- anti-abuse-wg - mailman.ripe.net

Introduction - Eric FREYSSINET
by Eric Freyssinet 23 Aug '11

23 Aug '11

Hello ! This short message to introduce myself to the list. I have registered to follow your discussions after a presentation at Europol where Brian Nisbet made a presentation. I am Eric FREYSSINET, and I work for the gendarmerie nationale in France, which is one of our two national police forces. Currently, I am the head of our national cybercrime division. I have been working since 1998 in the field of IT investigations, first as the head of our IT forensics lab, then at our headquarters in a coordination function, and now as the head of an Internet invesitigations unit. I look forward to exchanging with the community. Best regards, -- Eric Freyssinet perso: eric.freyssinet(a)m4x.org pro: eric.freyssinet(a)gendarmerie.interieur.gouv.fr blog: http://blog.crimenumerique.fr/

2 1

Fwd: Prefix hijacking by Michael Lindsay via Internap
by Suresh Ramasubramanian 20 Aug '11

20 Aug '11

Nice little thread on nanog that is rather a propos to what we're discussing. ---------- Forwarded message ---------- From: Denis Spirin <noc(a)link-telecom.net> Date: Sun, Aug 21, 2011 at 6:35 AM Subject: Prefix hijacking by Michael Lindsay via Internap To: nanog(a)nanog.org Hello All, I was hired by the Russian ISP company to get it back to the business. Due to impact of the financial crisis, the company was almost bankrupt, but then found the investor and have a big wish to life again. When I tried to announce it's networks, upstreams rejected to accept it because of Spamhaus listings. But our employer sworn there is not and was not any spamming from the company. The Spamhaus lists all our networks as spamming Zombies. And it IS announced and used now!!! The announce is from American based company Internap (AS12182). I wrote the abuse report them, but instead of stop unauthorized announces of our networks, I was contacted by a person named 'Michael Lindsay' - he tell me he buy our networks from some other people and demand we get back our abuse reports. Of course, we don't. After a short googling, I found this is well-known cyber crime person: http://www.spamhaus.org/rokso/listing.lasso?file=818&skip=0, and he did IP hijacking with the fake letter of authorization before: http://www.spamhaus.org/rokso/evidence.lasso?rokso_id=ROK8686 so our company is not a first victim of him. Yes, our company "help" him with the mistake of loosing old domain link-telecom.biz he was also squatted. This domain was listed as contact at RIPE Database. It is a good topic why these easy-to-forge LOAs is still in use, as RADB/RIPE DB/other routing database with the password access is a common thing. But this is not the main thing. The main thing is why Internap helps to commit a crime to the well-known felony person, and completely ignores our requests? Is there any way to push them to stop doing that immediately? If anybody can - please help... -- Suresh Ramasubramanian (ops.lists(a)gmail.com)

1 0

RIPE NCC Abuse Complaints, Audits and Reports
by Athina Fragkouli 18 Aug '11

18 Aug '11

Dear colleagues, Following discussions and comments on the mailing list, we would like to inform you about the current status of audits and handling abuse complaints, and on plans to improve the way we deal with these. Currently, abuse complaints come in via abuse(a)ripe.net. When this is a valid complaint, we investigate the matter, we contact the relevant LIR and we execute an audit on the LIR. Apart from audits initiated by complaints, we also execute audits of randomly selected LIRs as well as LIRs in whose registration records we notice inconsistencies. Here are some statistics on the number of audits and on the outcomes of those audits: - 2009: 319 audits, all LIRs were in order or complied with auditors’ instructions - 2010: 447 audits, seven PI assignments were deregistered - 2011: 234 audits, 124 are complete, two LIRs were closed as a result of the audits, two PI assignments were deregistered, 110 audits are ongoing For confidentiality reasons, the RIPE NCC does not report on individual audits, on the changes/amendments made in the audits or on the comments/communication with the LIR during the audit. Reports on audits will take place during the update from the RIPE NCC at the RIPE NCC Services Working Group at every RIPE Meeting. We acknowledge there is a lack of clarity and transparency on our abuse and complaint procedure. We are in the process of redeveloping this process to improve our services in this area. We will present the revised process during the RIPE 63 Meeting in Vienna. Because we are in the process of setting this up, we welcome your feedback and any experiences you would like to share on this mailing list. We will not comment on each and every suggestion, but we will take the feedback/comments into account in developing this new procedure. Kind regards, Athina Fragkouli RIPE NCC

