- anti-abuse-wg - mailman.ripe.net

So many idiots. So little time.
by Ronald F. Guilmette 14 Aug '22

14 Aug '22

[ part 1 - text/plain - Notification 574B ] This is the mail system at host segfault.tristatelogic.com. I'm sorry to have to inform you that your message could not be delivered to one or more recipients. It's attached below. For further assistance, please send mail to postmaster. If you do so, please include this problem report. You can delete your own text from the attached returned message. The mail system <abuse(a)serverius.net>: host mail.serverius.net[91.221.69.174] said: 554 5.7.1 This message has been blocked because ASE reports it as spam. (in reply to end of DATA command) [ part 2 - message/delivery-status - Delivery report 435B (suppressed) ] [ part 3 - message/rfc822 - Undelivered Message 23.2KB ] Number is required after -h Return-Path: <rfg(a)tristatelogic.com> Received: by segfault.tristatelogic.com (Postfix, from userid 1237) id 754EF4E7D0; Fri, 12 Aug 2022 14:59:24 -0700 (PDT) From: "Ronald F. Guilmette" <rfg(a)tristatelogic.com> To: abuse(a)serverius.net Cc: spamreports(a)tristatelogic.com Subject: Spam from your network (AS50673): [194.104.236.160] Date: 12 Aug 2022 14:59:24 -0700 X-Rfg-Spam-Report: (AS50673): [194.104.236.160] Message-Id: <20220812215924.754EF4E7D0(a)segfault.tristatelogic.com> ...

3 7

New on RIPE Labs: Threat Integration Lessons of Indicator and Incident Exchange
by Anastasiya Pak 09 Aug '22

09 Aug '22

Dear colleagues, Integration of shared indicators of compromise is very difficult when the responsibility is distributed to organisations which are then left with the task of turning those indicators into defensive actions or blocking rules. In the new article on RIPE Labs, Kathleen Moriarty, Chief Technology Officer for the Center of Internet Security, shares lessons learned for indicator and incident exchange. Read now: https://labs.ripe.net/author/kathleen_moriarty/threat-integration-lessons-o… Kind regards, Anastasiya Pak Marketing & Communications Officer RIPE NCC

1 0

postal address in IRT objects
by denis walker 23 Jul '22

23 Jul '22

Colleagues I have started a discussion on the DB-WG mailing list about the usefulness (or not) of a mandatory postal address in the IRT object. As there are perhaps more CSIRT people on this mailing list I thought I would bring it to your attention. The discussion starts here https://www.ripe.net/ripe/mail/archives/db-wg/2022-July/007537.html Your opinions would be appreciated. cheers denis proposal author

3 2

International survey on cyber skill gap in tertiary education
by Wout de Natris 15 Jul '22

15 Jul '22

Dear colleagues, We are currently researching the growing gap between the skills of young people graduating from tertiary studies and the expectations of employers in the tech and cybersecurity industry, and we're interested in hearing your views. We kindly invite you to fill out our survey in English<https://forms.gle/Dna6nSeiKMFY11cP9>, French<https://forms.gle/BzGZmmT2iJqkLRat8> or Polish<https://forms.gle/5cgeRjz29r1ZKTWE8>. The deadline is 15 August. The survey has been developed by the IGF's Internet Standards, Security and Safety Coalition (IS3C)<http://www.is3coalition.org>. It aims to establish where the gaps are and possible solutions, as well as to find out more about current good practice in this area around the world. To do this we need your views, knowledge and expertise. We hope you can assist us in getting a clear picture of the current playing field by filling in this questionnaire. An analysis of results will be made available at www.is3coalition.org<http://www.is3coalition.org/> in September 2022, in the lead up to a series of workshops bringing together academia and industry. If you know colleagues interested in this topic, then please share this survey with them. Best regards, Janice Richardson, Wout de Natris Chair of WG2 of the IS3C IS3C Cordinator https://forms.gle/5cgeRjz29r1ZKTWE8 - Polish version https://forms.gle/BzGZmmT2iJqkLRat8 - French version https://forms.gle/Dna6nSeiKMFY11cP9 - English version - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - De Natris Consult Kamerlingh Onnesstraat 43 Tel: +31 648388813 2014 EK Haarlem Skype: wout.de.natris denatrisconsult(a)hotmail.nl<mailto:denatrisconsult@hotmail.nl> http://www.denatrisconsult.nl Blog http://woutdenatris.wordpress.com

