution could be, that the RIPE system will return a link > to the report sender, that has to be clicked, before the report > will be forwarded to the member. > > Will that help ? Sorry I missed that in my original reading. > A member abuse address could be resetted automatically to the members > main email adress (but is very likely to be read by the member). > The member would not want that many emails arrive at that main address > and fix the abuse address asap. > > This process could be automated at RIPE system. I don't know anything about RIPE's existing processes for making sure that member information is correct but I suspect that it still requires human effort as a last resort. > Another idea to stop spam coming in, could be to open > the whole system only to RIPE members first ! > > The ISP could work together and all others stay out. > > Will that be a solution ? No, I suspect most of our reports come from non RIPE members. The link confirmation would be enough, although you'd need some way to deal with automated reports. >> No, it'll just ensure that the reports end up being delivered to an > > Thats far more, that we have now ... Shuffling bits from one mailbox to another doesn't constitute actual progress. You need to give a reason for the recipient to care enough about the reports to do something - and if they have that reason they'll take care of making themselves contactable for you :) James - -- James Davis +44 1235 822 229 PGP: 0xD1622876 JANET CSIRT 0870 850 2340 (+44 1235 822 340) Lumen House, Library Avenue, Didcot, Oxfordshire, OX11 0SG -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iD8DBQFLvgCNhZi14NFiKHYRAnvWAJ9z0cWJq/rXaNZgyEPcG3MhdEODhgCfb2OZ MMz5kWuRdgtPKF3vuY9L2OI= =DfbR -----END PGP SIGNATURE----- JANET(UK) is a trading name of The JNT Association, a company limited by guarantee which is registered in England under No. 2881024 and whose Registered Office is at Lumen House, Library Avenue, Harwell Science and Innovation Campus, Didcot, Oxfordshire. OX11 0SG

8 7

Re: [anti-abuse-wg] DRAFT: RIPE proposal - implementation of an
by Michele Neylon :: Blacknight 09 Apr '10

09 Apr '10

Frank Either you are doing this intentionally or accidentally, but you keep emailing me offlist > > Yes I do. And my experience is even, that things get more easy, > when they get bigger. > But its not my reputation that we should talk about. You are trying to impose your views on everyone else, so it is therefore important to understand from what stance you are speaking > > If just that weird that a few members on the list are that heavily > against anything that would change the current situation without > really saying what disturbing them. Your modus operandi > > If you have another perspective or other needs, simply name them. > In details. Read my last few emails > >>> Small, but effective. >>> >>>>> Like I outline already: >>>>> - whois is complicated and unusefull for end users >>>>> - IRT objects makes it even more complicated >>>>> - nobody is meassuring the members so far >>>> >>>> Why is measuring the data of any use to any one? >>> >>> This group is already talking to Government related organisations. >>> If you like them to act, you need data. >>> >>>> What data are you trying to measure? >>> >>> Surely the amount of spam every member causes. >> >> "causes" ? > > The amount of spam they cause ... thats running > out of there networks ... or even how many real abuse reports > they get or whatever else to indicate, who does care or > what doesnt. > >> Seriously you cannot state that a member "causes" anything. > > Sure I can. Ok, let me put it to you in very clear terms If you ever get spam or other junk from our network and you state anywhere in public that we "caused it" I will sue you and I'm sure there are others who would too. You need to learn that you cannot use certain terms without there being repurcussions. If you state that AS39122 / Blacknight "caused" spam then that, as far as I am concerned, is both: - false - damaging to us and enough of a reason for us to sue you. Clear enough? > > There is a lot of members that actively host spammers. Define "a lot" Define "spammers" > That make money on it. > That make money with things that are illegal in other countries. That's an inane comment. Lots of things are illegal in lots of countries. You cannot honestly expect an Irish ISP to impose a German law on its Irish customers, can you? > That dont care about hacked servers or hacked dialin customers. > >>>> The only people who seem to benefit from lots of data are vendors trying to sell "solutions" >>> >>> Why that ? >>> RIPE will not have to buy any "solution". >>> RIPE NCC has a own programmers team. >>> They will have to buy servers and bandwidth, thats it. >> >> Please actually read what I wrote > > Well, your comment was out of scope Why? Just because you are having difficulties understanding my reasoning does not render my comment "out of scope" and in any case, who are you to decide what is "in scope" and what isn't? > , so you mean, that a system like > I described will cut the revenue of vendors selling antispam or > antivirus solutions ? > > Well, who cares ? > Internet is free. No it isn't > And business is, when you can sell something. > > If there is no oil anymore tomorrow, well sell electric cars ... > >>>> Not all RIPE members offer connectivity in the same way nor do they have the same types of services. >>> >>> Do you mean Universities or others with free access ? >> >> Have a look at the full list of RIPE members and have a look at what each and every one of them is doing. > > Come on, I you that wise, please let me participate at your knowledge ... You are the one proposing a well meaning, but very badly thought out concept. You have not taken into consideration a lot of factors that you probably should. > >>> Where a needed abuse team would cause additional costs ? >>> >>> Come on, if any non-provit organisation is not taking into account what they >>> cause by ignoring the risks they cause, there is something wrong in the calulation >>> anyway. >> >> I never said anything about non-profits > > Yes, buts the only organisation form I can think of, that will have a problem > in developing an abuse team. Then maybe you need to broaden your mind. As I already suggested, have a closer look at the RIPE member list > >>>> You assume that my comment about business models infers that people would ignore an issue. This is not in the least bit helpful >>> >>> Well, a lot are ignoring it, and even worse, a lot make profit with it >> >> Again - accusing RIPE members of profiting from something that you consider to be criminal is NOT helpful > > Why not ? > Naming things is always helpfull. Being sued isn't .. > > Do you think that RIPE is a cleaner region than others ? > Look at the worsed spammer at spamhaus, where are they located ? > USA, Russia, Korea ... oops, Russia is the RIPE region. > > > Kind regards, Frank > >> >> Please tone it down >> >> >> >>> (if its only, that they charged the traffic and are happy about every >>> spam that comes out of a spambotted PC). >>> >>>> What you need to understand is that not every single RIPE member is going to be doing the same thing and may not be aware of or need to be aware of certain things. >>> >>> Thats the basic problem, like I wrote an hour ago. >>> >>> Is the community willing to accept the fact, that there are members causing >>> a lot of problems, that they harm others, that they create costs for others >>> and even act against laws in other countries, just because they are >>> not willing to take responsibility for the services they get from RIPE ? >>> >>> And is RIPE willing to do nothing against those members ? >>> >>>> Lack of awareness does not equate with anything more than lack of awareness, however you seem to think that a bit of ignorance equates with culpability. >>> >>> Missing awareness could be changed with education ... >> >> >> Yes, but your concept of education would not be conducive to anyone actually wanting to learn .. >> >>> >>> >>> >>> Kind regards, Frank >>> -- >>> PHADE Software - PowerWeb http://www.powerweb.de >>> Inh. Dipl.