May 2020 - anti-abuse-wg - mailman.ripe.net

Post Election Unwanted Email Collection Project
by IP Abuse Research 26 May '20

26 May '20

To Whom It May Concern, Around the time of the election RIPE members posted about receiving unwanted email from candidates. I would like to more formally quantify this event. To start I have two questions: 1) Has anyone followed up with RIPE membership to assess how large of a mailing run was sent? Did all registered RIPE members sent email or only a portion? 2) Has anyone collected samples of the unwanted mail with or without headers to establish a corpus which can be analyzed? If this feedback and corpus has not yet been compiled / established I am happy to help do so. Please send any details and examples you're willing to share. Thank you for your time and willingness to help quantify this event.

1 0

bgprep.info
by mohsen atiq 26 May '20

26 May '20

Dear Sir, Recently I developed a robot that collects reported IP lists from more than 160 resources and then tries to categorize and normalize these lists. Some of these resources are highly reputed, and some of them are personal-lists. I summarize the result in the https://bgprep.info/report web app. this tiny app provides basic search and reporting functionality and a free, unlimited rest API for researching purpose. Besides this, I maintain my database of IP-Location and BGP AS-location. Currently, the information is updated regularly every week, but I will try to decrease the update interval. I am very eager to hear your feedback about this app. Please consider this information, and related data is entirely free and remains free in the future. Best regards. Mohsen

1 0

Spam from provider Timeweb/Russia AS9123 - and they just ignore me
by Martin Wilhelmi 25 May '20