1 0

Reclamation of Number Resources
by Ronald F. Guilmette 07 Jul '22

07 Jul '22

Greetings all, As many of you no doubt know, there has been quite an extraordinarily large brouhaha of late within the AFRINIC region relating to AFRINIC's efforts to reclaim certain large blocks of IPv4 addresses from one particular member organization. This effort has resulted in considerable litigation within Mauritius, the home country of AFRINIC. Partially as a result of this ongoing controversy, but also just for my own edification, I would like to ask a number of questions about any and all prior instances in which RIPE has reclaimed number resources from member organizations, based on policy. It seems safe to assume that there have historically been some instances in which RIPE memberships have been terminated, and any associated assigned number resources reclaimed, if and when a given member has simply failed to pay fess due to RIPE. My questions however have to do with situations where policy violations other than the non-payment of fees are involved. Specifically, I would like to know if any of you can recall past instances where number resources have been reclaimed, by RIPE, for any of the following reasons: *) Usage of the assigned number resources was no longer consistant with the original justification submitted to RIPE. *) Violation(s) of out-of-region usage policy. *) Any other policy violations. Thanks in advance for any and all responses. Regards, rfg

1 0

Adding a "Security Information" contact?
by Max Grobecker 06 Jul '22

06 Jul '22

Moin-Moin and hello, TL;DR: Should there be an optional contact for sending security information to (i.e. about vulnerable services), which can be different from the abuse contact? Background: We get a reasonable amount of security information sent to our abuse mailbox about things like "There's a vulnerable Confluence server on your network" and "This IP has contacted a botnet C&C server". Technically, this is not an abuse related issue, but still relevant to know and forward to the respective customer. Most of these e-mails originate from our local CERT (in my case CERT-BUND in Germany) but there are some other senders which are informing about these vulnerable services. I guess, most other providers know about these from their local CERTs or other organizations. Our abuse mailbox is not overflowing with these, of course, but it makes semi-automated handling a bit painful. For example, we would like to forward these information to our customers, but we wont need to take further action on this, because we refuse to break into the offices of our customers at night and patch their software. Also, sometimes these reports contain outdated data and the vulnerability has been removed in the time between collecting these information and sending the e-mail. On the other hand, for real abuse like sending spam or participating in DDoS, we also want to forward this information as quick as possible (automated), but also we want to know about and escalate so we can pull the plug if needed. So I wondered, if there (c|sh)ould be an optional contact/role for sending security related information to? This could be a different mailbox which does another automated handling of forwarding this notifications. What is your opinion on this? Greetings Max

10 22

RIPE 84 minutes
by Markus de Brün 29 Jun '22

29 Jun '22

Hi all, our colleagues from RIPE NCC provided minutes for the AA WG session at RIPE 84. Please have a look at them and let us know by 07.07.22 if you have any additions, clarifications or comments. Thanks, Markus

1 0

Proposal 2022-01
by Ronald F. Guilmette 24 Jun '22

24 Jun '22

Just curious... How many of you folks have actually read sections 4.0, 5.0, and 6.0 of this pending proposal from the Database Working Group? https://www.ripe.net/participate/policies/proposals/2022-01 I suspect that many of you are going to want to read those sections before you have your memberships revoked for non-compliance. Regards, rfg

2 2

What todo when a registrar doe snot respond to babuse form an IP
by Angel P 23 Jun '22

23 Jun '22

Hello there, I have reported to a registrar an IP that has been doing a bunch of wordpress attacks one one of my sites and also using a fake referrer by impersonating itself a www.bing.com What can be done? Regards

4 3

Unanimity
by Ronald F. Guilmette 21 Jun '22

21 Jun '22

Just a brief point. I previously noted here that RIPE's rules requiring unanimity or near unanimity in order to declare "consensus" with respect to any given proposal has recently been recognized, by some EU politicians at least, as being a material impediment to forward movement on various issues. I only just noted that this growing sentiment has now apparently extended even to the Chancellor of Germany: https://twitter.com/EuromaidanPress/status/1538637496124317704 My hope, of course, is that RIPE and its various WGs are taking notes. Regards, rfg

4 5