- anti-abuse-wg - mailman.ripe.net

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 19, Issue 5
by Wout de Natris 07 Mar '13

07 Mar '13

Ronald, Have you considered working with the Dutch National Cyber Security Center? The people there may be very much interested in your data. Best wishes, Wout - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - De Natris Consult Raaphorst 33 Tel: +31 648388813 2352 KJ Leiderdorp Skype: wout.de.natris denatrisconsult(a)hotmail.nl http://www.denatrisconsult.nl Blog http://woutdenatris.wordpress.com > From: anti-abuse-wg-request(a)ripe.net > Subject: anti-abuse-wg Digest, Vol 19, Issue 5 > To: anti-abuse-wg(a)ripe.net > Date: Thu, 7 Mar 2013 12:00:02 +0100 > > Send anti-abuse-wg mailing list submissions to > anti-abuse-wg(a)ripe.net > > To subscribe or unsubscribe via the World Wide Web, visit > https://www.ripe.net/mailman/listinfo/anti-abuse-wg > or, via email, send a message with subject or body 'help' to > anti-abuse-wg-request(a)ripe.net > > You can reach the person managing the list at > anti-abuse-wg-owner(a)ripe.net > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of anti-abuse-wg digest..." > > > Today's Topics: > > 1. Re: Draft Anti-Abuse WG Agenda - RIPE 66 (Ronald F. Guilmette) > 2. Re: Draft Anti-Abuse WG Agenda - RIPE 66 (Ronald F. Guilmette) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Wed, 06 Mar 2013 22:41:53 -0800 > From: "Ronald F. Guilmette" <rfg(a)tristatelogic.com> > Subject: Re: [anti-abuse-wg] Draft Anti-Abuse WG Agenda - RIPE 66 > To: anti-abuse-wg(a)ripe.net > Message-ID: <55478.1362638513(a)server1.tristatelogic.com> > > > In message <51371EFA.3030502(a)heanet.ie>, > Brian Nisbet <brian.nisbet(a)heanet.ie> wrote: > > >> P.S. I am still not sure if any other things that drew me to this mailing > >> list, or to this WG, or that I have reported here, over time, are or are > >> not considered abuse. (And by that I mean "formally" considered.) > > > >I certainly believe they are, everyone else seems largely to agree > > Then why hasn't anything been done? > > I reported a set of blatantly, provably, outrageously fradulent networks > here over six weeks ago now. As far as I can tell, they are all still > on the books (in the RIPE data base) and all still operating with total > and utter impunity... still announcing routes to innumerable IPv4 blocks > registered to innumerable utterly fradulent and fictitious entities, all > of which were transparently and deliberately created, out of whole cloth, > by a single party or entity, entirely and only as a ruse to trick RIPE NCC > out of huge quantities of IPv4 addresses so that those could then be sub- > leased to several different snowshoe spammers. (None of this is speculation. > I have the evidence that clearly supports every charge I've just made, and > would have provided it to anyone who asked, but apparently nobody, either > here or elsewhere, gives or gave enough of a damn to even ask to see any > of it.) > > RIPE NCC knows all about this stuff, and they haven't lifted a finger > in over six weeks to do squat about any of it. And I daresay that it > now seems abundantly likely that we will see action out of the College > of Cardinals in Rome long before we see any out of RIPE NCC on this issue. > > Personally, I think this indefensible and abject inaction makes a mockery > of you, me, this working group, the Internet as a whole, and every person > who, like me, has invested even a moment of their time, effort, or intellectual > abilities to try to ferret out and then report these kinds of outrageously > crooked operations to ``responsible authorities''... and I use the term > loosely. I mean what's the point? I could have more profitably invested > my time and energy in rearranging the contents of my sock drawer. (And I > doubt that this point will be lost on any others who might likewise be > tempted to work to make the Internet a better place for all. Why bother? > It won't be appreciated and more to the point, it won't have any effect.) > > I see only two possibilities. Either what I reported is not actually and > formally considered to be ``abuse'', or else _rectifying_ ``abuse'', even > of the most blatant, fradulent, wasteful, and destructive kind, is now > provably not on anybody's official TO-DO, list. You claim that it is > not the former. If it is the latter, then all activities of this working > group, past, present, and future, may, in my opinion, rightfully be derided > as being nothing more than exercises in mental masturbation and bureaucratic > mumbo jumbo yielding absolutely nothing of value. > > If the point of this WG is merely to _talk_ about network abuse, then I'm > confident that it will go down in the history books as having been a great > success. > > >so we're good. > > Speak for yourself please. > > To quote the Lone Ranger's trusty (American-)Indian sidekick Tonto ``What > do you mean WE kimo sabe?'' > > > > > ------------------------------ > > Message: 2 > Date: Wed, 06 Mar 2013 22:51:08 -0800 > From: "Ronald F. Guilmette" <rfg(a)tristatelogic.com> > Subject: Re: [anti-abuse-wg] Draft Anti-Abuse WG Agenda - RIPE 66 > To: anti-abuse-wg(a)ripe.net > Message-ID: <55540.1362639068(a)server1.tristatelogic.com> > > > In message <51372538.60604(a)hovland.cx>, > =?ISO-8859-1?Q?J=F8rgen_Hovland?= <jorgen(a)hovland.cx> wrote: > > > On 03/06/13 11:48, Brian Nisbet wrote: > >> Ronald, > >> Ronald F. Guilmette wrote the following on 05/03/2013 20:36: > >>> I'd like to just reiterate my view that all other activities of this WG > >>> will be utterly fruitless until such time as a reasonable, rational, and > >>> generally accepted definition of "abuse" is in hand. > >> > >> I genuinely don't think it will be useful to spend time on this. I > >> think an attempt to get a consensual definition of abuse would take > >> the whole of the session in Dublin and every session thereafter and > >> after all that time, I still don't think we would have got anywhere. > >> If the rest of the WG disagrees with me, then we can raise it, but if > >> n = the number of people in the WG, I fear we would have n + 1 > >> definitions. > > > >I am pretty sure it will take until the end of the world to agree on a > >definition. Perhaps even longer. > > > "And when the broken hearted people, living in the world agree, > there will be an answer, let it be." > -- Paul McCartney > > > > > End of anti-abuse-wg Digest, Vol 19, Issue 5 > ********************************************