25 May '20

Hey everyone, I have a conflict with a provider from Russia "Timeweb" AS9123. It seems to be hosting a customer who sends spam and uses one of my domains as sender. I got the information via DMARC, RFC 7489 with several mails. This provider has an abuse email address. After I contacted them, they analyzed my domain, complained about the header of the automatic DMARC e-mail from mail.ru, because there an internal host distributes it and uses an internal IP address 10/8 according to RFC 1918 and so on. Apparently one does not want to do anything and requests one of these e-mails classified as spam sent to @mail.ru. But this is not provided for in the DMARC protocol, which the provider does not 'believe’. This means I continue to receive emails from Russia telling me that my domain is being used by their host to send spam. And the provider writes me many e-mails telling me that I have to provide correct facts and that nothing else will be done. Because DMARC emails are not facts and cannot be used as evidence. Do you have any idea how to deal with this? I have received 11 DMARC emails from mail.ru regarding this host. I have attached last one here with header: Return-Path: <dmarc_support(a)corp.mail.ru> Delivered-To: mnin(a)mnin.de Received: from mail.mnin.de ([xxxx]) by mail.mnin.de with LMTP id yedWJNMKx14sDAAAuS6XVA (envelope-from <dmarc_support(a)corp.mail.ru>) for <mnin(a)mnin.de>; Fri, 22 May 2020 01:12:19 +0200 Received: from relay7.m.smailru.net (relay7.m.smailru.net [94.100.178.51]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.mnin.de (Postcow) with ESMTPS id 6D59868509C for <mnin(a)mnin.de>; Fri, 22 May 2020 01:12:18 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=corp.mail.ru; s=mail; h=Date:Message-ID:To:From:Subject:MIME-Version:Content-Type; bh=DMqnfyeB+D0YjhIdtRipG66iEqaOVRHns+l07FJTLbw=; b=k6PdTMpn2SHfn7HO4jdOto6jxVRnOLsCsFLz0Lp87ytUyQL7ifwnze/LC/xQlDQ1hLpkHdM/sM8RFDgusUQYtL4e7/Zkmln4vsjgPvsW6go/YK7hvaeQBKMKgDSXqTlTXqm7BUyXOU4g9wByuAWUM0UpOM+3lrgHzm7d/Fil5IU=; Received: from [10.161.4.115] (port=48176 helo=60) by relay7.m.smailru.net with esmtp (envelope-from <dmarc_support(a)corp.mail.ru>) id 1jbuMI-0007Kr-2n for mnin(a)mnin.de; Fri, 22 May 2020 02:12:14 +0300 Content-Type: multipart/mixed; boundary="===============1678280035031557895==" MIME-Version: 1.0 Subject: Report Domain: mnin.de; Submitter: Mail.Ru; Report-ID: 25590927945792699841590019200 From: dmarc_support(a)corp.mail.ru To: mnin(a)mnin.de Message-ID: <dmarc-1590102734(a)corp.mail.ru> Date: Fri, 22 May 2020 02:12:14 +0300 Auto-Submitted: auto-generated ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=mnin.de; s=dkim; t=1590102738; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: dkim-signature; bh=DMqnfyeB+D0YjhIdtRipG66iEqaOVRHns+l07FJTLbw=; b=YpE4Z5u3l+mzLxsH+2Qbd39KekLCXa2jbbIrdnDxvgNFS6zvl4zKq33jQ/7fs5KkJEB0Xc VCRT+1keQ9x/+a0tp6IMMUKE1elcOp6LHbBzTXCZYcgylnhbmb/JrCgAUI67KzXJlLn4o4 pxToLIR5HD58dGeler0v2GTby5si8GUfczS2mM4QAvxJHDSZ8GqTE359H8HTmXUXGBQRb+ 0RVhhOzYxwmusEpWvuMcXYm4oZ7V+eKNuv12N5xCAbaWaqen37v1M53j0pu1vYoUSQBgOa dv3UgtOSdPxj8wVI5OzpY6ZVKtfSqyTXW5dV+8yfZUSe1Zpm/UPOO5eaqyUnpw== ARC-Seal: i=1; s=dkim; d=mnin.de; t=1590102738; a=rsa-sha256; cv=none; b=keiIRdDt35e1bk6toEJdITgagC1CXQE81NoMoM8T19TBM9LFU4zudqRg73qPYgGkqvXqqI Te3Z+AC+CZp9bxfqIOrm2xSE8fNfZEKYhl5fB59sen9/m1rwiZznvvbNcBCJMpytYyDAbg l74M2uJVfvrUAoAbMF8dweJV/SANBC2K6eKs1r9nRu5DrCEcicWKNLxWbvZ7Q/TccUGgeZ VCyYvxqc0m5U7wZqK/32Sgf1EpWAjkXpC5eTMxH73FfrIkpPQa8v5ag6qKMP+GRk8B3GO1 eQxsci0l3eATOMFFeEAW/QkSB+ur5f2bPEraluEN5VD4iwWzd2tBGmbcT0ZKaw== ARC-Authentication-Results: i=1; mail.mnin.de; dkim=pass header.d=corp.mail.ru header.s=mail header.b=k6PdTMpn; spf=pass (mail.mnin.de: domain of dmarc_support(a)corp.mail.ru designates 94.100.178.51 as permitted sender) smtp.mailfrom=dmarc_support(a)corp.mail.ru X-Last-TLS-Session-Version: TLSv1.2 Authentication-Results: mail.mnin.de; dkim=pass header.d=corp.mail.ru header.s=mail header.b=k6PdTMpn; dmarc=pass (policy=reject) header.from=corp.mail.ru; spf=pass (mail.mnin.de: domain of dmarc_support(a)corp.mail.ru designates 94.100.178.51 as permitted sender) smtp.mailfrom=dmarc_support(a)corp.mail.ru --===============1678280035031557895== MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 VGhpcyBpcyBhbiBhZ2dyZWdhdGUgcmVwb3J0IGZyb20gTWFpbC5SdS4= --===============1678280035031557895== Content-Type: application/gzip MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="mail.ru!mnin.de!1590019200!1590105600.xml.gz" H4sICM4Kx14C/21haWwucnUhbW5pbi5kZSExNTkwMDE5MjAwITE1OTAxMDU2MDAueG1sAIVTQXKk MAy85xW5zSkYqDADW4qzH9jLfsDlscXgCtgu22Szv48MYUJqKpULlpqW6JYFPL9N4/0rhmicfTpU RXm4R6ucNvbydJhT/9Aenvkd9Ij6LNULh4DehSQmTFLLJDm4cBFWTsj/SDMWf2dgVwRwIozrSQYl 4uxz5W/lgi8yXgTirgzAtxSkUM4mqZIwtnd8SMn/YmzA8Upn+XzICBXeVmzajOZ103RlV5+6x+bU 1ceuax8rQsqqq8sS2CcRyASKIO2F5J7xYizfE1cE0OoFrsrmmOGcA9uXspu5eDca9V/4+TyaOGD+ lCP9lk/W2EIj1a85SP1iJh6ArQHI6PslzSd4bp0ltucQt5gC8CrxKovJAT1vPheQRp1P949K3RwU CuN51bZFXTfF6VRUx5Z6Xd+AcrOlpsDWYLOAr3KcyWu2YKJ30STalg8pewQW/T1dEuGLlexgzRcv 7LYjW+QZjTaZ3tAichhQagyiD276HNYeBPaFL+c0iIBxHlP80LDNmqrTkBcGw7Ju28gjjqiSC1wT g8RtKaxtuJcx5jtdkr2ZHxsr55FPWSa1XZJveq4D+aqdbXfGrj/cO84BW+uiAwAA --===============1678280035031557895==-- Decompressed xml is: <?xml version='1.0' encoding='utf-8'?> <feedback><report_metadata><org_name>Mail.Ru</org_name><email>dmarc_support(a)corp.mail.ru</email><extra_contact_info>http://help.mail.ru/mail-help</extra_contact_info><report_id>25590927945792699841590019200</report_id><date_range><begin>1590019200</begin><end>1590105600</end></date_range></report_metadata><policy_published><domain>mnin.de</domain><adkim>r</adkim><aspf>r</aspf><p>none</p><sp>none</sp><pct>100</pct></policy_published><record><row><source_ip>188.225.77.168</source_ip><count>1</count><policy_evaluated><disposition>none</disposition><dkim>fail</dkim><spf>fail</spf></policy_evaluated></row><identifiers><header_from>mnin.de</header_from></identifiers><auth_results><dkim><domain>ninthhelper.ru</domain><selector>dnin</selector><result>pass</result></dkim><spf><domain>ninthhelper.ru</domain><scope>mfrom</scope><result>pass</result></spf></auth_results></record></feedback> Cheers, Martin

