August 2017 - anti-abuse-wg - mailman.ripe.net

upcoming policy proposal for Anti-Abuse WG
by Marco Schmidt 01 Sep '17

01 Sep '17

Hello Brian and Tobias, How are you? You got already your ticket to Dubai? I just want to inform you that likely a policy proposal will find a way to your working group. Gregory from Europol just contacted me, as he want to add a validation requirement to the policy "Abuse Contact Management in the RIPE Database". His proposal looked pretty advanced to me. I gave him some feedback and explained how to start the formal PDP - by contacting you :) I told Greg to put me in cc when he'll send you the proposal. In case he forgets this, can you please add me in your potential reply so I can start the preparation for the publishing? Regards, Marco

3 3

Re: [anti-abuse-wg] *** Re: Abuse Police
by phishing＠storey.xxx 25 Aug '17

25 Aug '17

2 1

Re: [anti-abuse-wg] Abuse Police
by phishing＠storey.xxx 24 Aug '17

24 Aug '17

2 1

Re: [anti-abuse-wg] Abuse Police
by phishing＠storey.xxx 24 Aug '17

24 Aug '17

4 3

Re: [anti-abuse-wg] Abuse Police
by phishing＠storey.xxx 24 Aug '17

24 Aug '17

1 0

Re: [anti-abuse-wg] Abuse Police
by Gareth Llewellyn 22 Aug '17

22 Aug '17

-------- Original Message -------- On 22 Aug 2017, 06:21, ox wrote: The Internet is all about inter operation, co operation and if something is not legal, why not have laws and law enforcement deal with it? All societies have laws, we all have real Police. Why should companies be deciding what is legal and what is not? Our Police and our Laws have become something secondary to these global companies. I'm not accountable to US, Chinese, Russian, Nigerian etc etc laws and neither are my users. We can't be shutting down pinknews.co.uk because some regime regressed a few decades of civil liberties and made their content illegal. Also in places such as the UK our laws haven't exactly been stellar at respecting the right to privacy or against self incrimination in a digital age. "Co-operating" with law enforcement should go as far as local MLATs require and no more.

2 2

Abuse Police
by ox 22 Aug '17

22 Aug '17

Hi All, I would like to propose a serious (and possibly long) conversation about policing abuse. In depth, as it relates to DDOS, AS jacking, pump n dump and everything Internet abuse. Questions posed by Matthew Prince, http://gizmodo.com/cloudflare-ceo-on-terminating-service-to-neo-nazi-site-1… "Prince wants to spark a conversation about how tech should respond to abhorrent content, and whether content should be policed by registrars, browsers, or social networks" This is relevant to all of us, as well as RIPE (all registries) and anyone involved in Internet Abuse as it is far reaching. the NY Times wrote about how social media platforms (including multinationals like Google) are businesses and quoted Kendra Admas: "legal talismans" https://www.nytimes.com/2017/08/21/magazine/how-hate-groups-forced-online-p… My initial comment is that I support what Ronald said (Educate/Education) - To be clear, I am against registrars deciding do de-register domains based on domain content or politics, I am against hosting companies policing content (this is a job for law enforcement) and as the USA seems to be changing. (Corporations are becoming more fascist - Google deciding what may be searched (no user options) Registrars deciding what random domain names may publish on websites, Hosting companies (even here in EU) deciding what example.com may say on a website. We are obviously at or close to a tipping point. It does not help that many important tech companies are mostly all based/operated from the USA and that these tech companies are now exposed as powerful policing authorities - who will enforce (or try to enforce) their opinions/mono culture/pseudo laws on the planet. For example: There was a disagreement with Google recently. - this disagreement was not related to politics, social discourse or anything of even much importance. It was a disagreement on the interpretation of a double blind clinical trial (posted on Eureka Alert) - Google has decided to devalue (and even remove) search results based on whether Google thinks it "agrees" with an opinion or not. I have also had disagreements with Google. It is simply an impossible battle as Google staff themselves are not "free" to express themselves - and if a certain policy team says "xyz" then "xyz" it is and basta! The google staffers that agree with you have no authority (and will never even think of) over the "policy team" - so, these 'policy teams" in various multi nationals are shaping the planet in their image and we are all just along for the ride? It is my argument that this type of behavior is in fact also Internet Abuse. - The Internet is all about inter operation, co operation and if something is not legal, why not have laws and law enforcement deal with it? All societies have laws, we all have real Police. Why should companies be deciding what is legal and what is not? Our Police and our Laws have become something secondary to these global companies. Countries like China has clearly refused this acceptance and I think it is time that many other countries also stand up and simply say "no". Andre