-Inform. Frank Gadegast mailto:frank@powerweb.de >>> Schinkelstrasse 17 fon: +49 33200 52920 >>> 14558 Nuthetal OT Rehbruecke, Germany fax: +49 33200 52921 >>> ====================================================================== >>> Public PGP Key available for frank(a)powerweb.de >>>> >>>> >>>>> >>>>> An example please. >>>>> >>>>>>>>> "Bad providers" could be even published by RIPE :o) >>>>>>>> >>>>>>>> >>>>>>>> Are you insane? RIPE cannot open itself up for that kind of liability >>>>>>> >>>>>>> Why not, blacklists are doing the same, whats the difference ? >>>>>> >>>>>> Ask a lawyer. >>>>> >>>>> More details please. >>>> >>>> Seriously - if you cannot understand why RIPE (or anyone else) publishing a list of companies that are described as "bad" does not open it up to liability then you really need to talk to your legal team (if you have one) >>>> >>>> Spamhaus et al get hit with legal threats on a regular basis. >>>> >>>> As a sponsor of Spamhaus we've had people try to get us involved in the past .. >>>> >>>>> >>>>>>>>> Well, thats only work at RIPE NCC, its not that complicated to >>>>>>>>> automated bounces ... >>>>>>>> >>>>>>>> So you say .. >>>>>>> >>>>>>> Yes, its quite easy. >>>>>> >>>>>> No it isn't. >>>>> >>>>> It is, we developed our own blacklist, and that wasnt that much work. >>>> >>>> You obviously have a lot of technical staff. Not every RIPE member does nor needs to. >>>> >>>> You need to understand that just because something is "easy" for you due to your particular setup does not mean that it is going to be as "easy" for everyone else >>>> >>>> >>>>> A powerfull organisation with competent workers like RIPE would create >>>>> that in really short time. >>>>> >>>>> Please give me arguments, why its soo complicated. >>>>> >>>>> Mailtools are wellknown, open source and available for nearly everything >>>>> you might want to do with mail. >>>>> It is easy, I was even already thinking about to use our own >>>>> blacklist as testbed, we not all available abuse contacts anyway >>>>> and to setup a general formatted email address is two lines >>>>> in the mailserver config and to pump that in a script that >>>>> forwards the mail after looking up the correct address is a >>>>> ten-liner in perl. >>>>> >>>>> Im still thinking about this testbed, the only problem is: >>>>> - our abuse addresses we have might not be as reliable >>>>> than RIPE will have them and it would be really bad to accuse >>>>> the wrong person or even expose details to the wrong >>>>> person >>>>> >>>>> If I would get complete access to all personal objects at RIPE in >>>>> a live process, a would think about the testbed again ... >>>>> >>>>> I could even sign whatever non-disclosure to ensure, that we >>>>> are not doing anything wrong with this data. >>>>> >>>>>> Either: >>>>>> >>>>>> - learn how to discuss this with other RIPE members >>>>>> or >>>>>> >>>>>> keep on with your stupid attitude and see how far it gets you >>>>> >>>>> Hm, Im not starting with words like "stupid", so please do not >>>>> reglement my tone and cool down first. >>>> >>>> >>>>> >>>>> You seem to fight heavily against any idea arriving here. >>>>> What are you so frightened about ? >>>> >>>> If you present what could be potentially be a positive thing in this manner it will not be accepted by people for a multitude of reasons, not least your tunneled view of the world. >>>> >>>> >>>> >>>>> >>>>>>>> You cannot speak for all providers / RIPE members. >>>>>>> >>>>>>> Thats one of the reasons for a centralized system located at RIPE. >>>>>>> The system only needs to be implemented once, there will be nearly >>>>>>> no costs on the members side (except that they have >>>>>>> to deal with report, but they can still ignore them and except >>>>>>> the costs that might be added to RIPEs fees, but that should not be that >>>>>>> much. >>>>>> >>>>>> You do not know that. >>>>>> >>>>>> You have no way of knowing how much of a load would be placed on RIPE's systems >>>>> >>>>> Sure, but RIPE is using millions of EUR yearly to get everything going. >>>>> You are an ISP yourself, make a guess, how much that costs >>>>> if you do not have to make provit. >>>>> >>>>> I quick guess: >>>>> - a redundant mailserver environment capable of what ? deliver 50 mio mails a day ? >>>>> - a would say 100GB traffic/day and 25 highend server >>>>> - thats about 3000 EUR traffic-costs a month >>>>> - and about 50 thousand one time invest for the servers >>>>> >>>>> - plus the development, I would implement something like this with >>>>> one month work, ok 5.000 >>>>> - plus hirering one person to take care about hardware and special cases, that >>>>> 3.000/month >>>> >>>> OK, but centralising anything like this has a lot of negative consequences that other list members have outlined. >>>> >>>>> >>>>> All together, lets say 6.000 per month plus the invest. >>>>> And now devide this to all members with the usual scale >>>>> (small pay less than big members), how much would that add >>>>> to the normal yearly membership costs ? >>>>> Could somebody could quickly compare that to the last yearly costs at RIPE ? >>>>> >>>>> You can save that if you only cut 30 peoples journeys to nice holiday locations >>>>> for "meetings" that could be done via modern comunication techniques anyway >>>>> per year. >>>> >>>> Face to face meetings work better for a LOT of people. >>>> >>>> >>>> >>>>> >>>>>>>>> Well, the monitoring system could send always the same backlink >>>>>>>>> for the same IP, so that the ISP could still count the amount >>>>>>>>> of incoming reports for one IP automatically and then >>>>>>>>> "answers" it as being closed with just clicking ONE link. >>>>>>>>> >>>>>>>>> Good idea ? >>>>>>>> >>>>>>>> So you expect RIPE members to completely rework their abuse desks to fit into your view of the world? >>>>>>> >>>>>>> Not MY VIEW, a standarized view. >>>>>> >>>>>> You're not a very good listener, are you? >>>>> >>>>> Might be because Im not english-speaking ... (like I noted when I was sending the draft). >>>>> >>>>> But, like I outlined above, a rework is not really neccessary. >>>>> Currently members are receiving lots of different formatted reports >>>>> to their abuse desk (if they have one) and have to read them all manually. >>>>> It isnt that bad, if you will get reports, that are more standarized. >>>>> >>>>>>> Thats the goal. >>>>>>> >>>>>>> Lets see it this way: providers have to change their infrastructure >>>>>>> regulary for a couple or reasons and always have done. >>>>>>> Serverhousing changed pretty much during the last years. >>>>>>> There was the change from ISDN to DSL dialin, there are new >>>>>>> technologies for HTML, Flash and Mail every day. >>>>>>> >>>>>>> And do not forget IPv6, EVERY member has to change that in the new future. >>>>>>> >>>>>>>> I can't see that happening, because not all RIPE members are the same or work in the same way. >>>>>>> >>>>>>> Well they work on the same basics, what are allocations and other resources. >>>>>>> Resources cause traffic, and every members uses resources like nameservices, >>>>>>> webpages and email. And spam problem comes into play with the later. >>>>>>> >>>>>>> The difference isnt that big. >>>>>>> Business models have nothing to do with how to deal with resources the got from RIPE. >>>>>> >>>>>> Yes it does >>>>>> >>>>>> If you think that you can live in a world where business models have zero impact on reality then you are deluded >>>>> >>>>> Example, please give an example .... >>>> >>>> I don't need to >>>> >>>> It's a simple fact. >>>> >>>> The fact that I've raised it (more than once) is enough (we are a RIPE member among other things .. ) >>>> >>>> >>>> >>>> Mr Michele Neylon >>>> Blacknight Solutions >>>> Hosting & Colocation, Brand Protection >>>> ICANN Accredited Registrar >>>> http://www.blacknight.com/ >>>> http://blog.blacknight.com/ >>>> http://mneylon.tel >>>> Intl. +353 (0) 59 9183072 >>>> US: 213-233-1612 >>>> UK: 0844 484 9361 >>>> Locall: 1850 929 929 >>>> Direct Dial: +353 (0)59 9183090 >>>> Twitter: http://twitter.com/mneylon >>>> ------------------------------- >>>> Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty >>>> Road,Graiguecullen,Carlow,Ireland Company No.: 370845 >>>> >>>> >>> >> >> Mr Michele Neylon >> Blacknight Solutions >> Hosting & Colocation, Brand Protection >> ICANN Accredited Registrar >> http://www.blacknight.com/ >> http://blog.blacknight.com/ >> http://mneylon.tel >> Intl. +353 (0) 59 9183072 >> US: 213-233-1612 >> UK: 0844 484 9361 >> Locall: 1850 929 929 >> Direct Dial: +353 (0)59 9183090 >> Twitter: http://twitter.com/mneylon >> ------------------------------- >> Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty >> Road,Graiguecullen,Carlow,Ireland Company No.: 370845 >> >> > Mr Michele Neylon Blacknight Solutions Hosting & Colocation, Brand Protection ICANN Accredited Registrar http://www.blacknight.com/ http://blog.blacknight.com/ http://mneylon.tel Intl. +353 (0) 59 9183072 US: 213-233-1612 UK: 0844 484 9361 Locall: 1850 929 929 Direct Dial: +353 (0)59 9183090 Twitter: http://twitter.com/mneylon ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,Ireland Company No.: 370845