4 4

Re: [anti-abuse-wg] Spamming LIR accounts
by JORDI PALET MARTINEZ 14 May '20

14 May '20

I don't think EU laws are useless towards non-EU countries that break them. In the case of privacy, they will not be able to keep doing business with the EU. In a more understanding way, EU (or EU members) reach agreements with specific countries so the sanctions can be applied as well, including fines. For example, when speaking about GDPR, countries like Mauritius and Uruguay, have signed those agreements. I believe the reason is to allow mutual business, it makes a lot of sense: if you are offering applications that collect our citizen data, you must follow our rules, or we will find someone that want to follows them. We do this every other day, in any economic activity. I know that if you violate speed limit in one country the fine will be collected from your account in many other countries, it is just reciprocity. Regards, Jordi @jordipalet El 10/5/20 20:54, "anti-abuse-wg en nombre de Sabri Berisha" <anti-abuse-wg-bounces(a)ripe.net en nombre de sabri(a)cluecentral.net> escribió: ----- On May 7, 2020, at 2:26 AM, Nick Hilliard nick(a)foobar.org wrote: Hi, (And to you Töma, Peace :)) > Töma Gavrichenkov wrote on 07/05/2020 10:03: >> What does GDPR have to say about this? > > You mean the Privacy and Electronic Communications Regulations / PECR. > Spamming is prohibited under article 13. > > National transcriptions of this legislation have implemented this as a > civil offence in some EU countries and a criminal offence in others. Yes, and as long as the sender is safe in a non-EU country, none of the EU "laws" will apply to them nor will they care. It's the same thing as saying bad things about Thailand's king while shouting from a pedestal on St. Petersburg Square. I don't know about you guys, but I have a very effective system for dealing with this kind of crap. It's called *plonk*. Thanks, Sabri ********************************************** IPv4 is over Are you ready for the new Internet ? http://www.theipv6company.com The IPv6 Company This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it.

7 11

2019-04 Discussion Phase (Validation of "abuse-mailbox")
by Petrit Hasani 14 May '20

14 May '20

Dear colleagues, A new version of RIPE policy proposal, 2019-04, "Validation of "abuse-mailbox"", is now available for discussion. This proposal aims to have the RIPE NCC validate "abuse-c:" information more often and introduces a new validation process. Most of the text has been rewritten following the last round of discussion and the proposal is now at version 3.0. Some key points in this version: - The abuse-mailbox should not force the sender to use a form - The validation process must ensure that the abuse mailbox is able to receive messages - The validation should happen at least every six months You can find the full proposal at: https://www.ripe.net/participate/policies/proposals/2019-04 As per the RIPE Policy Development Process (PDP), the purpose of this four-week Discussion Phase is to discuss the proposal and provide feedback to the proposer. At the end of the Discussion Phase, the proposer, with the agreement of the Anti-Abuse Working Group Chairs, will decide how to proceed with the proposal. We encourage you to review this proposal and send your comments to <anti-abuse-wg(a)ripe.net> before 27 May 2020. Kind regards, -- Petrit Hasani Policy Officer RIPE NCC

