- anti-abuse-wg - mailman.ripe.net

New on RIPE Labs: Who's Watching
by Mirjam Kuehne 13 Nov '14

13 Nov '14

Dear colleagues, For those of you who missed Geoff Huston's "Who's Watching" lightning talk during RIPE 69, the write-up is now on RIPE Labs: https://labs.ripe.net/Members/gih/whos-watching Kind regards, Mirjam Kuehne RIPE NCC

1 0

New on RIPE Labs: ECDSA and DNSSEC by Geoff Huston
by Mirjam Kuehne 11 Nov '14

11 Nov '14

Dear colleagues, Please find another security related article by Geoff Huston on RIPE Labs: Elliptic Curve Digital Signature Algorithm (ECDSA) and DNSSEC https://labs.ripe.net/Members/gih/ecdsa-and-dnssec Kind regards, Mirjam Kuehne RIPE NCC

1 0

Re: [anti-abuse-wg] Hijack Factory: AS201640 / AS200002
by Gert Doering 09 Nov '14

09 Nov '14

Hi, On Thu, Nov 06, 2014 at 02:55:52PM +0000, anfernandez(a)lavanguardia.es wrote: > When RIPE is actually a judge that decided to protecting internet piracy. You can be sure that RIPE will open an expedient to any LIR that do not pay its fee, but you can keep waiting to see RIPE opening an expedient to investigate bad use of internet by one of their associated LIRs. It should be made totally clear that spamming, pirating movies, and so on is a legitimate usage of IP addresses IF THE JURISDICTION OF THE LIR IN QUESTION PERMITS IT. We might not *like* it, but if it's legal in, say, Romania to send out large amounts of e-mail, attacking the RIPE NCC for providing IP addresses to a LIR in .ro is not the way to fix it. Now, we all might agree that SPAM is evil, and pirating moviez is also evil. What about encouraging political debate? China might have a stance here. What about pictures of men kissing men? Russia might not like that. Things that are totally inacceptable for some parties are things that other parties want protected by freedom of speech, or freedom of doing business. So, the NCC can, will and *should* not act on "things people do not like" - it will (and does) act if being lied to, or if a judge decides that a LIR's business is illegal. In this particular case, I wonder why nobody is yelling at the upstream who is happily forward packets for that AS... due dilligence at accepting customer prefixes would have easily caught the announcements. (Yes, I understand that I'm now officially part of the problem, as I'm obviously not willing to do everything technically possible to stop particular sorts of badness) Gert Doering -- NetMaster -- have you enabled IPv6 on something today...? SpaceNet AG Vorstand: Sebastian v. Bomhard Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279

7 25

Re: [anti-abuse-wg] Hijack Factory: AS201640 / AS200002
by Ronald F. Guilmette 07 Nov '14

07 Nov '14

<anfernandez(a)lavanguardia.es> wrote: >Don't waste your time. RIPE is not going to do anything about piracy... I already took my turn, years ago now, howling my disappointment that neither RIPE, nor RIPE NCC, nor any other RiR is willing to play the role of the Internet Police. I'm over that adolecent phase now, and have come to accept what they are, and the fact that no howling on my part is in the least bit likely to change what they are. The RiRs are fundamentally data base companies. I don't intend by saying that to slight them, or anybody associated with them in any way. I am quite completely sure that they also do quite a lot of other very fine work also... making all sorts of logistical arrange- ments for regular meetings, and all that goes with that, and RIPE Labs produces some fine tools and excelent technical reports. In short, they do a _lot_ of fine work. But at base, their first order task... RIPE NCC anyway... is the orderly allocation of resources and the maintenance of the data base. Anybody who knows anything about the history of the United States, as I do, can grasp the notion that RIPE is just a sort of ``federal'' system... a federation of a bunch of sometimes waring tribes/states, each with its own separate agenda, and a federation with intentionally limited powers over its constituents. So I'm not really either expecting or even asking them to ``do'' anything about ``piracy''. I will however ask them to look into some of the things that seem wrong to me and that appear in their data base. And I have faith that they will do so, because that _is_ their job. Regards, rfg

3 2

Re: [anti-abuse-wg] Hijack Factory: AS201640 / AS200002
by Ronald F. Guilmette 06 Nov '14

06 Nov '14

anfernandez(a)lavanguardia.es you wrote: >Let me ask you a question: Which is the mision of RIPE? You didn't ask _me_, but I will answer anyway. The first order mission of RIPE NCC is to make and oversee number re- source allocations, insuring that they are done in an orderly fashion, and to maintain the data base of said allocations. The first order mission of RIPE is to fund and maintain RIPE NCC. >RIPE's web site say: We serve our members by delivering a high quality regi >stry and supporting the core Internet infrastructure. Connecting people wit >hin and beyond the technical community through our inclusive, multi-stakeho >lder approach, we contribute to an innovative and reliable Internet. > >Do you really think RIPE is serving its mission? I do, yes. >Do you really think RIPE is providing a reliable internet? I do, yes. Every time I go to visit, for example, www.bbc.com, it just works. Younger people sometimes don't appreciate what a minor miracle this seemingly simple thing is, and what a colossally large number of different things *all* have to work, and work correctly, in order to make it happen. (I've been working on computers since the mid 1970's, and let me tell you, back then it was _really_ a minor miracle when anything did in fact work.) Regards, rfg