1 0

Re: [anti-abuse-wg] DRAFT: RIPE proposal - implementation of an
by Michele Neylon :: Blacknight 09 Apr '10

09 Apr '10

On 9 Apr 2010, at 12:29, Frank Gadegast , Dipl-Inform. Frank Gadegast wrote: >>> >> >> As someone who has spent a lot of money and time combatting network abuse I find your attitude completely unhelpful > > Not at all, we are small, and have no stress with abuse reports for our customers, Yes - you are small Not all RIPE members are .. > because they are trained and the servers are managed by us, hardened and monitored. > We have abuse problem, but very little. > > The implementation of our blacklist took a month work for one person > and is now protecting about 5000 email accounts. So you have no real experience of dealing with large volumes of mail then. > Small, but effective. > >>> Like I outline already: >>> - whois is complicated and unusefull for end users >>> - IRT objects makes it even more complicated >>> - nobody is meassuring the members so far >> >> Why is measuring the data of any use to any one? > > This group is already talking to Government related organisations. > If you like them to act, you need data. > >> What data are you trying to measure? > > Surely the amount of spam every member causes. "causes" ? Seriously you cannot state that a member "causes" anything. > >> The only people who seem to benefit from lots of data are vendors trying to sell "solutions" > > Why that ? > RIPE will not have to buy any "solution". > RIPE NCC has a own programmers team. > They will have to buy servers and bandwidth, thats it. Please actually read what I wrote > >> Not all RIPE members offer connectivity in the same way nor do they have the same types of services. > > Do you mean Universities or others with free access ? Have a look at the full list of RIPE members and have a look at what each and every one of them is doing. > Where a needed abuse team would cause additional costs ? > > Come on, if any non-provit organisation is not taking into account what they > cause by ignoring the risks they cause, there is something wrong in the calulation > anyway. I never said anything about non-profits > >> You assume that my comment about business models infers that people would ignore an issue. This is not in the least bit helpful > > Well, a lot are ignoring it, and even worse, a lot make profit with it Again - accusing RIPE members of profiting from something that you consider to be criminal is NOT helpful Please tone it down > (if its only, that they charged the traffic and are happy about every > spam that comes out of a spambotted PC). > >> What you need to understand is that not every single RIPE member is going to be doing the same thing and may not be aware of or need to be aware of certain things. > > Thats the basic problem, like I wrote an hour ago. > > Is the community willing to accept the fact, that there are members causing > a lot of problems, that they harm others, that they create costs for others > and even act against laws in other countries, just because they are > not willing to take responsibility for the services they get from RIPE ? > > And is RIPE willing to do nothing against those members ? > >> Lack of awareness does not equate with anything more than lack of awareness, however you seem to think that a bit of ignorance equates with culpability. > > Missing awareness could be changed with education ... Yes, but your concept of education would not be conducive to anyone actually wanting to learn .. > > > > Kind regards, Frank > -- > PHADE Software - PowerWeb http://www.powerweb.de > Inh. Dipl.-Inform. Frank Gadegast mailto:frank@powerweb.de > Schinkelstrasse 17 fon: +49 33200 52920 > 14558 Nuthetal OT Rehbruecke, Germany fax: +49 33200 52921 > ====================================================================== > Public PGP Key available for frank(a)powerweb.de >> >> >>> >>> An example please. >>> >>>>>>> "Bad providers" could be even published by RIPE :o) >>>>>> >>>>>> >>>>>> Are you insane? RIPE cannot open itself up for that kind of liability >>>>> >>>>> Why not, blacklists are doing the same, whats the difference ? >>>> >>>> Ask a lawyer. >>> >>> More details please. >> >> Seriously - if you cannot understand why RIPE (or anyone else) publishing a list of companies that are described as "bad" does not open it up to liability then you really need to talk to your legal team (if you have one) >> >> Spamhaus et al get hit with legal threats on a regular basis. >> >> As a sponsor of Spamhaus we've had people try to get us involved in the past .. >> >>> >>>>>>> Well, thats only work at RIPE NCC, its not that complicated to >>>>>>> automated bounces ... >>>>>> >>>>>> So you say .. >>>>> >>>>> Yes, its quite easy. >>>> >>>> No it isn't. >>> >>> It is, we developed our own blacklist, and that wasnt that much work. >> >> You obviously have a lot of technical staff. Not every RIPE member does nor needs to. >> >> You need to understand that just because something is "easy" for you due to your particular setup does not mean that it is going to be as "easy" for everyone else >> >> >>> A powerfull organisation with competent workers like RIPE would create >>> that in really short time. >>> >>> Please give me arguments, why its soo complicated. >>> >>> Mailtools are wellknown, open source and available for nearly everything >>> you might want to do with mail. >>> It is easy, I was even already thinking about to use our own >>> blacklist as testbed, we not all available abuse contacts anyway >>> and to setup a general formatted email address is two lines >>> in the mailserver config and to pump that in a script that >>> forwards the mail after looking up the correct address is a >>> ten-liner in perl. >>> >>> Im still thinking about this testbed, the only problem is: >>> - our abuse addresses we have might not be as reliable >>> than RIPE will have them and it would be really bad to accuse >>> the wrong person or even expose details to the wrong >>> person >>> >>> If I would get complete access to all personal objects at RIPE in >>> a live process, a would think about the testbed again ... >>> >>> I could even sign whatever non-disclosure to ensure, that we >>> are not doing anything wrong with this data. >>> >>>> Either: >>>> >>>> - learn how to discuss this with other RIPE members >>>> or >>>> >>>> keep on with your stupid attitude and see how far it gets you >>> >>> Hm, Im not starting with words like "stupid", so please do not >>> reglement my tone and cool down first. >> >> >>> >>> You seem to fight heavily against any idea arriving here. >>> What are you so frightened about ? >> >> If you present what could be potentially be a positive thing in this manner it will not be accepted by people for a multitude of reasons, not least your tunneled view of the world. >> >> >> >>> >>>>>> You cannot speak for all providers / RIPE members. >>>>> >>>>> Thats one of the reasons for a centralized system located at RIPE. >>>>> The system only needs to be implemented once, there will be nearly >>>>> no costs on the members side (except that they have >>>>> to deal with report, but they can still ignore them and except >>>>> the costs that might be added to RIPEs fees, but that should not be that >>>>> much. >>>> >>>> You do not know that. >>>> >>>> You have no way of knowing how much of a load would be placed on RIPE's systems >>> >>> Sure, but RIPE is using millions of EUR yearly to get everything going. >>> You are an ISP yourself, make a guess, how much that costs >>> if you do not have to make provit. >>> >>> I quick guess: >>> - a redundant mailserver environment capable of what ? deliver 50 mio mails a day ? >>> - a would say 100GB traffic/day and 25 highend server >>> - thats about 3000 EUR traffic-costs a month >>> - and about 50 thousand one time invest for the servers >>> >>> - plus the development, I would implement something like this with >>> one month work, ok 5.000 >>> - plus hirering one person to take care about hardware and special cases, that >>> 3.000/month >> >> OK, but centralising anything like this has a lot of negative consequences that other list members have outlined. >> >>> >>> All together, lets say 6.000 per month plus the invest. >>> And now devide this to all members with the usual scale >>> (small pay less than big members), how much would that add >>> to the normal yearly membership costs ? >>> Could somebody could quickly compare that to the last yearly costs at RIPE ? >>> >>> You can save that if you only cut 30 peoples journeys to nice holiday locations >>> for "meetings" that could be done via modern comunication techniques anyway >>> per year. >> >> Face to face meetings work better for a LOT of people. >> >> >> >>> >>>>>>> Well, the monitoring system could send always the same backlink >>>>>>> for the same IP, so that the ISP could still count the amount >>>>>>> of incoming reports for one IP automatically and then >>>>>>> "answers" it as being closed with just clicking ONE link. >>>>>>> >>>>>>> Good idea ? >>>>>> >>>>>> So you expect RIPE members to completely rework their abuse desks to fit into your view of the world? >>>>> >>>>> Not MY VIEW, a standarized view. >>>> >>>> You're not a very good listener, are you? >>> >>> Might be because Im not english-speaking ... (like I noted when I was sending the draft). >>> >>> But, like I outlined above, a rework is not really neccessary. >>> Currently members are receiving lots of different formatted reports >>> to their abuse desk (if they have one) and have to read them all manually. >>> It isnt that bad, if you will get reports, that are more standarized. >>> >>>>> Thats the goal. >>>>> >>>>> Lets see it this way: providers have to change their infrastructure >>>>> regulary for a couple or reasons and always have done. >>>>> Serverhousing changed pretty much during the last years. >>>>> There was the change from ISDN to DSL dialin, there are new >>>>> technologies for HTML, Flash and Mail every day. >>>>> >>>>> And do not forget IPv6, EVERY member has to change that in the new future. >>>>> >>>>>> I can't see that happening, because not all RIPE members are the same or work in the same way. >>>>> >>>>> Well they work on the same basics, what are allocations and other resources. >>>>> Resources cause traffic, and every members uses resources like nameservices, >>>>> webpages and email. And spam problem comes into play with the later. >>>>> >>>>> The difference isnt that big. >>>>> Business models have nothing to do with how to deal with resources the got from RIPE. >>>> >>>> Yes it does >>>> >>>> If you think that you can live in a world where business models have zero impact on reality then you are deluded >>> >>> Example, please give an example .... >> >> I don't need to >> >> It's a simple fact. >> >> The fact that I've raised it (more than once) is enough (we are a RIPE member among other things .. ) >> >> >> >> Mr Michele Neylon >> Blacknight Solutions >> Hosting & Colocation, Brand Protection >> ICANN Accredited Registrar >> http://www.blacknight.com/ >> http://blog.blacknight.com/ >> http://mneylon.tel >> Intl. +353 (0) 59 9183072 >> US: 213-233-1612 >> UK: 0844 484 9361 >> Locall: 1850 929 929 >> Direct Dial: +353 (0)59 9183090 >> Twitter: http://twitter.com/mneylon >> ------------------------------- >> Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty >> Road,Graiguecullen,Carlow,Ireland Company No.: 370845 >> >> > Mr Michele Neylon Blacknight Solutions Hosting & Colocation, Brand Protection ICANN Accredited Registrar http://www.blacknight.com/ http://blog.blacknight.com/ http://mneylon.tel Intl. +353 (0) 59 9183072 US: 213-233-1612 UK: 0844 484 9361 Locall: 1850 929 929 Direct Dial: +353 (0)59 9183090 Twitter: http://twitter.com/mneylon ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,Ireland Company No.: 370845

1 0

Re: [anti-abuse-wg] DRAFT: RIPE proposal - implementation of an
by Frank Gadegast 09 Apr '10