17 56

Re: [anti-abuse-wg] Spamming LIR accounts
by JORDI PALET MARTINEZ 12 May '20

12 May '20

Two quick points here: The money collected by Data Protection Agency fines aren’t for the ones claiming, but for the respective governments. If the abuse country don’t have an agreement with the EU to collect that fine, the EU can seize it later on, at any time, when there is a payment from the EU to that company or person, depending on the case. Meanwhile, this company, which has been fined, will not be able to continue business with EU companies. So even if procmail saves time, I feel more responsible, as citizen, to make sure that the law that protects me, is called upon when/if it comes the time for it. Further to that, at least in Spain, I guess is the same in other countries, if you receive spam or any other abuse towards your network, you have law recognized compensation for the damages. Of course this is not millions of euros, even not a few thousands, however a collective claim against a spammer, which my turn the cost for the spammer in something really bad for his/her pocket. Last, but not least, a quick google search shows that there is an agreement for GDPR related issues among the EU and Israel, and Israel has adapted to their equivalent law, which is understandable, because there is a lot of business among those region. Regards, Jordi @jordipalet El 12/5/20 21:49, "anti-abuse-wg en nombre de Sabri Berisha" <anti-abuse-wg-bounces(a)ripe.net en nombre de sabri(a)cluecentral.net> escribió: ----- On May 12, 2020, at 12:32 PM, Töma Gavrichenkov <ximaera(a)gmail.com> wrote: On Tue, May 12, 2020, 10:13 PM Sabri First of all, there is the requirement for the non-EU company to intentionally provide goods or services to the EU. That can be found in article 3(2)a. Well, virtually that's exactly our case: an employee of an Israeli company promotes their services (in multiple local EU languages such as Czech language) through an intentional mailing. Yes, you are absolutely correct in that. Second, and most important, for a law to protect it must be enforceable. For a law to be enforceable, a court must be able to issue a judgement, and that judgement must be executable. Still fine: AFAIK Israeli companies with a remote offering directed to the EU citizens are subject to extraterritorial reaches. At least, I've seen some of those working in GDPR compliance. What do I miss here? This is the part where I disagree. According to EU law, they are subject to what's called "universal jurisdiction", but unless there are treaties in place, or the local Israeli courts are willing to recognize foreign judgements, that EU law is nothing but a useless piece of paper. The EU cannot enforce their laws in a different country without the local courts granting jurisdiction. And that, in turn, means that EU laws cannot be applied to those outside of its reach. It would be different if said entity (whether that's a person or business) had any assets in the EU. In that case they could be seized upon a monetary judgement. Which is the case with Google, Facebook etc. In more simpler terms: EU courts can award you 100 million euros, but without a way to collect it you're still poor. Hence my recommendation to just plonk the guy into oblivion instead of pursuing a theoretical and practically impossible avenue (GDPR enforcement). Just procmail the guy's emails, and vote for the other candidates. Saves you a lot of headaches :) Thanks, Sabri ********************************************** IPv4 is over Are you ready for the new Internet ? http://www.theipv6company.com The IPv6 Company This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it.

1 0

About "consensus" and "voting"...
by Carlos Friaças 12 May '20

12 May '20

Hi Suresh, Gert, All, "member organizations represented by" -- this only happens at the RIPE NCC GM, twice a year. The PDP doesn't happen at the RIPE NCC GM, afaik, whether we like it or not. When polarisation is obvious, "consensus" is impossible and everything tend to remain as is... Cheers, Carlos On Sat, 9 May 2020, Suresh Ramasubramanian wrote: > > In a case where the community is polarised to this extent it would be better to break with procedure and call a vote for once. With member organizations represented by their abuse team heads, rather than IP / routing people, so that > the organisation?s stance on this is clear. > > > > From: Gert Doering <gert(a)space.net> > Date: Saturday, 9 May 2020 at 3:57 PM > To: Suresh Ramasubramanian <ops.lists(a)gmail.com> > Cc: Randy Bush <randy(a)psg.com>, Nick Hilliard <nick(a)foobar.org>, anti-abuse-wg(a)ripe.net <anti-abuse-wg(a)ripe.net> > Subject: Re: [anti-abuse-wg] 2019-04 Discussion Phase (Validation of "abuse-mailbox") > > Hi, > > On Sat, May 09, 2020 at 01:12:32AM +0000, Suresh Ramasubramanian wrote: > > Has this even been put to a vote or is it the same group of extremely vocal RIPE regulars against it and the same group of extremely vocal security types for it? Rough consensus has its limitations in such cases. > > There is no voting. > > It's either "there is sufficient support and counterarguments have been > adequately addressed" or "no consensus, rewrite or withdraw". > > Gert Doering > -- NetMaster > -- > have you enabled IPv6 on something today...? > > SpaceNet AG Vorstand: Sebastian v. Bomhard, Michael Emmer > Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann > D-80807 Muenchen HRB: 136055 (AG Muenchen) > Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279 > > >

