- anti-abuse-wg - mailman.ripe.net

hosting with anonymous whois
by Karl-Josef Ziegler 14 Jan '13

14 Jan '13

Hello! Today I go a spam for pillz (CAPRXPHARMACY.RU) 'hosted' at IP 84.22.104.117. This IP is of course listed at Spamhaus: http://www.spamhaus.org/sbl/query/SBL99505 http://www.spamhaus.org/sbl/query/SBL99505 and this 'hoster' has a very long list (118 entries) at Spamhaus: http://www.spamhaus.org/sbl/listings/cb3rob.net and is on place no. 1 at Spamhaus: http://www.spamhaus.org/statistics/networks/ Whois says: address: Customer did not enter their own contact details yet A research says: Ministry of Telecommunications, One CyberBunker Avenue CB-10000 CyberBunker-1 Republic CyberBunker C/O CB3ROB LLTC. Company reg. #8 CyberBunker trade register. One CyberBunker Avenue CB-10000 CyberBunker-1 Republic CyberBunker So is it really possible to get an IP block with anonymous whois entries at RIPE? Best regards, - Karl-Josef Ziegler

3 2

Update - RIPE Database Proxy Service Issues
by Axel Pawlik 04 Jan '13

04 Jan '13

[Apologies for duplicate emails] Dear colleagues, Thank you for your comments on this issue. I would like to point out that the *DRAFT* Activity Plan and Budget is published around September of each year, allowing members ample time to read it before it is discussed at the Autumn General Meeting. The RIPE NCC Executive Board then takes the outcome of the discussions and any new developments into consideration before finalising and approving the definitive Activity Plan and Budget, which is then published before the end of the year. On 13 December 2012, we informed the membership of the definitive Activity Plan and Budget and listed the changes from the draft plan. Please note that the membership does not vote on either the draft or the final Activity Plan and Budget - this is one of the member-elected Executive Board's functions. One of the modifications that took place from the draft to the final Activity Plan was the addition of the RIPE Database Proxy Service as a member-only service. This was a follow-up on an action point that stemmed from the Data Protection Task Force and a need to strengthen our contractual relationship between the current users of the RIPE Database Proxy Service and the RIPE NCC ensuring compliance with Dutch and EU legislation. Partially based on the membership's vote of approval regarding the new Charging Scheme of "one LIR, one fee" and partially based on the fact that the RIPE Database Proxy Service is only actively used by less than a handful of entities (both members and non-members), the Executive Board made the decision, which they felt was in the members' interest, to ask the users of this service to sign both a specific RIPE Database Proxy Service Agreement and the Standard Service Agreement (Membership Agreement) that adheres to both EU and Dutch legislation, which would entail the users of this service paying the annual membership fee. Based on the recent mailing list discussions it seems apparent that this is a contentious issue that requires further membership and community discussion. Therefore, we will keep the RIPE Database Proxy Service running as it was in 2012 (i.e., no fee and no Membership Agreement) until we have completed these discussions. We will prepare a legal analysis of the options at hand for the contractual documentation required to use this service and gauge whether or not the membership feels that we should charge a fee for this service. Regards, Axel Pawlik Managing Director RIPE NCC

