- anti-abuse-wg - mailman.ripe.net

Is there any analysis on root causes of mail account break-ins?
by Hans-Martin Mosner 17 Nov '21

17 Nov '21

Hi folks, I'm trying to understand the root causes and vulnerabilities that lead to hacked mailboxes. Currently, we can handle dynamic IP ranges pretty well, and we have an extensive list of network ranges whose owner are spammers or knowingly accept spammers as customers. So what mainly remains as spam sources are hacked servers/websites, hacked mail accounts, and freemail accounts registered with the purpose of spamming (I'm looking at you, Google). Here I want to focus on hacked mail accounts. I can think of two major root causes but I have no idea about their relative significance: * Easily guessable passwords, with two subcauses for exploits: o Brute force authentication attempts - I'm seeing them regularly, and the most egregious networks (e.g. 5.188.206.0/24) are fully blocked at our mailserver, but some mailops are less struct about blocking such abusers. o Hashed password data exfiltration and cracking (for example using JtR) these lists - this would work better with weaker password hashing, but with weak passwords and some CPU power it is probably possible even for strong hash algorithms. * Malware on client machines where passwords are either stored in a password vault, or entered manually. My gut feeling is that some organizations are especially prone to hacked mail accounts. We're seeing lots of south american government agency users, and many accounts at educational institutions. The latter are often hosted using Microsoft O365 services, and I highly suspect that weak passwords for all the freshly created student accounts may be a major cause, although exfiltrated password data may be a possibility, too. So does anyone have pointers to studies analyzing these (and probably more) causes of exploited mail accounts? Cheers, Hans-Martin

4 3

Call For Co-Chair Nominations & Updated Agenda: RIPE 83 AA-WG Session
by Brian Nisbet 15 Nov '21

15 Nov '21

Colleagues, With the initial deadline for nominations for Co-Chairs arriving tomorrow, I wanted to let you all know that we have had one nomination so far. Numerically this is enough, but I would encourage those who have an interest in the sustainability, growth & evolution of the Anti-Abuse WG to consider putting themselves forward. You can send your nominations directly to me - brian.nisbet(a)heanet.ie In other news, we have an update for the draft agenda for our session next week, but I would note that there is still available time if anyone has any last minute entries. A. Administrative Matters * Welcome * Scribe, Chat, Stenography * Chat Etiquette * Ratings Where Appropriate * Approve Minutes from RIPE 82 * Finalise agenda * Working Group Chair Selection B. Update * B1. Recent List Discussion D. Interactions *D.1. RIPE NCC Abuse Handling Training E. Presentations *E.1. "The Hijackers Guide to the Galaxy: Off-path Taking over Internet Resources" - Tianxiang Dai, Technische Universität Darmstadt X. A.O.B. Z. Agenda for RIPE 84 Brian Nisbet (he/him) Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

1 0

RIPE Anti-Abuse WG Chair Selection @ RIPE 83
by Brian Nisbet 11 Nov '21

11 Nov '21

Colleagues, Both Alireza & Tobias' 3 year terms as AA-WG Co-Chairs will come to an end at RIPE 83. As per our current procedure this email is the start of the selection process for up to two Co-Chair positions for the WG and I would like to invite nominations (self- or otherwise) before 17:00 CET on Tuesday 16th November. More information on the process can be found here: https://www.ripe.net/participate/ripe/wg/active-wg/anti-abuse/anti-abuse-wg… Ideally Co-Chairs will be chosen by consensus within the WG, but if this cannot be managed, a vote will take place. The outcome of the process will be announced during the AA-WG session on Wednesday 24th November, between 10:30 - 12:00 CET. You can find out more about the role of WG Co-Chairs at: https://www.ripe.net/publications/docs/ripe-692 If you have any questions, or nominations, please do not hesitate to contact me. Brian Co-Chair, RIPE AA-WG Brian Nisbet (he/him) Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