4 6

Re: [anti-abuse-wg] About "consensus" and "voting"...
by Sérgio Rocha 12 May '20

12 May '20

Hi everyoneOtherwise we change the way the working Groups works it will remain unchanged for ever. I agree that we must get a way to vote or another democratic way to get decisions.If we don't change something in the process it better close this mailing lists that only exist to give the fake image that the community it's workingSREnviado a partir do meu smartphone Samsung Galaxy.<div> </div><div> </div><div>-------- Mensagem original --------</div><div>De : Carlos Friaças via anti-abuse-wg <anti-abuse-wg(a)ripe.net> </div><div>Data: 09/05/20 13:41 (GMT+00:00) </div><div>Para: Suresh Ramasubramanian <ops.lists(a)gmail.com> </div><div>Cc: Gert Doering <gert(a)space.net>, anti-abuse-wg(a)ripe.net </div><div>Assunto: [anti-abuse-wg] About "consensus" and "voting"... </div><div> </div> Hi Suresh, Gert, All, "member organizations represented by" -- this only happens at the RIPE NCC GM, twice a year. The PDP doesn't happen at the RIPE NCC GM, afaik, whether we like it or not. When polarisation is obvious, "consensus" is impossible and everything tend to remain as is... Cheers, Carlos On Sat, 9 May 2020, Suresh Ramasubramanian wrote: > > In a case where the community is polarised to this extent it would be better to break with procedure and call a vote for once.? With member organizations represented by their abuse team heads, rather than IP / routing people, so that > the organisation?s stance on this is clear. > > ? > > From: Gert Doering <gert(a)space.net> > Date: Saturday, 9 May 2020 at 3:57 PM > To: Suresh Ramasubramanian <ops.lists(a)gmail.com> > Cc: Randy Bush <randy(a)psg.com>, Nick Hilliard <nick(a)foobar.org>, anti-abuse-wg(a)ripe.net <anti-abuse-wg(a)ripe.net> > Subject: Re: [anti-abuse-wg] 2019-04 Discussion Phase (Validation of "abuse-mailbox") > > Hi, > > On Sat, May 09, 2020 at 01:12:32AM +0000, Suresh Ramasubramanian wrote: > > Has this even been put to a vote or is it the same group of extremely vocal RIPE regulars against it and the same group of extremely vocal security types for it??? Rough consensus has its limitations in such cases. > > There is no voting. > > It's either "there is sufficient support and counterarguments have been > adequately addressed" or "no consensus, rewrite or withdraw". > > Gert Doering > ??????? -- NetMaster > -- > have you enabled IPv6 on something today...? > > SpaceNet AG????????????????????? Vorstand: Sebastian v. Bomhard, Michael Emmer > Joseph-Dollinger-Bogen 14??????? Aufsichtsratsvors.: A. Grundner-Culemann > D-80807 Muenchen???????????????? HRB: 136055 (AG Muenchen) > Tel: +49 (0)89/32356-444???????? USt-IdNr.: DE813185279 > > >

8 10

Re: [anti-abuse-wg] 2019-04 Discussion Phase (Validation of "abuse-mailbox")
by Elad Cohen 12 May '20

12 May '20

What is this ? "However, the community should report any situation to the RIPE NCC, which can provide (anonymous) periodical statistics to the community, which can take further decisions about that." Ripe members are informers? "divide and conquer" strategy ? Abuse email addresses (just like any other email address) are being spammed, not only by non-relevant spammers but also by automatic useless services that are installed at servers that don't take themselves any measure of proper configuration to avoid the automatic useless services. To my opinion, Ripe should create its own anti-abuse system, each LIR will have login access to it (LIR will be able to choose to receive notifications through sms / email) and to mark each abuse complaint as resolved or not (that system can also have an API so LIR's will be able to pull their abuse complaints), the main issue is that complaints to that system will not be able to be done automatically or by email - only manually by form filling with captcha. (after the LIR will mark an abuse complain as resolved - the complainer will receive an email address also to confirm with him if issue is resolved or not, non-detailed statistics will be able to be displayed to the whole community - to see the percentage of how many manual complaints weren't handled by each LIR) --- Besides the above, I also believe that we as a community should not accept complainers which are not taking the most basic configuration actions to protect their systems, and would consider these complaints as spam. In order for abuse complaints not to be abused. Respectfully, Elad ________________________________ From: anti-abuse-wg on behalf of Serge Droz via anti-abuse-wg Sent: Wednesday, April 29, 2020 11:22 AM To: anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] 2019-04 Discussion Phase (Validation of "abuse-mailbox") Hi All I think this is a good policy. We can always find use cases where it fails, but it will help in some cases. And if some one is not able to answer an e-mail every six month, there are probably underlying issues. Also the argument, that the bad guys flood the mailbox is not really acceptable. It just means you can't filter spam. The proposal does not check how the reports are used. But it helps us to enumerate organizations, that don't act, coming up with various excuses, along the lines the best problems are some one else's problems, so let's make it some on else's problem. The fact is: Most mature organizations are perfectly capable of handling such mail boxes, even if they have a high load. Coming from the incident response side, I'm tiered of people constantly telling me, that issues are not their problem Best Serge On 28.04.20 16:01, Petrit Hasani wrote: > Dear colleagues, > > A new version of RIPE policy proposal, 2019-04, "Validation of > "abuse-mailbox"", is now available for discussion. > > This proposal aims to have the RIPE NCC validate "abuse-c:" information > more often and introduces a new validation process. > > Most of the text has been rewritten following the last round of > discussion and the proposal is now at version 3.0. Some key points in > this version: > > - The abuse-mailbox should not force the sender to use a form > - The validation process must ensure that the abuse mailbox is able to > receive messages > - The validation should happen at least every six months > > You can find the full proposal at: > https://www.ripe.net/participate/policies/proposals/2019-04 > > As per the RIPE Policy Development Process (PDP), the purpose of this > four-week Discussion Phase is to discuss the proposal and provide > feedback to the proposer. > > At the end of the Discussion Phase, the proposer, with the agreement of > the Anti-Abuse Working Group Chairs, will decide how to proceed with the > proposal. > > We encourage you to review this proposal and send your comments to > <anti-abuse-wg(a)ripe.net> before 27 May 2020. > > Kind regards, > -- > Petrit Hasani > Policy Officer > RIPE NCC > > > > > -- Dr. Serge Droz Chair of the FIRST Board of Directors https://www.first.org