1 0

RIPE Database Proxy Service Issues
by Axel Pawlik 03 Jan '13

03 Jan '13

[Apologies for duplicate emails] Dear colleagues, There has been discussion on various mailing lists regarding the status of the RIPE Database Proxy Service. Before I address the issues that arose, I'd like to give you some background information on the service itself that may help with the discussions. Technical Background -------------------- To prevent the automatic harvesting of personal information (real names, email addresses, phone numbers) from the RIPE Database, there are PERSON and ROLE object query limits defined in the RIPE Database Acceptable Use Policy. This is set at 1,000 PERSON or ROLE objects per IP address per day. Queries that result in more than 1,000 objects with personal data being returned result in that IP address being blocked from carrying out queries for that day. Users of the RIPE Database have unlimited access to Network Information Centre (NIC)-related objects. They can use the -r flag in order to filter out personal objects and query NIC objects without any limitations. The RIPE Database Proxy Service allows websites to provide a third party interface to the RIPE Database. Without the proxy service, the third parties would quickly run into the limits set on RIPE Database queries. With the proxy service, we whitelist the third party IP address and ask them to pass their user's IP address to us, so limits are only set on the user's IP address, not the third party's. There is no technical way to ensure that the user IP addresses passed to us by the third party are valid. Potentially, third party users of the proxy service could harvest all personal data in the RIPE Database (approximately 2 million objects) in a matter of hours. To ensure that the RIPE NCC's Terms and Conditions are followed, we require a contract between the third party and the RIPE NCC. Users of the Proxy Service -------------------------- In the past ten years, the RIPE NCC has had 31 requests for the proxy service and over the past year, there have been only four active users of the service. Of these four, one is already a RIPE NCC member. NIC Information --------------- All NIC information is still available without access to the proxy service. In the normal presentation of whois data, there is a redirect system that allows users with a normal whois client to deal directly with the RIPE Database whois service. There is no need for a proxy service in this scenario. The proxy service is only necessary if the data needs to be presented in alternative forms, such as on a third party's website. The limits imposed on RIPE Database queries only apply to personal data. Users can always access NIC data in any form they like if they are happy not to receive personal data. On 6 March 2012, the RIPE NCC proposed to change the default behaviour of the query system to instead return only "ALLOWED" results if a user had reached their daily personal data query limit, but there was disagreement over this on the mailing list so the change was not implemented. The proposal is available at: http://www.ripe.net/ripe/mail/archives/db-wg/2012-March/003885.html Legal Considerations -------------------- The RIPE NCC operates under European Data Protection laws, so to avoid risk in this area we insist on having a contract with third parties who wish to use the proxy service. The RIPE NCC and its Executive Board believes that the proxy service should become a member service because it tightens the contractual relationship between the RIPE NCC and third parties. Currently, no such agreement that meets the EU Data Protection legislation is in place between the RIPE NCC and the proxy service users. In order to tighten the contractual relationship between the RIPE NCC and the Proxy service users, taking into account the recent approval of the Charging Scheme 2013 that caused a simplification of the contractual agreements between the RIPE NCC and its service users, the RIPE NCC offered to conclude the membership agreement for continuation of the service. Next Steps? ------------ The Executive Board approved changes to the draft version of the Activity Plan and Budget 2013, and the RIPE NCC published the final version on 13 December 2012: http://www.ripe.net/internet-coordination/news/announcements/ripe-ncc-activ… We do apologise, however, that the changes regarding the proxy service were not more explicitly communicated to the members and the RIPE community in advance of the final publication of the Activity Plan. The RIPE NCC asks that non-RIPE NCC member proxy service users become members but we propose to waive their membership fee until the discussion of the RIPE NCC Charging Scheme 2014 takes place. This will give the membership and community the opportunity to discuss the best way forward for the proxy service in the coming months while ensuring a strong contractual bond between the RIPE NCC and users of this service. In the meantime, there will be no changes to the proxy service and no loss of functionality for the community. The RIPE NCC and its Executive Board will return to its members with proposals for ways to ensure that their wishes are met with regard to service developments while allowing the RIPE NCC to be operate efficiently and responsively. If you have any comments on this issue, please direct them to the RIPE NCC Services Working Group mailing list <ncc-services-wg(a)ripe.net>. Best regards, Axel Pawlik Managing Director RIPE NCC

5 7

Fwd: GeekTools Whois Proxy and RIPE/RIPE-NCC
by Suresh Ramasubramanian 02 Jan '13

02 Jan '13

Bad move. I find geektools very useful for abuse mitigation and it is my hope that this is reconsidered Happy New Year --srs (htc one x) ---------- Forwarded message ---------- From: "Rodney Joffe" <rjoffe(a)centergate.com> Date: 31-Dec-2012 9:15 PM Subject: GeekTools Whois Proxy and RIPE/RIPE-NCC To: <nanog(a)nanog.org> Cc: NANOG and ARIN Friends, 14 Years ago, at the suggestion of Jon Postel and some of the early participants in NANOG, we developed the GeekTools Whois proxy to make it easier for *us* - network security and abuse techs - to deal with the expanding number of gtlds and registrars and the varied whois servers that were appearing. The service had both a CLI and web interface. The service also led directly to the creation of whois-servers.net, which now seems to be part of a number of *nix distributions. The service has been up for 14 years, and over that time we have fulfilled the requirements of all of the whois server operators in regards to minimizing and stopping abuse of the GT whois proxy by domain scrapers, spammers, etc, while enabling the security folks to do their jobs. In some cases we have even written code to pass the ip address of the requestor to the whois server registry operator when they wanted to manage quota's directly. We think we have a really good relationship with all of the whois server operators, and I think we provide a useful service to the community, and is widely used. And in 14 years we have never been tarred as an enabler of abuse of "the whois" system. There has obviously never been any kind of charge or fee for using the proxy, or any of the other tools on GeekTools. In about 2002 we started placing a banner ad on the web interface page to offset some of the costs for the bandwidth that the proxy consumes. An average of about $70 a month for over the last 10 years. Actual bandwidth costs are higher than that of course, but it was a thought in 2002 that we had frankly forgotten about until recently. Two weeks ago RIPE-NCC, who provide the whois data for IP addresses in the RIPE region, informed us that based on decisions by their members, as of January 1st 2013, tomorrow, they would no longer provide whois proxy query response services to GeekTools unless we ponied up $1,800 a year for RIPE membership. I don't work very well above layer 7. It is what it is. So I wanted to let you know that as of midnight tonight, apparently, you won't be able to use GeekTools for RIPE related queries. If you have automated scripts, and you are one of the users who has expanded access to GeekTools, you'll need to find an alternative for RIPE queries *today*. My guess is that you will be able to query RIPE directly, once you have worked out that the address space is within RIPE's assignments. I think its wrong to have to pay for whois data that is part of a community resource . So I won't do it.