1 0

Call For Agenda Items - AA-WG RIPE 75
by Brian Nisbet 21 Aug '17

21 Aug '17

Colleagues, The next meeting of the Anti-Abuse WG will take place on Wednesday 25th October at 11:00 GST (UTC +4) during RIPE 75. While we have a few things for the agenda already, there is still space, so please let Tobias and I know if there is something you would like to present or propose in Dubai. However due to Dubai Department of Tourism & Commerce (DTCM) regulations any speakers at the meeting, including those in Working Groups, must provide additional information. This comprises of a colour photocopy of your passport and a short (at least 200 characters) personal profile. This information will be passed on to the RIPE NCC who will pass it on to the DTCM. The stated reason is to facilitate greater efficiency for event organisers and government entities that are responsible for granting permits. The data is used to conduct analysis, market research and examine industry trends. The data is not shared with other event organisers or ticket resellers/registration companies. Due to these regulations we will need to submit a finalised agenda by the 4th of September, so if you would like to add anything to the agenda, please make contact with aa-wg-chair(a)ripe.net soon. Tobias and I understand the unusual nature of this request and the effect it may have on AA-WG participation at RIPE75, but we still hope and plan to have an interesting agenda for the meeting. Thanks, Brian -- Brian Nisbet Network Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

1 2

More funny business involvolving the RIPE Route Registry
by Ronald F. Guilmette 15 Aug '17

15 Aug '17

I'd like to call the attention of all of you to a NANOG posting that I made recently: https://mailman.nanog.org/pipermail/nanog/2017-August/091954.html It would appear that the network AS29073, formerly known as Ecatel, and also formerly known as Quasi Networks, and now known as Novogara Ltd. may be having a spot of bother soon. The English translation of a document that I was given a link to today appears to indicate that some or all of the principals behind this specific "bullterpoof hosting" company have been ordered by a Dutch court to answer some pointed questions about their ownnership and/or control over this "Seychelles Islands" company, and perhaps also about their alleged tendency to provide hosting for other people's intellectual property: https://uitspraken.rechtspraak.nl/inziendocument?id=ECLI:NL:RBDHA:2017:9026… That, of course, is not really -my- main concern. I am at the moment rather more concerned about the manner in which they came to be doing routing for a particular legacy Afrinic /14 block, i.e. the 196.16.0.0/14 block. That has not been adequately explained as of now, I think. I wonder if any of you on this list peer with this network, AS29073 and if so, why. It seems to have a rather colorful reputation, to say the least: http://www.cyberlightglobal.com/is-another-attack-on-western-financial-inst… http://news.softpedia.com/news/complex-bitcoin-phishing-scheme-leads-back-t… https://umbrella.cisco.com/blog/2016/06/20/bitcoin-wallet-phishes-reveal-ro… https://techcrunch.com/2012/08/04/grum-inside-the-takedown-of-one-of-the-wo… I can speak another time about how easy it was, apparently, for these clever fellows to slip a route object into the RIPE data base which would seem to sanction their routing of the suspect block in question. Regards, rfg

1 0

Re: [anti-abuse-wg] Not Abuse
by peter h 15 Aug '17

15 Aug '17

On Tuesday 15 August 2017 09.17, ox wrote: > Hi All, > > Some spammers are now sending "verify your email account" spam abuse. I would say that sending a single unsolicited "verify your email account" IS SPAM The keyword here is "unsolicited" This is not the same as a mail sent as a respons to some action done, subscribe or purchase from someone. That "verify your email account" is legitimate. But unsolicited is always spam. > > When an email address is submitted and a vendor confirms that email > address (prior to subscribing it to a bulk mail list, etc) : > > imho, sending a single (one) email to verify/confirm every 24 hour > period - with a maximum of two verify/confirms reminders (one per 24 > hour period) - is not abuse. > > But sending more than one verify/confirm email, in a single 24 hour > period - and sending more than 3 emails in total - in any period - is > abuse. > > I know that I have used the spammer, twitter.com before as an example, > but they are good examples to use. > > Twitter.com seems to never remove their victims email addresses (and > even ignores unsubscribe requests). Twitter.com also seems to go > through bursts of activity and sends many confirmation emails to > spamtraps (accounts that has never existed and only exists in stolen > databases - i.e not real person/people) - whether criminals or third > parties submit these fake email addresses to twitter.com or how > twitter.com obtains these addresses are not relevant to this thread > > What is relevant is: Do you agree that sending "more than 3 verify your > email account" is abuse? > > If you do not agree, what do you think that number should be? > > How many "verify your email address" and reminders to confirm, etc. is > not abuse, in your opinion? > > Like I said, I think one in 24 hours and a total of three, seems > reasonable to me. > > Thanks! > > Andre > > -- Peter Håkanson There's never money to do it right, but always money to do it again ... and again ... and again ... and again. ( Det är billigare att göra rätt. Det är dyrt att laga fel. )