8 10

Re: [anti-abuse-wg] About "consensus" and "voting"...
by Randy Bush 11 May '20

11 May '20

> Suresh keeps attacking me without a single slightest proof, and hence > I must respond. a tale Told by an idiot, full of sound and fury, Signifying nothing. -- bill

1 0

FW: About "consensus" and "voting"...
by Suresh Ramasubramanian 11 May '20

11 May '20

Weird. Forwarding a (redacted) offlist email that pointed out that the archive URL I’d posted – which was dug out of my mailbox – is missing from the aawg archive, along with the rest of the email from Jan 2011. From: Suresh Ramasubramanian <ops.lists(a)gmail.com> Date: Monday, 11 May 2020 at 9:04 PM That was from an old email I’d sent to the list – searched my archives. The entire month’s email seems missing from the ripe mailman archives though. https://www.ripe.net/ripe/mail/archives/anti-abuse-wg/ February 2011: [ Thread ]<https://www.ripe.net/ripe/mail/archives/anti-abuse-wg/2011-February/thread.…> [ Subject ]<https://www.ripe.net/ripe/mail/archives/anti-abuse-wg/2011-February/subject…> [ Author ]<https://www.ripe.net/ripe/mail/archives/anti-abuse-wg/2011-February/author.…> [ Date ]<https://www.ripe.net/ripe/mail/archives/anti-abuse-wg/2011-February/date.ht…> [ Gzip'd Text 34 KB ]<https://www.ripe.net/ripe/mail/archives/anti-abuse-wg/2011-February.txt.gz> December 2010: [ Thread ]<https://www.ripe.net/ripe/mail/archives/anti-abuse-wg/2010-December/thread.…> [ Subject ]<https://www.ripe.net/ripe/mail/archives/anti-abuse-wg/2010-December/subject…> [ Author ]<https://www.ripe.net/ripe/mail/archives/anti-abuse-wg/2010-December/author.…> [ Date ]<https://www.ripe.net/ripe/mail/archives/anti-abuse-wg/2010-December/date.ht…> [ Gzip'd Text 47 KB ]<https://www.ripe.net/ripe/mail/archives/anti-abuse-wg/2010-December.txt.gz> From: removed Date: Monday, 11 May 2020 at 5:55 PM To: Suresh Ramasubramanian <ops.lists(a)gmail.com> Subject: Re: [anti-abuse-wg] About "consensus" and "voting"... > On 11 May 2020, at 08:20, Suresh Ramasubramanian <ops.lists(a)gmail.com> wrote: > > https://ripe.net/ripe/maillists/archives/anti-abuse-wg/2011/msg00000.html > Gets a Not found error page

1 0

Elad Cohen: Moderation & Responses
by Brian Nisbet 11 May '20

11 May '20

Colleagues, We would greatly prefer not to be writing this email, but it felt more wrong not to. You will have noticed that Elad Cohen has continued to successfully send emails to the list by creating new email addresses. This is, of course, easy, especially if you are determined. It is also against certainly the spirit of being placed in moderation and shows an unwillingness to abide by the Community code of conduct. While the Co-Chairs, with the invaluable support of the NCC staff, will continue to try to moderate the list when needed, and guided by that code of conduct, we would ask simply that people do not interact with Elad Cohen on list. What you do elsewhere is outside of our remit, as it should be, but we do not see any merit to these conversations on the AA-WG mailing list. Thank you all, Alireza, Brian, Tobias Co-Chairs, RIPE AA-WG Brian Nisbet Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

1 0

Spamming LIR accounts
by Töma Gavrichenkov 10 May '20

10 May '20

Peace, Okay, should I be the first to step in and say that spamming all the LIR accounts with one's mind-boggingly stupid "technical solutions" that have no, 0, zero chances to be implemented on the Internet is completely irresponsible and grossly unacceptable behaviour? What does GDPR have to say about this? -- Töma

10 14

Response to ipabuseresearch@gmail.com
by bigpiggyyyyyyyyyyyyyyyyyyyy＠protonmail.com 10 May '20