2 2

RIPE 83 Draft Agenda & Final Call For Content
by Brian Nisbet 03 Nov '21

03 Nov '21

Colleagues, We have a draft agenda for RIPE 83. The AA-WG session will be taking place on Wednesday 24th November. We do still have "spare" time on the agenda, so if you have any items you would like to present to the working group, then please do contact aa-wg-chair(a)ripe.net I would also repeat my call for anyone who may be interested in putting themselves forward for one of the two Co-Chair positions that are up for selection at RIPE 83. A. Administrative Matters * Welcome * Scribe, Chat, Stenography * Chat Etiquette * Ratings Where Appropriate * Approve Minutes from RIPE 82 * Finalise agenda * Working Group Chair Selection B. Update * B1. Recent List Discussion D. Interactions - *D.1. RIPE NCC Abuse Handling Training X. A.O.B. Z. Agenda for RIPE 84 Thanks, Brian Co-Chair, RIPE AA-WG Brian Nisbet (he/him) Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

1 0

Re: [anti-abuse-wg] Anti-Abuse Training: Questions for the WG
by Erik Bais 26 Oct '21

26 Oct '21

Hi Brian & AA-WG, I think that an AA automation training would be very helpful for the members. For what I had in mind is to get attendees experience with tools like Netbox (for address management among other things..), and 1 or 2 Abuse management software tools.. ( like Abuse.io or Abusix (hosted & commercial) ) I create some time ago a write up of what the training could entail ( not set in stone obviously .. ) feel free to take your own path .. https://docs.google.com/document/d/1V8yv7VmflmhJyu3jgz3R63YWNdhKKKaP8LEs25Z… Once people see how easy it is to move away from excel sheets for IP address management .. and see the benefits of off-the-shelves products .. and how this could help them in their daily work, I'm sure that we will be in a better place in the future. So a big +1 from me on any training for the NCC members on training on this subject. Regards, Erik Bais On 15/10/2021, 11:15, "anti-abuse-wg on behalf of Brian Nisbet" <anti-abuse-wg-bounces(a)ripe.net on behalf of brian.nisbet(a)heanet.ie> wrote: Colleagues, As you may remember the WG Co-Chairs have been talking to the NCC about some possible Anti-Abuse training in March of this year. This proposal got very little reaction from the community, so we are going to try again to see if there is interest, or if people who are already on this mailing list believe that there would be interest from other LIRs that they know. I have re-attached the proposal that Alireza sent to the mailing list in March. Between now and RIPE 83 (when this matter will be on the WG session agenda) I would ask the following questions: 1) Would training, as described, be of interest to you? 2) Would training, as described, be of interest to other LIRs you know of/work with? 3) If not, would there be other areas of Anti-Abuse training that would be of interest? 4) Would you be willing to help write training materials for this course? After the list discussion and discussion at RIPE 83 the Co-Chairs will work with the NCC Learning & Development Team to decide if there is enough interest to develop the course and, if there is, how to proceed from there. We really do believe this is something that would be of interest to a large number of small LIRs in the region, but that's not something we can really determine without the help of the WG Thank you, Brian Co-Chair, RIPE AA-WG Brian Nisbet (he/him) Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

3 2

New on RIPE Labs: The Role of Service Providers in Transforming Security
by Alun Davies 25 Oct '21

25 Oct '21

Dear colleagues, In this new guest post on RIPE Labs, Kathleen Moriarty talks about how service providers can help improve Internet security. Even though taking measures in this area can require a lot of effort, Kathleen shows why doing so is very much worthwhile: https://labs.ripe.net/author/kathleen_moriarty/the-role-of-service-provider… Kind regards, Alun Davies RIPE Labs Editor RIPE NCC