10 11

Re: [anti-abuse-wg] RIPE NCC Abuse Complaints, Audits and Reports
by Athina Fragkouli 18 Aug '11

18 Aug '11

Dear all, Thank you very much for your comments. Regarding the nature of a valid complaint and the inconsistent registration: A complaint sent to the RIPE NCC is valid if it refers to a matter the RIPE NCC is responsible for. The RIPE NCC is responsible for implementing RIPE Policies and for making sure that LIRs and End Users with independent resources comply with RIPE Policies. Accordingly, a registration is inconsistent if it is not correct and updated. Regarding audits before 2009: The RIPE NCC reported on audits (including audits before 2009) at RIPE 61: http://ripe61.ripe.net/presentations/331-Update_RIPE_NCC_R61.pdf (see slide 10) Regarding the total amount of IP addresses deregistered as a result of audits: Deregistered allocations: one /21 and one /17 Deregistered PI assignments: one /22, four /23s and four /24s Kind regards, Athina Fragkouli RIPE NCC

2 1

Re: [anti-abuse-wg] Correct info in RIPE-database - YES
by Frank Gadegast 18 Aug '11

18 Aug '11

Webservice wrote: > Now to tackle this problem: > Shouldn't there be a phone-number or a hotline for BGP-issues? > Especially with big problems it's a real problem to get to the right > helpdesk/support. > I know that some endusers who receive a spam email would contact that > hotline also, however: is it possible to show that info only if a person > is logged in into the LIR-portal? Just what Im asking for years now for. More easier would be an anonymous abuse contact wich could only by emailed to from registered email addresses from other RIPE members. So: every member would simply enter too email addresses and one (or more) IPs into their basic data at the portal. - one abuse contact - one sender email address - one or more IP address of the own sending mailservers And the Mailserver at RIPE will e.g. redirected a general as1234(a)members.ripe.net to the right abuse contact of that member. And: RIPE could even monitor outbreaks to one or the other member address to get an indication if there is an eval or non-responsive member (e.g. with not working mail addresses, full mailboxes aso). RIPE NCC could also monitor if a member becomes a bit to active or tries to flood other members. Telephone numbers seem to spread, so they will not be hidden after a while, but email is cool, because the receiver could handle these emails much quicker, because they could be more sure, that its coming from qualified other members, hopefully resulting in a much quicker action. Just an example: we filed a report at the usual abuse address of a bigger server housing provider in Germany arround 3 weeks ago , that one of their servers seemed to be captured and started to guess passwords on some of our POP3 servers. Now: after 3 weeks, be received a note, that our report will now be analysed. Whats about all those spam, all those DDoS attacks, pishing sites, whatever abuse, this server was causing the last 3 weeks to others ? And: just fiddled with our firewalls and can see, that this server is still trying to attack us ! Kind regards, Frank > > > Best regards, > Pascal Nobus > -- > www.webservice.be > Amelsdorp 72, 3740 Bilzen, Belgium > Tel: +32.89257404, Fax: +32.70423475 > > > -- PHADE Software - PowerWeb http://www.powerweb.de Inh. Dipl.-Inform. Frank Gadegast mailto:frank@powerweb.de Schinkelstrasse 17 fon: +49 33200 52920 14558 Nuthetal OT Rehbruecke, Germany fax: +49 33200 52921 ====================================================================== Public PGP Key available for frank(a)powerweb.de

10 24

Correct info in RIPE-database
by Webservice 13 Aug '11

13 Aug '11

Dear members. Last weekend I stumbled on a problem: We had problems in on of our BGP-prefixes. As the RIS Dashboard showed there was an overlapping Network in the same range as our prefix. We then wanted to contact the ISP, so the route could be redrawn (or sort this issue out), however: on the RIPE database we found: - no adress - no telephone-number - a wrong emailadress There was a link to a website, but after 4 phone-calls (where 1 has moved to another location, all the others where voice-mails), we gave up! The ISP that I couldn't reach was telefonica, see it yourself at: http://www.db.ripe.net/whois?form_type=simple&full_query_string=&searchtext… Now to tackle this problem: Shouldn't there be a phone-number or a hotline for BGP-issues? Especially with big problems it's a real problem to get to the right helpdesk/support. I know that some endusers who receive a spam email would contact that hotline also, however: is it possible to show that info only if a person is logged in into the LIR-portal? Best regards, Pascal Nobus -- www.webservice.be Amelsdorp 72, 3740 Bilzen, Belgium Tel: +32.89257404, Fax: +32.70423475