10 May '20

Hello IP Abuse Research, Response to your questions, misunderstanding and false information at: https://www.ripe.net/ripe/mail/archives/anti-abuse-wg/2020-May/005747.html ---- "Please refrain from attacking mods or claiming censorship w/o proof, provide logs or transparency into the issue or just state your case w/o personal attacks." ---- Please refrain from writing false information to the readers, do you want a proof of a censorship ? it sounds reasonable to you ? I need too use a different email address in order to reply to you. ---- "Do you have a draft RFC or any buy in from the IETF for your tracking packet proposal? Or is part of harnessing the power of the RIPE part of a larger campaign to alter the current process? When soliciting feedback, did any of the NIRs have pushback on this?" ---- The draft is in my head and will be implemented through a roundtable if I will be elected. ---- "Do Cisco, Juniper, Huawei and others have an estimate on how long it will take to develop the controls mentioned and integrate them / back port them? Are they willing to subsidize this upgrade or will this require public and private institutions around the world to update their BGP routers at their own expense?" ---- No commercial company wil subsidize anything, the goal is that only firmware updates will be needed without any hardware upgrade and that through community pressure - through the roundtable - the routing equipment manufaturers in the roundtable will do what they need to do (implementation of their firmware according to the specfiications). ---- "If this works you might should follow up with Bert Hubert to see if this solution can help fix the DNS Camel problem. I don't think he has explored this specific means of control." ---- Bert is a member of the illegal anonymous organization "The Spamhaus Project" (such as you are) and he is taking active actions for me not to be elected. He is against this solution because it came from me only because of his ego. ---- "Both of your plans mention a large centralized infrastructure run by the 5 RIRs which is managed "by regulated supervised Law Enforcement Agency (for example: Interpol) and not by an internet organization such as the RIRs or ccTLD registries." Is your proposal that we will create The Internet Police? Will they be overseen by the UN or the ITU?" ---- This is incorrect, it is a "centralized" infrastructure exactly as the root DNS servers are a "centralized" infrastructure - exactly the same and everyone are happy with the root DNS servers spread over the world. Regarding: "which is managed "by regulated supervised Law Enforcement Agency (for example: Interpol) and not by an internet organization such as the RIRs or ccTLD registries." This is a completele lie and you are intentioanlly taking sentences out of their context! In the email spam solution, the only part of Interpol is to be in charge only for setting which domains are criminal domains (phishing/malware/virus/etc), remotely through an API, without any access to the system - the reason that Interpol should set it and not the 5 RIR's is because Interpol is regulated and supervised according to law and in Interpol all the countries of the world is/should exist so Interpol will not act as a political organization against any non-member country. The reason Interpol is written and not Europol is also the same - so there will not be any case of few countries in Europol against another country not in the region of Europol (and capability of censorship, digital warfare, etc) - so no politics will be involved here. And this criminals domains list will not be used for agenda / politics / hidden interests (just like "The Spamhaus Project" are doing anonymously). In the anti-abuse methods solutions, the only part of Interpol is regarding creating the signed honeypot templates, that's it, without any access to the system. The reason is that honeypot hacking will cause criminal implications - so the honeypot template must be 100% reliable and created by an organization which is supervised and is regulated according to law - so there will not be false positives. ---- "When it comes to the body of the 5 RIRs, are the NIRs represented independently or do they maintain their own infrastructure?" ---- The two solutions will be managed only by the 5 RIR's, the bgp anycasted infrastructure can be spread over internet organizations worldwide which are not controlled by governments (and that these internet organizations are in countries with strict privacy laws, without experience of violating privacy laws and with democracies). Respectfully, Elad

2 2

@EXT: Europol Safety Guide for the "New Normal" after COVID-19
by Marcolla, Sara Veronica 08 May '20

08 May '20

Dear Anti-Abuse WG readers, Over the course of the past 6 weeks Europol has been releasing on weekly basis new material relating to COVID-19, all is available in the Europol landing page: https://www.europol.europa.eu/staying-safe-during-covid-19-what-you-need-to… and it gets published via the Europol and EC3 social media channels (Twitter, Facebook, Instagram and LinkedIn). This week we have launched a new product that may be of your interest: an infographic covering a safety guide for 'the new normal', looking ahead and complementing the information contain in the latest Europol public report issued a few days ago. You can find the report here: https://www.europol.europa.eu/sites/default/files/documents/report_beyond_t… And the infographic here: https://www.europol.europa.eu/activities-services/public-awareness-and-prev… The infographic comes in full and in 4 themed cards (if you wish to have them for use in your social media and/or in your company, you can drop me a message). This message was shared with ICANN GAC and the RIPE Cooperation WG as well, inter alia. Kind regards, Sara Marcolla Europol - O3 European Cyber Crime Centre (EC3) Eisenhowerlaan 73, 2517 KK The Hague, The Netherlands www.europol.europa.eu<http://www.europol.europa.eu> ******************* DISCLAIMER : This message is sent in confidence and is only intended for the named recipient. If you receive this message by mistake, you may not use, copy, distribute or forward this message, or any part of its contents or rely upon the information contained in it. Please notify the sender immediately by e-mail and delete the relevant e-mails from any computer. This message does not constitute a commitment by Europol unless otherwise indicated. *******************

1 0

Preventing spoofed amplification DDoS attack and email spam
by bigpiggyyyyyyy 06 May '20