2 1

Not Abuse
by ox 15 Aug '17

15 Aug '17

Hi All, Some spammers are now sending "verify your email account" spam abuse. When an email address is submitted and a vendor confirms that email address (prior to subscribing it to a bulk mail list, etc) : imho, sending a single (one) email to verify/confirm every 24 hour period - with a maximum of two verify/confirms reminders (one per 24 hour period) - is not abuse. But sending more than one verify/confirm email, in a single 24 hour period - and sending more than 3 emails in total - in any period - is abuse. I know that I have used the spammer, twitter.com before as an example, but they are good examples to use. Twitter.com seems to never remove their victims email addresses (and even ignores unsubscribe requests). Twitter.com also seems to go through bursts of activity and sends many confirmation emails to spamtraps (accounts that has never existed and only exists in stolen databases - i.e not real person/people) - whether criminals or third parties submit these fake email addresses to twitter.com or how twitter.com obtains these addresses are not relevant to this thread What is relevant is: Do you agree that sending "more than 3 verify your email account" is abuse? If you do not agree, what do you think that number should be? How many "verify your email address" and reminders to confirm, etc. is not abuse, in your opinion? Like I said, I think one in 24 hours and a total of three, seems reasonable to me. Thanks! Andre

1 0

Re: [anti-abuse-wg] Abuse & ipv6 - Email Servers and e-Registry
by phishing＠storey.xxx 05 Aug '17

05 Aug '17

1 0

Abuse & ipv6 - Email Servers and e-Registry
by ox 05 Aug '17

05 Aug '17

Hi, ipv6 & abuse has many different aspects and this specific thread is about email servers. If you wish to discuss other abuse aspects of ipv6, please do have the decency (and courtesy/netiquette) of starting a new thread. I am working from the proposition that ipv6 email servers will operate on a pro active basis as regards abuse, instead of a reactive basis (as is the case with ipv4) - The eventual proposed protocol will see spam and other types of email abuse almost disappear and become the exception, rather than the rule. Current status: All current production email servers offering ipv6 do so on a white list basis Some reputation lists are already building 'white lists' of ipv6 - many spammers and abusers are already embedded into the startup white lists and there are already many practical challenges in low/small data. White listing, by itself, will not work (or at the very least will be a chargeable service and even then) will be problematic as individual email servers would have little or no control, except by manually allow/deny individual ipv6 numbers/ranges (in a playing field of 2(128)) ipv6 for email servers is going to be much more problematic and challenging than many thought as it would require less privacy (deep content inspection) and as implemented by some large providers, would mean the eventual end of privacy. (as small esp's are forced out and the email players become larger and larger) Large ipv6 email providers will only able to filter abuse properly by filtering content and if not discussed/solved the eu/world will have less/no freedom. I am working on a concept where DNS TXT is used on a devolutionary basis (using encryption) from an ipv6 DNS email server registry to secondary master sub domains - cross referenced with the sub reply on TXT. This would enable email servers to manage and exercise their own inter operability (as they do now) as well as manage their own reputation score(s), w/l and even b/l (by omission/default) and even do so close to real time (as they do now, re-actively) There are a number of challenges: This could be 'hidden' as yadnswl (yet another ipv6 dns whitelist - in fact there are already some ideas of doing exactly that...) But, in reality (and in truth/openness) all the planned ipv6 white I have seen implies 'central control' - and would already be a 'central registry of sorts. (we are going to end up with some version(s) of this anyway - it is a question of whether it will be open or provided using different terminology by someone - and how it would be controlled or used) I am proposing calling a cow a cow, and calling it a "registry" by name. As this would be called a 'registry' of email servers (and not a dns white list) - the age old (well, decades old) arguments of 'control' / 'transparency' and other obvious issues, come into play - as many of the objectors to a registry would need to be satisfied around the open/transparency/control issues that such a registry would seem to provide - So I would need to efficiently communicate the obvious foundation propositions clearly to avoid problems in that regard. *********************************************************************** The problem/challenge with email abuse has always been in the balance between freedom (to send email anywhere) and in taking responsibility for what you send. To be responsible you have to be identifiable (not anonymous) and this has always been the problem. ********************************************************************** It is quite simple, I am proposing the addition and removal from the registry would be free and open (no control from registry) The registry is only a "starting point" or a single point of reference and has no authority or control over and of anything. And as such a proposed registry would accommodate all resources there should be less objections to it. The registry would delegate a unique sub domain to a single ipv6 number and with 2(128) and the registry intended for 'server' or 'service' on the behalf of other ipv6 or clients, there would need to be at least some defining criteria and a balance with freedom/open and being responsible for the resource needs to be found, for such a registry to be credible and fair. The technology exists to do this, the protocol in general principle, is solid. (and could be refined anyway) I am soliciting comments as to the balance of open/free/fair with responsible - what minimum is required in filing registration at a proposed registry such as this? Obviously: ipv6 number (as a minimum) - but what else? Own DNS TXT encrypted key (match rDNS) 1. Name? 2. Email Address? 3. Phone Number? 4. Physical Address? 5. 2nd factor email address? 6. ? Also, welcome to email me off list - as on list this thread may probably generate a lot of static/noise useless/valueless/empty comments... as well as awake many trolls... Andre