10 17

Recent Discussion & RIPE NCC Issues
by Brian Nisbet 11 Aug '11

11 Aug '11

Morning, There's been some very interesting discussion on the list recently, raising all sorts of point, with the odd diversion here and there. There are a few main points I'd like to address, with updates from the RIPE NCC, with whom I had a very useful conversation this morning. RIPE NCC Audits & Reporting Currently the NCC reports on audits to the NCC Services working group and they prepare a report for the community. While this overall reporting method won't change, they have agreed to send the latest copy of the report to the AA-WG and to send a copy of future reports to the list. Education/BCP As previously mentioned, this is an action on the AA-WG Chairs and we will be reporting back to you on this in the run up to and during RIPE 63. RIPE NCC Abuse Complain Procedure Along with more information on the Audits the NCC will be mailing the list, likely before the middle of next week, on their plans for the abuse complaint procedure. They will be outlining improvements to how abuse can be reported, what those reporting incidents should expect and what will be accepted. While information will, of course, be sent to the list, there will also be a presentation on this matter at RIPE 63. All of this is part of an ongoing plan to deal with issues with inconsistencies (deliberate or accidental) in the Database. The work of the ACM-TF also touches on this. This email is not meant as a full description of the NCC and WG activities, as I said, more information will be made available next week, so I would ask you to hold any questions until then. If it is felt that there is a requirement for further changes or expansion of activities, then we get into the territory of proposals and the NCC budget and both the AA-WG chairs and the NCC will render any assistance they can to anyone who would like to examine the possibilities there. One additional point, this mailing list, and the WG as a whole, will remain open to anyone in the RIPE community. As has been mentioned, we cannot work in isolation, nor should we. As regards the bounces, I'll pass them on to the relevant folk. Thanks again for your robust participation over the last two weeks and hopefully both this email and the NCC's response next week will go a long way to answering your points. Regards, Brian.

1 0

Re: [anti-abuse-wg] Correct info in RIPE-database
by Wilfried Woeber, UniVie/ACOnet 09 Aug '11

09 Aug '11

JXXrgen Hovland wrote: > You have to send to Mr World.Antispam.Report(a)inbox.com > <mailto:World.Antispam.Report@inbox.com> Really? ;-) Sorry, too much complexity and lack of credibility - if reply destination as offered in the mail headers doesn't work, I consider the data provided, and the identity used, as fake/fraudulent and draw my local conclusions ;-) Respectfully yours, for a moment wearing my CERT Team's Membership hat, Wilfried. > At 19:11 09/08/2011 (UTC), Wilfried Woeber, UniVie/ACOnet wrote: > > I'm a tad puzzled... > > abuse(a)localhost.com wrote: > [...] > > Trying to help with geography, and due to this being OT, > trying to do an individual reply to the sender, I get: > > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > > Subject: Mail delivery failed: returning message to sender > [...] > This message was created automatically by mail delivery software. > > A message that you sent could not be delivered to one or more of its > recipients. This is a permanent error. The following address(es) failed: > > abuse(a)localhost.com > all relevant MX records point to non-existent hosts > > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > > Hm, I think I can draw some conclusions for my end? > Wilfrid. > > >