1 0

Hijack Factory: AS201640 / AS200002
by Ronald F. Guilmette 06 Nov '14

06 Nov '14

How does one go about making a formal request to RIPE NCC to investigate a given AS registrant/registration? Given that AS201640 appears to exist exclusively for the purpose of hijacking multiple/numerous blocks of IPv4 space that it rather clearly has no rights to, I would like to formally lodge exactly such a request. http://blogs.cisco.com/security/talos/help-my-ip-address-has-been-hijacked/ http://mailman.nanog.org/pipermail/nanog/2014-October/071056.html This is ongoing, as we speak. Among the many IP blocks being hijacked, one of them even belongs to the Taiwan Network Information Center. Note that the hijacked IP space is being used, perhaps by multiple parties, by also by at least one convicted felon, and for one very specific purpose... http://krebsonsecurity.com/2014/11/still-spamming-after-all-these-years/ Regards, rfg P.S. To be clear, I would like to see there be an investigation of _both_ AS201640 and also the one and only other AS that appears to connect AS201640 to the rest of the world, i.e. AS200002. Somebody please help me here. I did try to read at least one of the official RIPE NCC registration requirement documents yesterday, and I was left with the impression... perhaps incorrect on my part... that in order to obtain an AS, the network in question must be multi-homed. Doesn't that mean that the network in question must have connectivity to the outside world via *more than one* other AS? P.P.S. Unlike RIPE number resource allocations, it _is_ easily possible to find the registration date for most domain names in most TLDs. The AS primarily at issue here is AS201640 and it seems to be associated with a (contact) domain name of "grimhosting.com". (The associated web site, by the way, is _not_ hosted within any IP space which is being announced by AS201640. Rather it is hosted on Cloudflare.) Anyway, the registration date for the domain name grimhosting.com is 2014-06-18. The person name on the registration for both the AS and that domain name is "Bogomil Simeonov". In the domain name registration, this name is associated with the e-mail address <simeonov_zepter(a)abv.bg>. That address in turn seems to be associated with some company named Zepter Bulgaria Ltd., which is apparently a "direct sales" organization, and also, perhaps, with the young man who is pictured in/on this web page: http://cv-simeonov.hit.bg/

3 3

Link to data sets document
by Mirjam Kuehne 06 Nov '14

06 Nov '14

Hi, As promised earlier this week during the WG session, here is the link to the document describing various abuse contact data sets for IT security incident handling: https://github.com/certtools/contactdb/blob/rest/doc/datasets.mkd Please let us know if you have any comments or suggestions. Any feedback is welcome. Kind regards, Mirjam Kuehne

1 0

Re: [anti-abuse-wg] Hijack Factory: AS201640 / AS200002
by Gert Doering 06 Nov '14

06 Nov '14

Hi, On Thu, Nov 06, 2014 at 03:41:51PM +0000, anfernandez(a)lavanguardia.es wrote: > Let me ask you a question: Which is the mision of RIPE? "Distribute Internet resources in a fair and impartial way to those entities that need Internet resources to go about their business". > RIPE's web site say: We serve our members by delivering a high quality registry and supporting the core Internet infrastructure. Connecting people within and beyond the technical community through our inclusive, multi-stakeholder approach, we contribute to an innovative and reliable Internet. > > Do you really think RIPE is serving its mission? Yes. > Do you really think RIPE database is a high quality registry when the single requirement to the LIRs is not provide untruthful information , but it does not matter if it is unuseful, as, for example, abuse contact email address? If the information provided to the RIPE NCC is not correct, this can lead to closure of a LIR. If someone is not reading their abuse mail, there is nothing the NCC can do about it unless the community(!) mandates it to do so. > Do you really think RIPE is providing a reliable internet? RIPE's delegation of their responsabilities is driving internet to be blocked by a lot of national firewall because of local application of copyright or anti abuse legislaton. Is this the RIPE's reliable internet? The RIPE NCC is not running the internet, but it *is* providing one of the better registration services as far as transparency of policy making and mission go. Especially the fact that it is very clearly defined what the RIPE NCC will do and what it will not do, and that everything can be changed if the community comes to consensus to do so. Gert Doering -- NetMaster -- have you enabled IPv6 on something today...? SpaceNet AG Vorstand: Sebastian v. Bomhard Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279

1 0

New on RIPE Labs: Security and Privacy Objectives by Geoff Huston
by Mirjam Kuehne 06 Nov '14

06 Nov '14

Dear colleagues, Please find a new article by Geoff Huston on RIPE Labs: Privacy and Security - Five Objectives https://labs.ripe.net/Members/gih/privacy-and-security-five-objectives Kind regards, Mirjam Kuehne RIPE NCC

1 0

RIPE Autonomous System Numbers
by Ronald F. Guilmette 05 Nov '14

05 Nov '14

A few questions, if you don't mind... Given some arbitrary record which is stored within the RIPE WHOIS data base, such as an organization (ORG-*) record or a record for a number resource, such as an AS, how can I determine the date on which that record was created? Do I just look for the earliest date found in any of the associated changed: fields? Give an AS number, issued within the RIPE region, how can I find the identity of the associated LIR? Is the identity of the associated LIR provided by the sponsoring-org: field of the WHOIS record for the AS? What sorts of credentials or bona fides must or should applicants who are requesting AS number allocations provide to the RIPE LIR which processes the request(s)? Has any AS number allocation, issued within the RIPE region, ever been revoked without the consent of the registrant of that allocation? If so, which ones? And in those cases, what policies and/or procedures were used or followed during the revocation process? Are these policies and/or procedures written down someplace, or are they entirely ad hoc?

10 28