09 Apr '10

Bradley Freeman wrote: Hello, >> Its only against members, that are ignoring that there attitude >> or business model causes real harm to others. > > This proposal still will not help the abuse desks which are uncooperative > which is the real problem. Yes, thats true, if your are willing to ignore reports, it will help nothing. But it will help to make uneducated members more aware and to help others that are not really far in the process of developing a real abuse team. >>> If a RIPE member has an abuse contact and sets up abuse contact >> objects for every allocation, why do you need anything else? >> >> Like I outline already: >> - whois is complicated and unusefull for end users > > And do you believe that this proposal will be used by end users who couldn't > use whois? Yes, it this easy IP-scheme-email address will get public, there will be a lot of more people akt, when they receive spam. Our customers asking as a lot, where to report spam too ... ... and we have no easy answer to that. >> - IRT objects makes it even more complicated > > I simply disagree, IRT objects simplify the whois and provide a clear > contact email. IRT objects will be additional and maybe even non-mandatory again. It will end up having two things to check. The remarks of a netrange object, maybe even the route object and the IRT object. And thats send all different for a lot of RIRs. If like the IRT object being a help, it would have to be mandatory, and there we start again. >> - nobody is meassuring the members so far >> - nobody has detailed data about how much abuse is really happening >> except really well-known blacklists like spamhaus > > My network != your network, I don't see any point in measuring the abuse > from ISPs in this manner. As James said previously larger networks will > generate greater amounts of abuse, and ISPs with different businesses models > will generate varying amounts of abuse, a high level of abuse from a network > is not indicative that you are running a bad network. Additionally there is > nothing that RIPE could do with this data it is simply a meaningless metric. Clear. I clarified this in another mail today, as an example how I think it could work ... > >> It isnt that bad, if you will get reports, that are more standarized. > > There is an IETF working group on Messaging Abuse Reporting Format, I am not > involved in it and not aware of its status, this proposal would not achieve > standardisation. Somebody just posted a link, thnx for that ! Will include that in the next version of the draft, including all valuable feedback I collected so far. Kind regards, Frank -- PHADE Software - PowerWeb http://www.powerweb.de Inh. Dipl.-Inform. Frank Gadegast mailto:frank@powerweb.de Schinkelstrasse 17 fon: +49 33200 52920 14558 Nuthetal OT Rehbruecke, Germany fax: +49 33200 52921 ====================================================================== Public PGP Key available for frank(a)powerweb.de

1 0

Re: [anti-abuse-wg] DRAFT: RIPE proposal - implementation of an
by Michele Neylon :: Blacknight 09 Apr '10

09 Apr '10

On 9 Apr 2010, at 10:02, Frank Gadegast , Dipl-Inform. Frank Gadegast wrote: >> > > Thats up for discussion. > Preferably every incident will generate one mail to be qick as possible. > Surely its also possible to summarizereal outbreaks. OK > >>> >>> You can then look up the report (or even automate it), reset >>> his radius password and kick him out, waiting for him >>> to phone your support :o) >> >> Not everyone has the same business model > > Right, some members seem to make money with abuse ... Again - if you expect there to be ANY dialogue you need to drop that attitude It's offensive and totally unhelpful > >>> Or you could redirect him to a webpage describing that there >>> are too many reports coming in for his IP in a whatever time. >>> Its all up you. >>> >>> My dream system looks like this: >>> - abuse reports will get standarized >> >> that would be helpful > > Indeed. > >>> - monitoring systems will be developed at all RIRs >> >> Monitoring for what exactly??? > > abuse reports I'm having difficulty understanding this. If a RIPE member has an abuse contact and sets up abuse contact objects for every allocation, why do you need anything else? >> >> >> And again you are working under the false assumption that ALL RIPE members offer the same services as you do and in the same way. > > So we are even not clear that abuse is kind of "evil" and should be acceptable > because its the business of the member ? > > We should close this list, if we could not even have the same oppinion here. > > But feel free to explain these "business models" to me ... Again - drop the attitude You have to understand that not every RIPE member offers the same services or has the same resources at their disposal etc., > >>> "Bad providers" could be even published by RIPE :o) >> >> >> Are you insane? RIPE cannot open itself up for that kind of liability > > Why not, blacklists are doing the same, whats the difference ? Ask a lawyer. > >>> Well, thats only work at RIPE NCC, its not that complicated to >>> automated bounces ... >> >> So you say .. > > Yes, its quite easy. No it isn't. Either: - learn how to discuss this with other RIPE members or keep on with your stupid attitude and see how far it gets you > >> You cannot speak for all providers / RIPE members. > > Thats one of the reasons for a centralized system located at RIPE. > The system only needs to be implemented once, there will be nearly > no costs on the members side (except that they have > to deal with report, but they can still ignore them and except > the costs that might be added to RIPEs fees, but that should not be that > much. You do not know that. You have no way of knowing how much of a load would be placed on RIPE's systems > >> You are also suggesting putting a very heavy load on RIPE's systems which someone will have to pay for. Who? > > The member. > Simply add the costs to RIPE general costs and shared the along the members > with the current mechanism, small member pay less, big one more. > >>>> confirmation would be enough, although you'd need some way to deal with >>>> automated reports. >>> >>> Well, the monitoring system could send always the same backlink >>> for the same IP, so that the ISP could still count the amount >>> of incoming reports for one IP automatically and then >>> "answers" it as being closed with just clicking ONE link. >>> >>> Good idea ? >> >> So you expect RIPE members to completely rework their abuse desks to fit into your view of the world? > > Not MY VIEW, a standarized view. You're not a very good listener, are you? > Thats the goal. > > Lets see it this way: providers have to change their infrastructure > regulary for a couple or reasons and always have done. > Serverhousing changed pretty much during the last years. > There was the change from ISDN to DSL dialin, there are new > technologies for HTML, Flash and Mail every day. > > And do not forget IPv6, EVERY member has to change that in the new future. > >> I can't see that happening, because not all RIPE members are the same or work in the same way. > > Well they work on the same basics, what are allocations and other resources. > Resources cause traffic, and every members uses resources like nameservices, > webpages and email. And spam problem comes into play with the later. > > The difference isnt that big. > Business models have nothing to do with how to deal with resources the got from RIPE. Yes it does If you think that you can live in a world where business models have zero impact on reality then you are deluded > > > Kind regards, Frank > >> >> >> Mr Michele Neylon >> Blacknight Solutions >> Hosting & Colocation, Brand Protection >> ICANN Accredited Registrar >> http://www.blacknight.com/ >> http://blog.blacknight.com/ >> http://mneylon.tel >> Intl. +353 (0) 59 9183072 >> US: 213-233-1612 >> UK: 0844 484 9361 >> Locall: 1850 929 929 >> Twitter: http://twitter.com/mneylon >> ------------------------------- >> Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty >> Road,Graiguecullen,Carlow,Ireland Company No.: 370845 >> >> > Mr Michele Neylon Blacknight Solutions Hosting & Colocation, Brand Protection ICANN Accredited Registrar http://www.blacknight.com/ http://blog.blacknight.com/ http://mneylon.tel Intl. +353 (0) 59 9183072 US: 213-233-1612 UK: 0844 484 9361 Locall: 1850 929 929 Direct Dial: +353 (0)59 9183090 Twitter: http://twitter.com/mneylon ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,Ireland Company No.: 370845

3 3

Re: [anti-abuse-wg] DRAFT: RIPE proposal - implementation of an abuse
by Frank Gadegast 09 Apr '10

09 Apr '10

James Davis wrote: Hello, >> It is likely, that you get a problem report just a few minutes >> after on of your users started to send spam, because his PC >> is invected. > > This already happens. Our contact details are published in a clear and > unambiguous fashion, in all the places that you'd expect. Automated spam > reporting schemes appear to have no problems contacting us. This is > because as a network operator we have chosen to deal with these issues, > not because we're told to. Sorry but this is not true for all members. Most newer or smaller ISPs are pretty puzzled, when they have their first real outbreak, and even ask us for advise and help to fix their holes and others do not subscribe lists, that could give them up-to-date warnings or get enough reports, if its only a smaller problem. At least, this is our experience here with our own blacklist. >> You can then look up the report (or even automate it), reset >> his radius password and kick him out, waiting for him >> to phone your support :o) > > Not all ISPs can operate like that. Every one of our customers would > rather we offered them help and advice on how to deal with the problem > rather than taking automated action. That is why we have a CSIRT/abuse > team.p Good for you, impossible for big ISPs that have no real contact to their customers. Cutting the line is a hard method, right, but for some ISPs the only methods to get attention immediatelly. But again: its up for the member what to do with the reports ... And Im not saying, that the system would fit everybody needs, but I defny think that it would be better than the current state. >> Lets say, you receive 100 reports in about 10 minutes for one >> IP, where this IP had no report ever ? >> >> What is likely to happen ? >> What would you do ? > > An incident would likely be opened in our ticketing system before that > ten minutes were up, and someone would be on the phone to our customer > shortly afterwards. We deal with every complaint of spam, even if it's > just a single report, although the response is proportionate to the > particular incident. Great, you are part of a very small club ;o) > Like I said, you'd have to think really carefully about how you'd > measure what a "bad provider" was, or you risk not only wasting your > efforts but making a lot of people angry. Sure, so that why limits have to very high and these kind of limits are up for discussion on this list. But making analysis like this public should not be the first step for the system at all, it might be a future option, if things are settled, everybody got used to the new system aso ... > We get questions like this a lot from our customers - asking us how they > rank abuse wise compared to other customers and honestly there isn't an > easy way to measure this. Ok, got it ... > The proposal, whether I agree with it or not, needs a concrete answer > for how you would measure a 'bad provider'. I dont think so, because the first intention of the system is not how to define a "bad provider", it only talkes about how RIPE staff could talk to those providers. If I would implement limits, I would messure rates according to the size of the member allocations first and monitor these rates to see whats currently normal for a member. And if those rates are much higher than compared to others, I would ask the member to try to do something against that or to explain it, then slowly adjusting the allowed rates up or down again. Finally, after a long period, I would tell all members, that its time to drop the rates, if they are rising over their allowed limit or not really dropping over a long period, THEN, and only then I would call them a "bad provider", because they are obviously not capable or willing to do anything ... But thats a big step for the future. The first step should be a backlink system, to ensure that reports are read and categorized (ok, "really bad provider" will propably program something arround that backlink system to bypass it, I heared even about people that are bypassing captcha codes already with OCR-software). >> Well, thats only work at RIPE NCC, its not that complicated to >> automated bounces ... > > Say the abuse contact is abuse(a)foo.com and the billing contact is > john.doe(a)foo.com, if the domain foo.com expires then no amount of e-mail > is going to resolve the issue. Someone has to get on the phone and find Clear, but a member without any working email contact ? Is that really possible ? How can you work with new allocations or changes to old one without any working email contact ? > out what's happened. This happens fairly frequently here with only > around a thousand customers. Cant believe it. Does the RIPEs system do not check automatically if (e.g.) allocations messages bounce ? >> Defny right, but lets start with something ... > > Starting is good when you know what direction you're heading in. It's > the other half of the question that people here are more interested in :) Interesting point ... Kind regards, Frank > > James > > - -- > James Davis +44 1235 822 229 PGP: 0xD1622876 > JANET CSIRT 0870 850 2340 (+44 1235 822 340) > Lumen House, Library Avenue, Didcot, Oxfordshire, OX11 0SG > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.4.6 (GNU/Linux) > Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ > > iD8DBQFLvvqahZi14NFiKHYRAkpHAJ4s3tiryuoTmY3j8Jivot909exfkgCfYLy3 > Wm34pL98ZdkkHClYthklcEg= > =b+z3 > -----END PGP SIGNATURE----- > > JANET(UK) is a trading name of The JNT Association, a company limited > by guarantee which is registered in England under No. 2881024 > and whose Registered Office is at Lumen House, Library Avenue, > Harwell Science and Innovation Campus, Didcot, Oxfordshire. OX11 0SG > > > -- Mit freundlichen Gruessen, -- PHADE Software - PowerWeb http://www.powerweb.de Inh. Dipl.-Inform. Frank Gadegast mailto:frank@powerweb.de Schinkelstrasse 17 fon: +49 33200 52920 14558 Nuthetal OT Rehbruecke, Germany fax: +49 33200 52921 ====================================================================== Public PGP Key available for frank(a)powerweb.de