1 0

Re: [anti-abuse-wg] AS41609, AS203974, and Alexandru ("Andrei") Stanciu / Suceava, Romania
by Ronald F. Guilmette 05 Aug '17

05 Aug '17

ox <andre(a)ox.co.za> you wrote: >For Abuse purposes... Email Administrators should as a rule not >relay/accept emails from IP numbers with no reverse... I do agree completely. However as is made clear by this exact case, there are enough inbound mail servers still left on this planet that do not follow that rule so as to make it worthwhile for spammers to continue to go to great lengths... even hijacking old & abandoned legacy IPv4 blocks... to get "fresh" IP addresses, even if they can't set up any reverse DNS for those. In a way, this case shows just how desperate spammers have become in their search for "fresh" IP addres space. Regards, rfg

2 1

Reliance on rDNS
by Niall O'Reilly 05 Aug '17

05 Aug '17

By co-incidence, this is operationally relevant for me. On 4 Aug 2017, at 20:46, Ronald F. Guilmette wrote: > ox <andre(a)ox.co.za> you wrote: > > >> For Abuse purposes... Email Administrators should as a rule not >> relay/accept emails from IP numbers with no reverse... > > > I do agree completely. However as is made clear by this exact case, > there are enough inbound mail servers still left on this planet that > do not follow that rule This is not a "rule", but a heuristic of first approximation which, if relied on exclusively and dogmatically, has the consequences of arbitrarily penalizing the innocent, breaking network neutrality, and violating the end-to-end principle. Any of these consequences is itself an abuse. Email administrators and reputation brokers have other information and processes available to them which can be used to mitigate these consequence when appropriate. Failure to do so is either to play the bully or complacently to take the lazy option. I am currently in frustrating correspondence with a reputation broker who rigidly applies this so-called "rule", to whom I have most recently written the following. This is not helpful. The address of this mail server is provisioned dynamically, but has long-term persistence. I have no reason to believe that my connectivity provider can oblige me by implementing the measures you demand. It is not only today or yesterday that more sophisticated and flexible approaches than simple reliance on rDNS data have been available for making assessments of reputation. I have dealt with other reputation services in the past, and have been able to satisfy their requirements for whitelisting after a far shorter exchange of correspondence that the one in which we are now engaged. Your company, by relying, as it apparently does, solely on rDNS data to determine the reputation of the mail server I operate and announcing this reputation to its clients, is choosing act in a way which seems to involve defamation, denial of service, and holding the users of my e-mail system to ransom. This is, quite simply, abuse or, as I put it in an earlier message, bullying. I have re-used this item of correspondence with the intent of illustrating a current operational problem which shows the pernicious effect of the unmitigated application of the so-called "rule" mentioned in earlier posts. It is not my intent, and I hope I have not strayed too far in that direction, to mis-use this list as a channel for reporting abuse. Best regards, Niall O'Reilly

3 2

Re: [anti-abuse-wg] AS41609, AS203974, and Alexandru ("Andrei") Stanciu / Suceava, Romania
by Suresh Ramasubramanian 04 Aug '17

04 Aug '17

I do get that a problem with incompetence and/or malice depending on which way hanlons razor cuts in allowing these ranges to be hijacked is being shoved onto receiving isps for them to mitigate it, yes. --srs > On 04-Aug-2017, at 1:35 PM, ox <andre(a)ox.co.za> wrote: > > On Fri, 4 Aug 2017 13:31:29 +0530 > Suresh Ramasubramanian <ops.lists(a)gmail.com> wrote: >> Lovely of you to mansplain rdns based spam filtering to Ron - he’s >> been doing it since at least 1998 that I know of, most probably >> earlier >> > > I think you are confused or deliberately trying to distribute FUD > > Did you note that I quoted what Ron already said on nanog - for this list? > > This means that; > > imnsho many people on THIS LIST are relaying email when there is no > reverse. > > get it? > > Andre >