1 0

Abuse report.
by abuse＠eunet.rs 09 Aug '11

09 Aug '11

Dear colleagues, This is SPAM report from one of our users. It seems that message came from your server. We belive that you will find that user and that you will take appropriate measures against him. Due to privacy policy of our company, all information about our user is changed to "x". >From - Mon Aug 08 20:27:03 2011 X-Account-Key: account4 X-UIDL: 76e74b310924bc33 X-Mozilla-Status: 0001 X-Mozilla-Status2: 00000000 X-Mozilla-Keys: Return-Path:<coke98(a)9.cn> Received: from freeuk-outbound-smtp04.mail.eu.clara.net (freeuk-outbound-smtp04.mail.eu.clara.net [195.8.64.21]) by eunet.rs (8.13.6/8.13.6) with ESMTP id p786mrD8029683; Mon, 8 Aug 2011 08:48:59 +0200 Received: from webmail01.mail.eu.clara.net ([213.253.3.101]:39081 helo=webmail.freeuk.com) by relay04.mail.eu.clara.net (relay.freeuk.com [213.253.3.44]:1225) with esmtp id 1QqJcs-000724-DM (return-path<coke98(a)9.cn>); Mon, 08 Aug 2011 06:47:50 +0000 Received: from 41.138.188.115 (SquirrelMail authenticated user j.fawcett(a)freeuk.com) by ssl-webmail-vh.freeuk.com with HTTP; Mon, 8 Aug 2011 07:47:50 +0100 Message-ID:<cf72a906cd7895b462e79c9e07dc16d6.squirrel(a)ssl-webmail-vh.freeuk.com> Date: Mon, 8 Aug 2011 07:47:50 +0100 Subject: You won in Yesterday Draws!!! From: "Coca-Cola Award Team"<coke98(a)9.cn> Reply-To: cocacolawebnetvet(a)w.cn User-Agent: SquirrelMail/1.4.21 MIME-Version: 1.0 Content-Type: text/plain;charset=ISO-8859-1 Content-Transfer-Encoding: 8bit X-Priority: 3 (Normal) Importance: Normal X-Squirrel-AuthUser: j.fawcett(a)freeuk.com X-EUNET-AVAS-Milter-Version: 2.0.0 X-AVAS-Virus-Status: clean X-AVAS-Virus-Status: clean X-AVAS-Spamd-Symbols: BAYES_80,DNS_FROM_RFC_ABUSE,DNS_FROM_RFC_POST,FORGED_RCVD_HELO,PLING_PLING,TO_CC_NONE,UNPARSEABLE_RELAY X-AVAS-Spam-Score: 4.5 X-AVAS-Spam-Level: xxxxxxxxx If You have any questions, please contact our Technical support, every day from 00.00 to 24.00 phone 0700 300 400, (011) 202 3636 or e-mail support(a)eunet.rs EUnet wishes You a nice day and good connections! Petar Orlovic , Support Agent -- YUnet International www.EUnet.rs Dubrovacka 35/III, 11000 Beograd, Serbia Tel: 0700 300 400 Tel: +381 11 202 3636, Fax: +381 11 330 5609 e-mail: support(a)eunet.rs www.eunet.rs -- This e-mail is confidential and intended only for the recipient. Unauthorized distribution, modification or disclosure of its contents is prohibited. If you have received this e-mail in error, please notify the sender by telephone +381 11 2023636. --

9 12

Re: [anti-abuse-wg] VOTE: members and RIPE region only
by Frank Gadegast 09 Aug '11

09 Aug '11

Rob Evans wrote: >> why should anybody not associated with the RIPE region be >> part of the RIPE community ? > > Because the Internet is global. Ahhh, I did not think about that (*godsake*) > <https://www.ripe.net/ripe/about> Sorry, thats confusing. RIR stand for "regional" not world-wide. The community should also be a regional community. RIPE NCC defines itself as: The RIPE NCC is an independent, not-for-profit membership organisation that supports the infrastructure of the Internet through technical coordination in its service region. "Service region" ! At least RIPE is worldwide in the way, that its resources are globaly routed and misused worldwide ... I dont think that RIPE and RIPE NCC should not listen to users and organisations world-wide, but descissions should only be made be users from the RIPE region. Thats the same with the spamhause discussion we had. RIPE NCC has to check everything to its own regulations, but they could listen to important sources like spamhaus. And we are here to discuss definitions and regulations for the RIPE region, to discuss drafts and give advice to boards and descission makers in the RIPE region. We do not have to discuss them with people that hide behind anonymous services offered world wide. We could listen to them, but progress should only be defined by members. > > Rob > > > Kind regards, Frank -- PHADE Software - PowerWeb http://www.powerweb.de Inh. Dipl.-Inform. Frank Gadegast mailto:frank@powerweb.de Schinkelstrasse 17 fon: +49 33200 52920 14558 Nuthetal OT Rehbruecke, Germany fax: +49 33200 52921 ====================================================================== Public PGP Key available for frank(a)powerweb.de

2 1