1 0

DRAFT: RIPE proposal - implementation of an abuse monitor system
by Frank Gadegast 09 Apr '10

09 Apr '10

Dear all, please discuss and comment to following draft proposal ... (and please forgive but correct my english, bad formatting or terms) Kind regards, Frank -------------------------------------------------------------- DRAFT: implementation of an abuse monitor system (draft RIPE proposal) Abstract This document describes the implementation of an abuse monitor system at RIPE NCC. Its intention is to ensure working abuse contacts on the members side and to improve the awareness, responsiveness and work flow for abuse reports for the reporting (and abused) internet users and the RIPE members (owning the misused services). Contents 1. Introduction 2. Goals of an abuse monitor system 3. Requirements 4. Description 5. Advantages 6. Disadvantages 7. Enhancements 8. Outlook 1. Introduction Taking in account the amount of spam and other abuse currently happening every day, there is a need to ensure that ISPs and other organisations are aware of the problem their customers and end users can cause for others. The current procedure of having non-mandatory abuse contacts in whois output is causing several problems for the incident reporting side as well as for the receiver. RIPEs member should be responsible for the abuse their customers cause, like this is enforced by law in many countries already. 2. Goals of an abuse monitor system Currently most abuse contact addresses are hidden in whois output remark fields in several non-standarized ways or do not even exist, because the real abuse-field is non-mandatory. There should be a standarized method how to contact responsible people to send abuse reports too. It should be possible to to send abuse reports to a standarized email address, because whois queries are limited. The system should bypass whois queries, so that reports can be automated. Currently there is no control, if existing abuse contacts are still valid, working or incoming emails are beeing read. The real abuse email address of any RIPE member should be hidden by the abuse monitor system. Finally a monitoring system should be able to messure the amount of incoming reports for any RIPE member. This will enable RIPE NCC to help members to become more aware of security breakouts or help members that are not aware of the problems they cause. RIPE NCC could e.g. arrange for security training cources and invite members with a very high reporting rate according to the amount of allocated IP addresses. 3. Requirements RIPE NCC should enhance the member section with an extra abuse contact field. This field should be filled at startup with the main email address of any member automatically, but should be editable for the members. 4. Description RIPE NCC should implement a mailserver able to receive emails in the form of IP1.IP2.IP3.IP4(a)abuse.ripe.net (example) Incoming emails to these addresses can be treated as incoming abuse reports and will be forwarded to the members internal abuse contact address (non-public), after the mailserver finds the correct member by looking up internal allocation tables. The amount of incoming emails for every member will be logged and should create internal statistics for RIPE NCCs internal usage. Their should be no anti spam systems implemented on this server to ensure that every incoming email gets forwarded. Anti spam systems should be up to the member. Furthermore, RIPE NCC should monitor, if the members abuse contact address generates errors, bounces or other problems like "User unknown" or "Mailbox full". If the members abuse contact address is not valid anymore, it could be reset to the members hidden main email address, and the member could be informed about the problem in other ways (letter, phone call aso). 5. Advantages The system does neither have to define or decide what spam or abuse is, because it only forwards abuse reports to the responsible person. It is likely that any incoming email is a description of a real abusive problem (except incoming spam). The described system would make it very easy for any ISP or private person to report received spam, hacks or other abuses directly to the responsible RIPE member, without having to know its name and without having to know how to use whois. Reporting systems could be easily automated without having to query whois. The ISP or RIPE member can easily change and control his internal abuse contact address without having to update several objects in RIPEs database. RIPE NCC can ensure that all alocations have a working abuse address. This all can ensure that incidents are really reported by the abused users (and not beeing ignored or forgotten because its to much work to report incidents) and that reports will be read by the right and responsible person. This will finally increase the awareness of any RIPE member about the problems his end users or misused servers may cause and will hopefully force any member to implement methods to monitor there own servers and/or dialin users to improve the detection of misused services. This will hopefully reduce the amount of spams and abuse worldwide. Finally this will maybe influence other RIRs to implement similar systems. 6. Disadvantages It is likely that spammer will misuse the new general abuse adresses massively. Anti spam methos needs to be implemented at the members side. 7. Enhancements The system could be enhanced with addtional services easily on RIPE NCCs side, after implementation and a test period of the system. More detailed statistics could help improving the awareness at the members side. Enhancing forwarded abuse report with an feedback link could help to categorize incoming reports. Members could then visit a ticket system to back report incoming reports as "spam", "incident" or "wrong report" (like popular spam blacklist like SpamCop are doing this already), add comments like "missing information", "incident currently under investigation" or "incident solved". This could help members to track reports and incident easily without having to implement a own system (what could be very interesting for smaller ISPs). Finally this would allow the reporting internet user to receive feedback to ensure that his input is valuable, important and taking care off. 8. Outlook Standarization of a general abuse address will be another step to the standarization of an abuse report format, wich are currently in process. This could lead to open source implemantations of spam detection solutions that include standarized reporting features. Standarized reporting could also be included in other monitoring and detection software, like Intrusion Detection Systems or Antispam Solutions. Author: Frank Gadegast Company: PHADE Software - PowerWeb Contact: frank(a)powerweb.de Version: 0.1 Date: 08.04.2010

7 7

Re: [anti-abuse-wg] mandatory information in the IRT object
by Frank Gadegast 08 Apr '10

08 Apr '10

> > This functionality is already provided by the irt object, maybe it would be more beneficial to change the policy to require that the irt-object contains valid information. But it seems that there is no majority to make abuse fields (whatever abuse fields) mandatory. And there is still no idea how to validate the supplied email addresses. Thats why I thought that my system is better (and easier, because the member has just one email address to setup instead to take care about hundred objects). Kind regards, Frank -- PHADE Software - PowerWeb http://www.powerweb.de Inh. Dipl.-Inform. Frank Gadegast mailto:frank@powerweb.de Schinkelstrasse 17 fon: +49 33200 52920 14558 Nuthetal OT Rehbruecke, Germany fax: +49 33200 52921 ====================================================================== Public PGP Key available for frank(a)powerweb.de > > Bradley >