2 1

Draft Anti-Abuse WG Agenda - RIPE 66
by Brian Nisbet 07 Mar '13

07 Mar '13

Colleagues, This is the draft agenda for the RIPE 66 meeting. The WG session will take place on Thursday 16th May at 14:00 BST. RIPE 66 will be taking place in the Burlington Hotel, Dublin. There is still possibly some room on the agenda for the session for something small, so if you have any matters you'd like to discuss, please let Tobias & I know. A. Administrative Matters * Welcome * Scribe, Jabber, Stenography * Microphone Etiquette * Approve Minutes from RIPE 65 * Finalise agenda B. Update * B1. Recent List Discussion * B2. CleanIT Project Close-Off * B3. AA-WG Charter C. Policies * RIPE Policy 2011-06 * RIPE Policy Proposal 2013-01 D. Interactions * D1. Working Groups * D3. RIPE NCC Gov/LEA Interactions Update E. Presentation * E1. "Save money online without killing yourself" - Michele Neylon & ASOP * E2. x-arf - Tobias Knecht X. A.O.B. Z. Agenda for RIPE 67

3 5

What am I missing in this mnt-by query for MNT-ANONYMOUS?
by Suresh Ramasubramanian 06 Mar '13

06 Mar '13

inetnum: 37.114.49.0 - 37.114.49.255 netname: DE-NETWORK-ABUSE-3706 descr: Network-Abuse.info country: DE admin-c: HA2568-RIPE tech-c: HA2568-RIPE status: ASSIGNED PA mnt-by: MNT-INTERCOLO mnt-by: MNT-WEESLY source: RIPE # Filtered % Information related to 'HA2568-RIPE' person: Holger Anonymous address: Please contact us by E-Mail phone: +49.180.4100100 abuse-mailbox: abuse(a)network-abuse.info remarks: ******************************************* remarks: * SPAM / ABUSE / SECURITY / OTHERS * remarks: ******************************************* remarks: * For spam/abuse/security issues please * remarks: * contact : abuse(a)network-abuse.info * remarks: ******************************************* remarks: * For other information or issues please * remarks: * sent to abuse(a)network-abuse.info * remarks: ******************************************* nic-hdl: HA2568-RIPE mnt-by: MNT-ANONYMOUS source: RIPE # Filtered and network-abuse.info is domain clocked on godaddy - Domain Name:NETWORK-ABUSE.INFO Created On:19-Sep-2011 12:28:46 UTC Last Updated On:21-Jun-2012 09:56:51 UTC Expiration Date:19-Sep-2013 12:28:46 UTC Now for what I wanted to ask. A RIPE query from the command line doesnt show anything. suresh@oc2751464200 22:27:52 <~> $ whois -h whois.ripe.net -i mnt-by MNT-ANONYMOUS [Querying whois.ripe.net] [whois.ripe.net] %ERROR:101: no entries found % % No entries found in source RIPE. But he has at least two other interesting (to a postmaster for a large email service, hint, hint) netblocks this guy has - 37.114.43.0/24 37.114.45.0/24 Doing a RIPE full text search does get me these and other netblocks inetnum: 89.144.17.0 - 89.144.18.255 mnt-by=MNT-WEESLY ISP4P-MNT MNT-ANONYMOUS inetnum: 185.10.68.0 - 185.10.69.255 