2 1

New on RIPE Labs: SHA2017: Hackers' Camping, RIPE Topics
by Vesna Manojlovic 04 Aug '17

04 Aug '17

Dear colleagues, Today begins the newest edition of four-yearly Dutch summer camping conferences for and by hackers: SHA2017. http://sha2017.org/ Since there is an overlap between topics and participants within the RIPE community, this is an invitation to the talks and workshops - a small selection was recommended, from more then 200 lectures. There is a special sub-selection relevant to Anti-Abuse WG. Read more about it in this RIPE Labs article: https://labs.ripe.net/Members/becha/sha2017-hackers-camping-ripe-topics ... or if you are there too, get in touch :) Regards, Vesna Manojlovic Community Builder RIPE NCC

1 0

Re: [anti-abuse-wg] Straw-man abuse reporting system (was: New on RIPE Labs: Botnets: As We See Them in 2017)
by phishing＠storey.xxx 04 Aug '17

04 Aug '17

1 0

Re: [anti-abuse-wg] AS41609, AS203974, and Alexandru ("Andrei") Stanciu / Suceava, Romania
by Suresh Ramasubramanian 04 Aug '17

04 Aug '17

Lovely of you to mansplain rdns based spam filtering to Ron - he’s been doing it since at least 1998 that I know of, most probably earlier --srs > On 04-Aug-2017, at 12:04 PM, ox <andre(a)ox.co.za> wrote: > > For Abuse purposes... Email Administrators should as a rule not > relay/accept emails from IP numbers with no reverse...

2 1

Re: [anti-abuse-wg] New on RIPE Labs: Botnets: As We See Them in 2017
by phishing＠storey.xxx 04 Aug '17

04 Aug '17

2 1

AS41609, AS203974, and Alexandru ("Andrei") Stanciu / Suceava, Romania
by Ronald F. Guilmette 04 Aug '17

04 Aug '17

Do any of you folks know this guy, or know anything about him? Alexandru ("Andrei") Stanciu of Suceava, Romania I am particularly interested in talking to anybody who is peering with either of his two ASNs: AS41609 -- Architecture Iq Data S.R.L. (LIR) AS203974 -- Advertising Distribution Supplies S.R.L. It seems that he has perhaps been involved with some IP block hijacking hanky panky, which originated on this side of the pond, but where the two hijacked legacy Afrinic /16s were apparently routed to him. More information at the following link: https://mailman.nanog.org/pipermail/nanog/2017-August/091821.html I do hope that either I, or someone, will be able to let all of his peers know about this guy's role in this affair. Personally, I don't think this kind of fraduldent activitity should be condoned. I hope and trust that at least some on this list will agree with that general sentiment, and might thus be persuaded to reach out to relevant networks and peers, to let them know about this. Regards, rfg P.S. Apparently, this fellow is a member in good standing of the "Email Marketing Gurus" special interest group on LinkedIn. Why am I not surprised? https://ro.linkedin.com/in/alexandru-stanciu-8846aa12a

2 1

ASN effect on abuse
by alireza vaziri 03 Aug '17

03 Aug '17

Dear colleagues, I have seen that some operators in EU have different ASN for their services, one for transit, another for their subscribers and one for their datacenter services. As long as some of the spam protection services treat ASNs differently, is there any relation between having different ASN and protecting their infrastructure's ASN to show up in lists like this: https://www.spamhaus.org/statistics/botnet-asn/ As a network/security administrator, do you drop/inspect/throttle connection based on ASN? Regards, Alireza Vaziri

1 0

New on RIPE Labs: Botnets: As We See Them in 2017
by Vesna Manojlovic 02 Aug '17

02 Aug '17

Dear colleagues, As a part of his research into detecting malicious network activities, Alireza Vaziri is sharing his network/system engineer experiences on defend network's infrastructure from outages. Please read about it in this new article on RIPE Labs: https://labs.ripe.net/Members/alireza_vaziri/botnet Regards, Vesna Manojlovic Community Builder RIPE NCC

1 0

Bringing Law Enforcement Into the RIPE Community
by Brian Nisbet 02 Aug '17

02 Aug '17

Colleagues, Given the relationship between the AA-WG and LEAs I think it's useful to share this article by Richard Leaning on RIPE Labs: https://labs.ripe.net/Members/richard_leaning/bringing-law-enforcement-into… Brian -- Brian Nisbet Network Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

9 20