06 May '20

Hello Everyone, I'm being intentionally moderated by the co-chair Brian without my replies being approved for almost a week, all of it in order to intentionally censor me for the near elections. My following technical solution will completely prevent any kind spoofed ip packets and any kind of spoofed amplification DDoS attacks: https://www.ripe.net/ripe/mail/archives/members-discuss/2020-April/003902.h… Spoofed ip traffic is a source for internet abuse, as well as spoofed amplification DDoS attacks. If I'll have the honor of being elected I'll work to have it implemented at a global scale, as well as my following technical solution to prevent email spam: https://www.ripe.net/ripe/mail/archives/members-discuss/2020-April/003778.h… A world without email spam will be a much more effective world, the time it will save is enormous. I hope to receive the support of RIPE Anti-Abuse Working Group for the above that will have a major impact on defeating abuse in the Internet, instead of a block from Brian. Respectfully, Elad

2 1

Draft Agenda, Anti-Abuse Working Group Meeting @ RIPE80
by Brian Nisbet 06 May '20

06 May '20

Colleagues, Here is the draft agenda for our session at 10:00 CEST on Thursday 14th May. We have a 45 minute session, so there may be time for other discussion/items, but keeping to that time will be very important. Please let the Co-Chairs know if you have any additions. A. Administrative Matters * Welcome * Scribe, Jabber, Stenography * Chat Etiquette * Approve Minutes from RIPE 79 * Finalise agenda B. Update * B1. Recent List Discussion C. Policies - *C.1. Policy Proposal 2019-04 - Validation of "abuse-mailbox", Jordi Palet Martinez, The IPv6 Company X. A.O.B. Z. Agenda for RIPE 81 Brian, Co-Chair, RIPE AA-WG Brian Nisbet Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

1 0

Testing - Replies to Other Threads Not Appearing
by IP Abuse Research 05 May '20

05 May '20

Hello, I recently sent a reply to a post that didn't ever appear as sent to the mailing list. This is a test to see if there is an issue with this thread or generally. Cheers

1 0

AS35196 - Ihor Hosting LLC
by No No 02 May '20

02 May '20

Hello, does anyone have any information on this criminal operation: https://bgp.he.net/AS35196#_asinfo https://bgp.he.net/AS35196#_graph4 It is being used for bullet proof hosting of phishing websites, such as: https://phishtank.com/phish_detail.php?phish_id=6520710 ----

2 1

ORG-PIHL2-RIPE AS43350
by No No 02 May '20

02 May '20

Further to my previous email about AS35196 Ihor hosting Ltd, IP range 91.212.150.0 - 91.212.150.255 of AS43350 appears to be run by the same people and is hosting these phishing websites: https://affittacamerehereditas[.]xyz/ https://aziendafuscillo[.]xyz/ https://apps.db.ripe.net/db-web-ui/lookup?source=ripe&key=ORG-PIHL2-RIPE&ty…

1 0

Re: [anti-abuse-wg] 2019-04 Discussion Phase (Validation of "abuse-mailbox")
by Richard Clayton 01 May '20

01 May '20

In message <DB7PR10MB215431CFDAB4554CBF6F9E85D6AA0(a)DB7PR10MB2154.EURPRD1 0.PROD.OUTLOOK.COM>, Elad Cohen <elad(a)netstyle.io> writes > if I will have the honor of being > elected to the Ripe Board I will [...] > At the source BGP router, for any ip packet with a source address > that is from the network of the source BGP router (lets call it > original ip packet) - the source BGP router will create a new ip > packet (lets call it tracking ip packet) with a new transport layer > protocol and with the same source address and with the same > destination address and with the same IP-ID such as the original ip > packet. etc this appears to be a technically inferior adaptation of a 20 year old proposal from Steve Bellovin https://academiccommons.columbia.edu/doi/10.7916/D8FF406R it got zero traction then because it treats the issue as technical rather a complex security economics issue. Nothing, in my view, has changed in twenty years. > Automatic prventation of IoT botnet infections: > > - IoT botnets are based on default credentials, only some of them -- many exploit unpatched insecure protocol implementations > Automatic prventation of botnet C&C ip addresses: > > - Botnets C&C are also a problem in the internet. > - This problem can be overcome using the following technical > addition: the 5 RIR's will operate end-users honeypots machines all > over the world you should keep up with my academic work on detecting honeypots (we found around 3000)... yes they are valuable, no they are not a panacea (and they are mainly poorly deployed... and we also found that many were not patched up-to-date [shoemaker's children?]) > Very soon I will post a single solution to all the following > problems: (implementation is fast and easy and I'll be very happy > to manage the implementation in case I will be elected to the Ripe > Board) > * Spoofed ip traffic > * Spoofed amplification ddos attacks > * BGP&RIR hijacking > * IoT botnet infections > * Botnet C&Cs I'm disappointed that you aren't solving the spam problem as well -- Dr Richard Clayton <richard.clayton(a)cl.cam.ac.uk> Director, Cambridge Cybercrime Centre mobile: +44 (0)7887 794090 Computer Laboratory, University of Cambridge, CB3 0FD tel: +44 (0)1223 763570

2 1