mnt-by=MNT-ANONYMOUS inetnum: 185.10.70.0 - 185.10.70.255 mnt-by=MNT-ANONYMOUS inetnum: 185.10.71.128 - 185.10.71.159 mnt-by=MNT-ANONYMOUS inetnum: 185.10.71.160 - 185.10.71.167 mnt-by=MNT-ANONYMOUS inetnum: 185.10.71.192 - 185.10.71.255 mnt-by=MNT-ANONYMOUS mntner: MNT-ANONYMOUS mnt-by=MNT-ANONYMOUS, referral-by=MNT-ANONYMOUS, mntner=MNT-ANONYMOUS route: 185.10.68.0/22AS198599 mnt-by=MNT-ANONYMOUS route: 37.114.43.0/24AS5577 mnt-by=MNT-ANONYMOUS ROOT-MNT route: 37.114.45.0/24AS198599 mnt-by=MNT-ANONYMOUS route: 37.114.46.0/24AS198599 mnt-by=MNT-ANONYMOUS route: 37.114.47.0/24AS198599 mnt-by=MNT-ANONYMOUS route: 37.114.48.0/24AS198599 mnt-by=MNT-ANONYMOUS route: 37.114.49.0/24AS198599 mnt-by=MNT-ANONYMOUS route: 37.114.51.0/24AS198599 mnt-by=MNT-ANONYMOUS -- Suresh Ramasubramanian (ops.lists(a)gmail.com)

6 8

Re: [anti-abuse-wg] What am I missing in this mnt-by query for MNT-ANONYMOUS?
by Karl-Josef Ziegler 05 Mar '13

05 Mar '13

1 0

Allocation of number resources
by Ronald F. Guilmette 01 Mar '13

01 Mar '13

Assume for the moment that there exists a provider, within the RIPE region, that has been allocated a sizeable IPv4 block. Let's say a /17, just for the sake of argument. Assume that this allocation was made to the provider, by RIPE NCC, some long time ago... Let's say early 2011. I would like to know the following things. If someone can answer these questions, please do: (1) What would have been the requirements, at that time (early 2011) that the provider would have had to meet in order to be allocated the /17 in question by RIPE NCC staff? (In the ARIN region, for IPv4 allocations there has been for some time various requirements in place that say that the provider being issued the address block must have some certain amount of hardware infrastructure in place in order to qualify for the allocation. Does RIPE have any similar rules? If so, then what are the rules, when did they go into effect, and what exactly does RIPE NCC staff do in order to actually enforce those rules, i.e. _prior_ to awarding an allocation to a given provider?) (2) If there are indeed requirements along the lines above, then are those requirements only in effect during and at the time of the initial allocation? Or is the provider who has been awarded an alloction either asked or required to maintain some certain amount of hardware infra- structure corresponding to the IPv4 address block allocation that it was awarded? (3) If there are indeed ``maintenance'' requirements along the lines in (2) above, then has there ever been a single publically documented instance in which a provider's failure to maintain the minimum required hardware infrastructure dedicated to some given IP address block allocation has caused the RIPE NCC to actually revoke the address block allocation in question? Regards, rfg