1 0

update on netsecdb project
by Claus Marxmeier 08 Apr '10

08 Apr '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 When starting with www.netsecdb.de in 2008 i'd never expected the decrease of spams to round about 1% of former amount to remain a stable value. Stats from last weeks, monthes and year now give proof that the setup of a central communitation matrix based on worldwide IPv4-whois databases was a great help in fighting abusive mails and a lot more. Inspite of common hosting environments the number of spams is generally lower that the amount of mails containing wanted messaging. The hourly auto-generated configuration files for MTAs like postfix, exim, qmail and MS Excchange 2007 and later used on external partner servers show same progresses. In addition, files that contain the blocking lists for leading TOP25 spammer-country are distributed for free. Starting from scratch with a localized german based environment, we opened netranges from additional countries based on the incoming spamlevel. Nowadays, networks from DE, CH, AT, BE, NL, FR, GB, LU, LI, IE, IT, CZ, SE, GR, PT, NO, PL, IS, FI, ES, DK, SK, HU, RO, BG, LT, LV, EE, US, CA, IL and defined customer nets don't get blocked but get tickets instead. If a non-customers's netrange abuse-email is invalid/non-functional, range gets blocked. Many providers integrated ticket-systems for abuse-handling and improved their quality management a lot. Only a few remained passive and surprisingly a handful of ISPs still seem to work with quota limited mailboxes to avoid a kind of work-overload. Logfiles show an increasing number of HEADER connects to our smtp-ports just to check the current status of single IP or netrange returned by our servers. Within the last monthes, netsol worked on rwhois integration into ARIN whois outputs which finetuned the process of generating abuse-tickets a lot. Many RIPE members started updating their whois records and abuse-mail contacts. Sometimes this results in an very effective workflow with only a few seconds response time over far distance whereas local providers still cannot be reached cause of invalid or missing contact records. Unfortunately the RIPE team stated by mail, that they have no job-order to take care of the integrity of it's database records i.e. finding ancient content with missing or invalid information gives random results. There seems to be no need for a RIPE member to keep it's records up-2-date ? Any additional information regardings spams, exploit attacks, hacking can be taken from www.netsecdb.de site's sections. I wonder how long hosters are willing to pay the traffic, energy and CPU-time for something nobody needs to have. I wonder how long i takes for the DialUp- and Business Customers to learn, that security is a crucial part of internet activities and that their ISP's deliver very diffent qualities behind their mostly coloured flash-animated websites. Looking forward to see the current unsolved problems beeing transported to public clouds in datacenter and poisoned high bandwith customer connections if everything remains 'same procedure as every year' ... Kind regards, Claus - -- Claus Marxmeier - --- Claus Marxmeier EDV-Service Johann-Kierspel-Straße 5 51491 Overath Germany -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (MingW32) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAku6h3oACgkQUIsBFYVeBxC82gCfReNpv+rLKbb2n9vRxwoizCv+ 0UAAn18QA/Y6irneBZyvcty9NGiKDHgq =MuBy -----END PGP SIGNATURE-----

9 11

DRAFT: RIPE proposal - implementation of an abuse monitor system
by Frank Gadegast 08 Apr '10

08 Apr '10

Dear all, please discuss and comment to following draft proposal ... (and please forgive but correct my english, bad formatting or terms) Kind regards, Frank -------------------------------------------------------------- DRAFT: implementation of an abuse monitor system (draft RIPE proposal) Abstract This document describes the implementation of an abuse monitor system at RIPE NCC. Its intention is to ensure working abuse contacts on the members side and to improve the awareness, responsiveness and work flow for abuse reports for the reporting (and abused) internet users and the RIPE members (owning the misused services). Contents 1. Introduction 2. Goals of an abuse monitor system 3. Requirements 4. Description 5. Advantages 6. Disadvantages 7. Enhancements 8. Outlook 1. Introduction Taking in account the amount of spam and other abuse currently happening every day, there is a need to ensure that ISPs and other organisations are aware of the problem their customers and end users can cause for others. The current procedure of having non-mandatory abuse contacts in whois output is causing several problems for the incident reporting side as well as for the receiver. RIPEs member should be responsible for the abuse their customers cause, like this is enforced by law in many countries already. 2. Goals of an abuse monitor system Currently most abuse contact addresses are hidden in whois output remark fields in several non-standarized ways or do not even exist, because the real abuse-field is non-mandatory. There should be a standarized method how to contact responsible people to send abuse reports too. It should be possible to to send abuse reports to a standarized email address, because whois queries are limited. The system should bypass whois queries, so that reports can be automated. Currently there is no control, if existing abuse contacts are still valid, working or incoming emails are beeing read. The real abuse email address of any RIPE member should be hidden by the abuse monitor system. Finally a monitoring system should be able to messure the amount of incoming reports for any RIPE member. This will enable RIPE NCC to help members to become more aware of security breakouts or help members that are not aware of the problems they cause. RIPE NCC could e.g. arrange for security training cources and invite members with a very high reporting rate according to the amount of allocated IP addresses. 3. Requirements RIPE NCC should enhance the member section with an extra abuse contact field. This field should be filled at startup with the main email address of any member automatically, but should be editable for the members. 4. Description RIPE NCC should implement a mailserver able to receive emails in the form of IP1.IP2.IP3.IP4(a)abuse.ripe.net (example) Incoming emails to these addresses can be treated as incoming abuse reports and will be forwarded to the members internal abuse contact address (non-public), after the mailserver finds the correct member by looking up internal allocation tables. The amount of incoming emails for every member will be logged and should create internal statistics for RIPE NCCs internal usage. Their should be no anti spam systems implemented on this server to ensure that every incoming email gets forwarded. Anti spam systems should be up to the member. Furthermore, RIPE NCC should monitor, if the members abuse contact address generates errors, bounces or other problems like "User unknown" or "Mailbox full". If the members abuse contact address is not valid anymore, it could be reset to the members hidden main email address, and the member could be informed about the problem in other ways (letter, phone call aso). 5. Advantages The system does neither have to define or decide what spam or abuse is, because it only forwards abuse reports to the responsible person. It is likely that any incoming email is a description of a real abusive problem (except incoming spam). The described system would make it very easy for any ISP or private person to report received spam, hacks or other abuses directly to the responsible RIPE member, without having to know its name and without having to know how to use whois. Reporting systems could be easily automated without having to query whois. The ISP or RIPE member can easily change and control his internal abuse contact address without having to update several objects in RIPEs database. RIPE NCC can ensure that all alocations have a working abuse address. This all can ensure that incidents are really reported by the abused users (and not beeing ignored or forgotten because its to much work to report incidents) and that reports will be read by the right and responsible person. This will finally increase the awareness of any RIPE member about the problems his end users or misused servers may cause and will hopefully force any member to implement methods to monitor there own servers and/or dialin users to improve the detection of misused services. This will hopefully reduce the amount of spams and abuse worldwide. Finally this will maybe influence other RIRs to implement similar systems. 6. Disadvantages It is likely that spammer will misuse the new general abuse adresses massively. Anti spam methos needs to be implemented at the members side. 7. Enhancements The system could be enhanced with addtional services easily on RIPE NCCs side, after implementation and a test period of the system. More detailed statistics could help improving the awareness at the members side. Enhancing forwarded abuse report with an feedback link could help to categorize incoming reports. Members could then visit a ticket system to back report incoming reports as "spam", "incident" or "wrong report" (like popular spam blacklist like SpamCop are doing this already), add comments like "missing information", "incident currently under investigation" or "incident solved". This could help members to track reports and incident easily without having to implement a own system (what could be very interesting for smaller ISPs). Finally this would allow the reporting internet user to receive feedback to ensure that his input is valuable, important and taking care off. 8. Outlook Standarization of a general abuse address will be another step to the standarization of an abuse report format, wich are currently in process. This could lead to open source implemantations of spam detection solutions that include standarized reporting features. Standarized reporting could also be included in other monitoring and detection software, like Intrusion Detection Systems or Antispam Solutions. Author: Frank Gadegast Company: PHADE Software - PowerWeb Contact: frank(a)powerweb.de Version: 0.1 Date: 08.04.2010

2 1

RE: [anti-abuse-wg] DRAFT: RIPE proposal - implementation of an abuse monitor system
by Thor Kottelin 08 Apr '10

08 Apr '10

> -----Original Message----- > From: anti-abuse-wg-admin(a)ripe.net [mailto:anti-abuse-wg- > admin(a)ripe.net] On Behalf Of Bradley Freeman > Sent: Thursday, April 08, 2010 4:45 PM > To: 'Frank Gadegast'; anti-abuse-wg(a)ripe.net > And if the only benefit is a common abuse alias, hasn't this has > already > been suggested with an abuse@ address in RFC2142 - Mailbox Names > for Common > Services, Roles and Functions which is not RIPE region specific? It is not always obvious which abuse@ domain should be selected for a particular IP address. I like the suggestion of routing reports according to the IP address of the abuse source. -- Thor Kottelin http://www.anta.net/

1 0

Re: [anti-abuse-wg] DRAFT: RIPE proposal - implementation of an abuse monitor system
by Frank Gadegast 08 Apr '10