1 0

Anti-Abuse Training: Questions for the WG
by Brian Nisbet 24 Oct '21

24 Oct '21

Colleagues, As you may remember the WG Co-Chairs have been talking to the NCC about some possible Anti-Abuse training in March of this year. This proposal got very little reaction from the community, so we are going to try again to see if there is interest, or if people who are already on this mailing list believe that there would be interest from other LIRs that they know. I have re-attached the proposal that Alireza sent to the mailing list in March. Between now and RIPE 83 (when this matter will be on the WG session agenda) I would ask the following questions: 1) Would training, as described, be of interest to you? 2) Would training, as described, be of interest to other LIRs you know of/work with? 3) If not, would there be other areas of Anti-Abuse training that would be of interest? 4) Would you be willing to help write training materials for this course? After the list discussion and discussion at RIPE 83 the Co-Chairs will work with the NCC Learning & Development Team to decide if there is enough interest to develop the course and, if there is, how to proceed from there. We really do believe this is something that would be of interest to a large number of small LIRs in the region, but that's not something we can really determine without the help of the WG Thank you, Brian Co-Chair, RIPE AA-WG Brian Nisbet (he/him) Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

8 9

Re: [anti-abuse-wg] Abuse address checking
by Ángel González Berdasco 18 Oct '21

18 Oct '21

Lol, a vacation autoreply to pass RIPE email address validation. 🤭 It kinda misses the point if they don't read them as well. -- INCIBE-CERT - Spanish National CSIRT https://www.incibe-cert.es/ PGP keys: https://www.incibe-cert.es/en/what-is-incibe-cert/pgp-public-keys ==================================================================== INCIBE-CERT is the Spanish National CSIRT designated for citizens, private law entities, other entities not included in the subjective scope of application of the "Ley 40/2015, de 1 de octubre, de Régimen Jurídico del Sector Público", as well as digital service providers, operators of essential services and critical operators under the terms of the "Real Decreto-ley 12/2018, de 7 de septiembre, de seguridad de las redes y sistemas de información" that transposes the Directive (EU) 2016/1148 of the European Parliament and of the Council of 6 July 2016 concerning measures for a high common level of security of network and information systems across the Union. ==================================================================== In compliance with the General Data Protection Regulation of the EU (Regulation EU 2016/679, of 27 April 2016) we inform you that your personal and corporate data (as well as those included in attached documents); and e-mail address, may be included in our records for the purpose derived from legal, contractual or pre-contractual obligations or in order to respond to your queries. You may exercise your rights of access, correction, cancellation, portability, limitation of processing and opposition under the terms established by current legislation and free of charge by sending an e-mail to dpd(a)incibe.es<mailto:dpd@incibe.es>. The Data Controller is S.M.E. Instituto Nacional de Ciberseguridad de España, M.P., S.A. More information is available on our website: https://www.incibe.es/proteccion-datos-personales and https://www.incibe.es/registro-actividad. ====================================================================

1 0

Abuse address checking
by Alessandro Vesely 17 Oct '21

17 Oct '21

Hi, it is rather common to find auto-responders at abuse addresses. For this one, however, it took me a minute to understand its intent, Best Ale -------- Forwarded Message -------- Subject: Confirmacion para RIPE Date: Sun, 17 Oct 2021 04:32:32 +0200 To: abuse(a)tana.it Auto-Submitted: auto-replied (vacation) OK, me llegan los correos!!.....

1 0

Reminder: Call for Agenda Items RIPE 83
by Brian Nisbet 13 Oct '21

13 Oct '21

Colleagues, As you're all hopefully aware the next RIPE meeting will be taking place, somewhere on the Internet, from the 22nd - 26th November this year. https://ripe83.ripe.net The Anti-Abuse WG will be meeting and Alireza, Tobias and I would invite people to submit topics for discussion, presentations for general enlightenment and, of course, work items for the working group. The session is currently scheduled for Wednesday 24th, but the date and time may both change as the various agendas fill up, we'll keep you posted. As always you can reach us at aa-wg-chair(a)ripe.net Thank you, Brian Co-Chair, RIPE AA-WG Brian Nisbet (he/him) Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

1 0