11 32

where do i report fraudulent AS?
by kai 21 Feb '13

21 Feb '13

Hello, where should I report fraudulent AS(Autonomous Systems), which are announcing mainly cybercriminal hosting subnetworks? sorry if i'm posting to wrong maillist. Cheers, Kai

2 1

Re: [anti-abuse-wg] New on RIPE Labs: Finding Abuse Contact Information Using RIPEstat
by Michele Neylon :: Blacknight 21 Feb '13

21 Feb '13

Mirjam Handy tool Question - how do you arrive at the rating? Checking some of our IPs we get 3 out of 4 stars, so I'm curious why :) Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting & Colocation, Brand Protection http://www.blacknight.com/ http://blog.blacknight.com/ http://mneylon.tel/ Intl. +353 (0) 59 9183072 Locall: 1850 929 929 Direct Dial: +353 (0)59 9183090 Fax. +353 (0) 1 4811 763 Twitter: http://twitter.com/mneylon ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,Ireland Company No.: 370845 ________________________________________ From: anti-abuse-wg-bounces(a)ripe.net [anti-abuse-wg-bounces(a)ripe.net] on behalf of Mirjam Kuehne [mir(a)ripe.net] Sent: 19 February 2013 14:36 To: anti-abuse-wg(a)ripe.net Subject: [anti-abuse-wg] New on RIPE Labs: Finding Abuse Contact Information Using RIPEstat [apologies for duplicates] Dear colleagues, We implemented a new widget in RIPEstat that allows you to find abuse contact information registered in the RIPE Database. Please find more information on RIPE Labs: https://labs.ripe.net/Members/cteusche/finding-anti-abuse-contact-informati… Kind regards, Mirjam Kuehne RIPE NCC

3 2

2013-01 New Policy Proposal (Openness about Policy Violations)
by Brückner, Carsten (BIT A 5) 19 Feb '13

19 Feb '13

To prevent abuse and to give the holder a fair chance to resolve any policy violation before the report is published there has to be a time for a reply of four weeks. If the holder has resolved all problems before expiration of the deadline, the report is not published. Best regards Carsten Brückner

1 0

New on RIPE Labs: Finding Abuse Contact Information Using RIPEstat
by Mirjam Kuehne 19 Feb '13

19 Feb '13

[apologies for duplicates] Dear colleagues, We implemented a new widget in RIPEstat that allows you to find abuse contact information registered in the RIPE Database. Please find more information on RIPE Labs: https://labs.ripe.net/Members/cteusche/finding-anti-abuse-contact-informati… Kind regards, Mirjam Kuehne RIPE NCC

1 0

Re: [anti-abuse-wg] [ncc-services-wg] Fwd: 2013-01 New Policy Proposal (Openness about Policy Violations)
by Sascha Luck 18 Feb '13

18 Feb '13

On Fri, Feb 15, 2013 at 11:38:36AM +0000, Brian Nisbet wrote: >The following policy '2013-01 Openness about Policy Violations' >started it's trip through the PDP yesterday. While the discussions on >this proposal will take place in the Anti-Abuse working group, I just >wanted to make sure this WG was aware as there are obvious >implications for NCC processes & procedures. Utterly and completely unacceptable. The proposal, in its current form, is akin to the police publishing every complaint they receive, with full details of the subject of the complaint, whether justified or not. I also note that is "The identity of the submitter, if the submitter indicated that it can be made public;" No such protection is afforded the subject of the complaint. This proposal is nothing but a denunciant's charter, the legality of which is doubtful (NCC Legal please to comment). The idea that publishing these reports makes abuse of the reporting system less likely - where the attack *is* the publishing of these reports - is laughable. I therefore register my vehement opposition and, indeed, protest against this proposal in its current form. As a possible compromise, I could accept the publication of reports where the NCC has found that a violation was indeed committed. Regards, Sascha Luck

6 14