08 Apr '10

Bradley Freeman wrote: > Hello, > Maybe I am missing something but I can't see the benefit in having RIPE Please read section 5. Advantages ... I described a lot of good reasons. I personally think that its really important to automate abuse reports. And this can not be done with the current practice of non standarized abuse contacts hidden somewhere in whois queries. > proxy abuse requests, as a member of a CSIRT I feel this would add a layer > of abstraction between the 2 network operators and definitely wouldn't use > it as a first port of call. Additionally RIPE are not in a position to force > the badly behaving ISPs to cooperate, if you have an uncooperative ISP with Well RIPE NCC can at least force their members to have a working contact address. > problem X do you really believe that RIPE suggesting they go on a training > course is going to help? Sure the RIPE NCC may have some other contact Maybe on some, we are running an internal blacklist that clearly states that most spam is coming from NEW members, if you compare it to the amount of IPs the members have. If you see that there is even a lot of spam coming out of the new IPv6 allocation it is clear, that most new members do not even think about abuse they cause. > details but most ISPs within the RIPE region you can get hold of even if the > abuse mailbox does not work by making a few phone calls etc. > > And if the only benefit is a common abuse alias, hasn't this has already > been suggested with an abuse@ address in RFC2142 - Mailbox Names for Common > Services, Roles and Functions which is not RIPE region specific? Yes, but it is only a recommendation, reality looks different. Most abuse addresses are hidden or not working or do not exist. RIPE can easily monitor a working address with this alias proxy. Thats what its for. I really believe it would work better than now, if the NCC can control and monitor the addresses. This will even work better than trying to make the abuse-field mandatory again. What we need now are comments to make the system working better and taking care about problems I wasnt thinking of in the first place ... Kind regards, Frank > > Bradley > >> -----Original Message----- >> From: anti-abuse-wg-admin(a)ripe.net [mailto:anti-abuse-wg- >> admin(a)ripe.net] On Behalf Of Frank Gadegast >> Sent: 08 April 2010 14:30 >> To: anti-abuse-wg(a)ripe.net >> Subject: [anti-abuse-wg] DRAFT: RIPE proposal - implementation of an >> abuse monitor system >> >> >> Dear all, >> >> please discuss and comment to following draft proposal ... >> (and please forgive but correct my english, bad formatting >> or terms) >> >> Kind regards, Frank >> >> -------------------------------------------------------------- >> >> >> DRAFT: implementation of an abuse monitor system >> (draft RIPE proposal) >> >> >> >> Abstract >> This document describes the implementation of an abuse monitor system >> at RIPE NCC. Its intention is to ensure working abuse contacts on the >> members side and to improve the awareness, responsiveness and work flow >> for abuse reports for the reporting (and abused) internet users and the >> RIPE members (owning the misused services). >> >> >> Contents >> 1. Introduction >> 2. Goals of an abuse monitor system >> 3. Requirements >> 4. Description >> 5. Advantages >> 6. Disadvantages >> 7. Enhancements >> 8. Outlook >> >> >> 1. Introduction >> Taking in account the amount of spam and other abuse currently >> happening every day, there is a need to ensure that ISPs and >> other organisations are aware of the problem their customers >> and end users can cause for others. >> >> The current procedure of having non-mandatory abuse contacts in >> whois output is causing several problems for the incident reporting >> side as well as for the receiver. >> >> RIPEs member should be responsible for the abuse their >> customers cause, like this is enforced by law in many countries >> already. >> >> >> 2. Goals of an abuse monitor system >> Currently most abuse contact addresses are hidden in whois output >> remark fields in several non-standarized ways or do not even exist, >> because the real abuse-field is non-mandatory. There should be >> a standarized method how to contact responsible people to send >> abuse reports too. >> >> It should be possible to to send abuse reports to a standarized >> email address, because whois queries are limited. The system should >> bypass whois queries, so that reports can be automated. >> >> Currently there is no control, if existing abuse contacts are still >> valid, working or incoming emails are beeing read. >> >> The real abuse email address of any RIPE member should be hidden >> by the abuse monitor system. >> >> Finally a monitoring system should be able to messure the amount >> of incoming reports for any RIPE member. This will enable >> RIPE NCC to help members to become more aware of security breakouts >> or help members that are not aware of the problems they cause. >> >> RIPE NCC could e.g. arrange for security training cources and >> invite members with a very high reporting rate according to >> the amount of allocated IP addresses. >> >> >> 3. Requirements >> RIPE NCC should enhance the member section with an extra abuse contact >> field. This field should be filled at startup with the main email >> address of any member automatically, but should be editable for the >> members. >> >> >> 4. Description >> RIPE NCC should implement a mailserver able to receive emails in the >> form of >> >> IP1.IP2.IP3.IP4(a)abuse.ripe.net (example) >> >> Incoming emails to these addresses can be treated as incoming abuse >> reports and will be forwarded to the members internal abuse contact >> address (non-public), after the mailserver finds the correct member by >> looking up internal allocation tables. >> >> The amount of incoming emails for every member will be logged and >> should >> create internal statistics for RIPE NCCs internal usage. >> >> Their should be no anti spam systems implemented on this server to >> ensure that every incoming email gets forwarded. Anti spam systems >> should be up to the member. >> >> Furthermore, RIPE NCC should monitor, if the members abuse contact >> address generates errors, bounces or other problems like "User unknown" >> or "Mailbox full". If the members abuse contact address is not valid >> anymore, it could be reset to the members hidden main email address, >> and >> the member could be informed about the problem in other ways (letter, >> phone call aso). >> >> >> 5. Advantages >> The system does neither have to define or decide what spam or abuse is, >> because it only forwards abuse reports to the responsible person. >> It is likely that any incoming email is a description of a real >> abusive problem (except incoming spam). >> >> The described system would make it very easy for any ISP or private >> person to report received spam, hacks or other abuses directly to >> the responsible RIPE member, without having to know its name and >> without >> having to know how to use whois. >> Reporting systems could be easily automated without having to query >> whois. >> >> The ISP or RIPE member can easily change and control his internal abuse >> contact address without having to update several objects in RIPEs >> database. >> >> RIPE NCC can ensure that all alocations have a working abuse address. >> >> This all can ensure that incidents are really reported by the abused >> users (and not beeing ignored or forgotten because its to much work to >> report incidents) and that reports will be read by the right and >> responsible person. >> >> This will finally increase the awareness of any RIPE member about the >> problems his end users or misused servers may cause and will hopefully >> force any member to implement methods to monitor there own servers >> and/or dialin users to improve the detection of misused services. >> >> This will hopefully reduce the amount of spams and abuse worldwide. >> >> Finally this will maybe influence other RIRs to implement similar >> systems. >> >> >> 6. Disadvantages >> It is likely that spammer will misuse the new general abuse adresses >> massively. Anti spam methos needs to be implemented at the members >> side. >> >> >> 7. Enhancements >> The system could be enhanced with addtional services easily on RIPE >> NCCs >> side, after implementation and a test period of the system. More >> detailed statistics could help improving the awareness at the members >> side. >> >> Enhancing forwarded abuse report with an feedback link could help to >> categorize incoming reports. Members could then visit a ticket system >> to >> back report incoming reports as "spam", "incident" or "wrong report" >> (like popular spam blacklist like SpamCop are doing this already), add >> comments like "missing information", "incident currently under >> investigation" or "incident solved". This could help members to track >> reports and incident easily without having to implement a own system >> (what could be very interesting for smaller ISPs). Finally this would >> allow the reporting internet user to receive feedback to ensure that >> his >> input is valuable, important and taking care off. >> >> >> 8. Outlook >> Standarization of a general abuse address will be another step to the >> standarization of an abuse report format, wich are currently in >> process. >> This could lead to open source implemantations of spam detection >> solutions that include standarized reporting features. >> Standarized reporting could also be included in other monitoring >> and detection software, like Intrusion Detection Systems or >> Antispam Solutions. >> >> >> >> Author: Frank Gadegast >> Company: PHADE Software - PowerWeb >> Contact: frank(a)powerweb.de >> Version: 0.1 >> Date: 08.04.2010 >> > > > > -----BEGIN PGP SIGNATURE----- > Version: PGP Desktop 10.0.0 > Charset: us-ascii > > wsBVAwUBS73dxjR8IIjdC+5SAQJEAQf/cG+OZ3r0JYXxLhTxk2dXumEATmrULXl4 > /ZBCJ5szqvhCArMCg5/dUAhA2Fp2j2jm8knh7+I2IIOX62UThDQiQRjwxvX2QDbB > 8moAsEiGlOWw5SCkydXCu2l/a1O7xSZuU5lmggJa85xaCw/eQEOsHQD5lEi7YEHN > VCTiV0+n4xLFniKLE1PfqS9xo7xqlZ4yq4YqJazCQIBd44siDlGh86Ck8oLjA5FK > IgRyHRwNBPh1Tbg4WdGQUyms/gXeO1cldK4F/FPWPUOobKNR8VZwed++sxgf/ECE > yWng6ckMNkknKZJDp4tXUp5f2D4Vjc4GSL9Aur+woNws+n2YV2xIwQ== > =eI5K > -----END PGP SIGNATURE----- > > > -- Mit freundlichen Gruessen, -- PHADE Software - PowerWeb http://www.powerweb.de Inh. Dipl.-Inform. Frank Gadegast mailto:frank@powerweb.de Schinkelstrasse 17 fon: +49 33200 52920 14558 Nuthetal OT Rehbruecke, Germany fax: +49 33200 52921 ====================================================================== Public PGP Key available for frank(a)powerweb.de

1 0

RIPE 60 - Draft Agenda
by Brian Nisbet 08 Apr '10

08 Apr '10

As promised, we have a draft agenda for the meeting in Prague. I wish to emphasise the draft nature of this agenda at present, I have no doubt it will change over the next four weeks. http://www.ripe.net/ripe/meetings/ripe-60/agendas/anti-abuse.html Anti-Abuse Working Group Agenda - RIPE 60 Location: - Bohemia I Date: Thursday, 6 May 2010, 16:00-17:30 Anti-Abuse Working Group Home Page A. Administrative Matters * Welcome * Select a scribe * Jabber Monitor * Microphone Etiquette * Approve Minutes from RIPE 59 * Finalise agenda B Update * B1. Network Abuse Update - Richard Cox * B2. Recent List Discussion - Abuse contacts, Sanctions, etc. C. Technical Measures * C1. RIPE NCC Tools update. D. Interactions * D1. Working Groups * D2. Law Enforcement Interaction - Wout de Natris, LAP * D3. RIPE NCC Gov/LEA Interactions Update E. Documents * E1. BCP Documentation X. A.O.B. Z. Agenda for RIPE 61; Plenary Presentations

1 0

Re: [anti-abuse-wg] update on netsecdb project
by Brian Nisbet 08 Apr '10

08 Apr '10

Frank, I have assumed, hopefully correctly, that you meant this mail to go to the list again, so I have copied my reply there. "Dipl-Inform. Frank Gadegast" wrote the following on 06/04/2010 16:03: > > Hello Brian, > >>> How can not anybody have an idea, how to solve the problem ? >> >> Many people have many ideas, not all of them work. There remains no >> silver bullet. And any recommendation made still needs to be adopted. > > I just discribed one arround launch time. > RIPE should urged all members to stop spam originating from their networks. You did not describe a silver bullet. The RIPE community has urged their members to stop spam and abuse for years, RIPE-409 says it quite plainly, this has been the repeated advice. There are potential ways of enforcing this, but please do not claim that what has been discussed so far today will suddenly stop network abuse. >>> Usally there are to many ideas resulting in at least something to do. >> >> And many things have been discussed, and often solutions suggested. It > > Not on the list. And the minutes of each meeting are posted to the list. So far no discussion has come out of them. >> is up to people to implement those suggestions or to make proposals to >> the RIPE community and perhaps ask the NCC to undertake a task. In >> addition, as we discussed in Lisbon and as we will be discussing again >> in Prague, the two chairs of the WG have been working with the NCC and >> international law enforcement to look at ways of furthering cooperation > > goverments ? > this will make all worse and slower ... The aim is to get governments and LEAs onside, to examine policies and procedures at RIR level and to avoid the making of necessary legislation and to keep the bottom up consensus approach. However there is no way that governments will not be involved, the idea is to take their input and show them we, as a community, are acting. >> and putting procedures in place that can more directly tackle network >> abuse. However this is, as you must appreciate, not a simple or fast task. >> >>>> we hope, in May, to chair another productive meeting. >>> >>> What will be discussed there ? >>> Agenda ? >> >> We're trying to finalise the agenda at the moment, but the work that is >> taking place with the NCC, the RIPE community and the LEAs will be > > Well, please post it to the list, so that it can be discussed before > its finalized. I will post an agenda, but I'm not sure what discussion there is likely to be as my two calls for agenda items have, so far, met with one single response. Equally, the agenda of any WG is reasonably mutable and on occasion has been finalised an hour or so before the meeting, so there will be plenty of time for discussion. >> playing a major part. I hope to have a first draft by the end of this >> week. Obviously if any proposals are brought to the WG before the >> meeting on Thursday 6th, discussion time for them will be allocated on >> the agenda. > > All this should happen all on the list, not everybody can attend meetings. Apologies, I should have been clearer. As has been stated elsewhere and, I believe, on this list, while policy proposals will, undoubtedly, be discussed at meetings, the primary place to discuss policy is the WG mailing list and there is no intention or plan to purely discuss things at meetings. Brian.

10 17

Re: [anti-abuse-wg] update on netsecdb project
by Frank Gadegast 07 Apr '10

07 Apr '10

> > HI, Frank! Hi, > Feel your frustration. But do a quick google search on FUSSP. April fools day if over ... > Anyway, your solution would impose costs on others (i.e. RIPE, other ISPs), Sure, but they can easily be shared with the same method that RIPE uses for the member fees, big ISPs pay more, small ones less. In fact it will be simple some costs at RIPE. And who cares what a spamming provider will have to invest to get his customers cleaned ? Im somehow getting the idea, that those people on this list that are always AGAINST any idea ARE these providers, that are too lazy to control their spambotted customers. Could that be the final reason why we do not find a solution ? I added some more statistics to our own blacklist. Then I will run the ASes of everyboy on this list Im aware off through this statistics next month and gonna post the results to this list, lets see ... Maybe everybody on this list running a blacklist or statistics about spam he receives should do this too. > and would be easily abused to destroy an ISP you don't like. How that ? By sending fake reports to RIPE clearing address ? I recommended that the ISP has to categorize the report himself like you can do on spamcop too, he can simply select "no spam from us" and thats it. And RIPE can control the behaviour of the ISP easily with some simple statistics ... The system should work fuzzy-like, only the really bad ones get punished and the ones with little problems get away. And RIPE can easily reject reports coming from the same IPs all the time ... or the ISP under a fake attack can talk to RIPE about it, that problem isnt really hard to solve. Kind regards, Frank -- PHADE Software - PowerWeb http://www.powerweb.de Inh. Dipl.-Inform. Frank Gadegast mailto:frank@powerweb.de Schinkelstrasse 17 fon: +49 33200 52920 14558 Nuthetal OT Rehbruecke, Germany fax: +49 33200 52921 ====================================================================== Public PGP Key available for frank(a)powerweb.de > > > -- > Esa Laitinen > Tel. +41 76 200 2870 > skype/yahoo: reunaesa > > --000e0cd1145cbf98e60483a02e56 > Content-Type: text/html; charset=ISO-8859-1 > > HI, Frank! Feel your frustration. But do a quick google search on FUSSP. Anyway, your solution would impose costs on others (i.e. RIPE, other ISPs), and would be easily abused to destroy an ISP you don't like. > -- Esa Laitinen Tel. +41 76 200 2870 skype/yahoo: reunaesa > > --000e0cd1145cbf98e60483a02e56-- >

2 1

Re: update on netsecdb project
by Dr. Alexander K. Seewald 06 Apr '10

06 Apr '10

IMHO just having blacklists based on IP addresses is not enough: * rapidly increasing mobile internet (which has dynamic IPs unless one keeps a connection open indefinitely - hardly ever the case) * tendency to reuse one bot for an ever decreasing number of spam messages - so blacklist are and always getting to be less helpful. We did an analysis of a commen DNSBL and found that only 3% of active bots could be found there at the timepoint when they were active. Roughly the same number (6%) can be got when comparing with originating IPs from incoming spam. If spam volume is sinking - and it definitely does at least for me - this has nothing to do with any countermeasures but is probably just a delayed effect from the economic crisis. Let's not delude ourselves here. Actually, our paper on automating botnet tracking was downloaded quite often (we got a mail from Computers & Security / Elsevier that it was among the top 25 downloaded paper in Q4/2009 - whatever that means ;-) so there seems to be a lot of interest in tracking bots with more intelligent techniques. My opinion was and still is that we need to automate detection and tracking techniques and not necessarily rely on old obsolete filtering techniques (although they can be helpful in some cases). But I see the limits of RIPE to make such an approach happen and frankly I don't see any other supranational organization that can pull that off. So here's to hoping the spammers die out from the current crisis and we can switch off all our spamfilters... Best, Alex -- Dr. Alexander K. Seewald Seewald Solutions www.seewald.at Tel. +43(664)1106886 Fax. +43(1)2533033/2764

3 3

Re: [anti-abuse-wg] update on netsecdb project
by Brian Nisbet 06 Apr '10

06 Apr '10

Frank, As discussed, I have copied my reply to the list. >> There has been an amount of discussion on this topic in both AA and DB >> working groups over the last few years but no concensus has been reached. >> >> At the meeting in Lisbon it was agreed between DB and AA that as no >> further comments had been made, the matter was to be closed. This does >> not, obviously, mean that it can't be raised again and both WGs would be >> most interested in any proposals you may have. > > This is simply weird. > How can anybody not agree what Spam is ? Many people agree what spam is, others disagree, the RIPE community is made up of many different people, but I'm not sure why a definition is important to this conversation? The matter was closed in Lisbon because no proposal had been produced since the last time one was asked for onlist. If there is now to be a proposal, then discussion will restart. > How can not anybody have an idea, how to solve the problem ? Many people have many ideas, not all of them work. There remains no silver bullet. And any recommendation made still needs to be adopted. > Usally there are to many ideas resulting in at least something to do. And many things have been discussed, and often solutions suggested. It is up to people to implement those suggestions or to make proposals to the RIPE community and perhaps ask the NCC to undertake a task. In addition, as we discussed in Lisbon and as we will be discussing again in Prague, the two chairs of the WG have been working with the NCC and international law enforcement to look at ways of furthering cooperation and putting procedures in place that can more directly tackle network abuse. However this is, as you must appreciate, not a simple or fast task. >> In this policy Tobias Knecht (tk(a)abusix.org) has stated that if he is >> successful in APNIC he plans to propose something similar in the RIPE >> region. I would suspect he is the best person to talk to about >> collaboration. > > I am already talking to him. Good stuff. > But as you know: he will need support from everybody to bring > this proposal also to RIPE. So it would be really nice if people on this > list dont strike him down because of politeness and instead support > what hes doing. Tobias and abusix have produced a number of different opinions in a very short period of time in operation, or at least in wide circulation. There is no mandate on how the members of any WG should treat the proposals of others, save to give them an honest and fair reading and treat everyone with respect. How the proposal is greeted will depend on how it is presented, but obviously the chairs will do what they can to allow for that fair hearing. >> we hope, in May, to chair another productive meeting. > > What will be discussed there ? > Agenda ? We're trying to finalise the agenda at the moment, but the work that is taking place with the NCC, the RIPE community and the LEAs will be playing a major part. I hope to have a first draft by the end of this week. Obviously if any proposals are brought to the WG before the meeting on Thursday 6th, discussion time for them will be allocated on the agenda. Brian.

1 0