2 1

RIPE NCC's proposed implementation of Abuse Contact Management in the RIPE Database
by Kaveh Ranjbar 13 Dec '12

13 Dec '12

Dear Colleagues, The RIPE NCC's proposed implementation plan of RIPE policy 563 (policy proposal 2011-06) titled "Abuse Contact Management in the RIPE Database" is as follows: =========== Introduction =========== Abuse Contact Management in the RIPE Database (as defined in RIPE policy document 563) mandates the RIPE NCC to gather and publish abuse contact information for Internet resources provisioned by the RIPE NCC. =========== Approach =========== Abuse handling is generally a role within an organisation and the RIPE NCC is planning to model this relation in the RIPE Database. So the "abuse-c:" attribute will be available in the ORGANISATION object and should reference a ROLE object. When a ROLE object is referenced from an ORGANISATION object by the "abuse-c:" attribute, it must have an "abuse-mailbox:" attribute. All resources allocated or assigned by the RIPE NCC are required to have a reference to an ORGANISATION object in the RIPE Database. By adding a single "abuse-c:" attribute to their ORGANISATION object, a resource holder can quickly cover all their resources. All resources that are allocated or assigned by the RIPE NCC and which are subject to and compliant with current resource policies will then either directly reference an abuse contact or will inherit one from the parent resource. The detailed changes to RIPE Database objects and business rules, fine tuning, search options and facilities for quick data entry by RIPE NCC members using the LIR Portal are all described in an article on RIPE Labs: https://labs.ripe.net/Members/kranjbar/implementation-details-of-policy-201… ============ Timeline ============ * Phase 0 - Q1 2013 The RIPE NCC will make internal changes to the RIPE Database and LIR Portal, this should be done by end of Q1 2013. * Phase 1 - Q2 and Q3 2013 The RIPE NCC will ask members to add "abuse-c:" to their member ORGANISATION object at least and will conduct a follow-up on that. RIPE NCC Members will be required to have abuse contact data for their resources when working with our Registration Services department. If a member has not added abuse-c:" to their ORGANISATION object by the end of this phase, the RIPE NCC will automatically add the member's published contact email address as the member's abuse contact. Members can edit this information any time through the LIR Portal. At the end of this phase, all PA allocations and their more specifics will have an abuse contact. * Phase 2 - Q4 2013 to Q3 2014 The RIPE NCC will ask AS Number and PI Resource holders to add abuse contact information to their ORGANISATION objects. If some resource holders have not added their abuse contact data by the end of this phase, the RIPE NCC will add the published abuse contact data for the responsible LIR to the ORGANISATION object listed in the resource. Any resource holder with access to the related object can always edit this information. At this point, ALL resources in the RIPE Database which are subject to and compliant with RIPE policies will have accessible abuse contact information. Please let us know if you like this proposal or have any feedback or ideas for improvement of this implementation proposal. Regards, Kaveh Ranjbar, RIPE NCC Database Group Manager

10 22

Implementation of 2011-06
by Brian Nisbet 05 Dec '12

05 Dec '12

Colleagues, Hopefully by now you have all read the mail from the NCC Database Group regarding the implementation plan for Policy 2011-06 sent on the 15th of November 2012. The Co-Chairs of the Anti-Abuse and Database WGs have conferred and we feel that while there have been a few questions regarding this plan, these have been answered and there were no objections so consensus has been reached in this regard. With this support from the community in mind, the Co-Chairs have asked the NCC to begin work on this implementation and to keep both WGs updated on their progress. As always, if you have any questions, please do raise them on the mailing lists. Brian, On behalf of the Co-Chairs of the AA-WG & DB-WG

1 0

New on RIPE Labs: Link to Survey on Network Attack Detection and Mitigation
by Mirjam Kuehne 30 Nov '12

30 Nov '12

Dear colleagues, Please note the link to a survey on network attack detection and mitigation provided by the Biometrics and Internet Security Research Group at the University Darmstadt: https://labs.ripe.net/Members/mirjam/survey-on-network-attack-detection-and… The survey is open until 4 December. Kind regards, Mirjam Kuehne RIPE NCC

1 0

Re: [anti-abuse-wg] abuse-c implementation schedule
by Bengt Gördén 14 Nov '12

14 Nov '12

2012-11-14 13:37, Michele Neylon :: Blacknight skrev: > This is a working group not RIPE NCC customer service .. I know that . . . . . . . . . . My first question was asked in the working group because it is demonstrably in the interest of the working group. If I can not get an proper answer here, I will of course take it up with the NCC, but it is good manners to complete the discussion where you started it. > > On 12 Nov 2012, at 17:45, Bengt Gördén <bengan(a)bag.org> wrote: > >> 2012-10-22 17:59, Denis Walker skrev: >>> Dear Colleagues, >>> >>> The RIPE NCC is working on the implementation plan. It requires changes to the core RIPE Database as well as several tools, such as Webupdates and the LIR Portal, and then finally the Abuse Finder Tool. Also some internal processes managed by the Registration and Customer Services Departments need modifying to include a check that an "abuse-c:" has been provided by a resource holder when requesting services. >>> >>> The RIPE NCC expects to have the plan ready for publishing to the community by mid November 2012. >>> >> I sent almost the exact same mail, as the questioner of this thread, in response to Emilio Madaios mail "[anti-abuse-wg] 2011-06 Proposal Accepted (Abuse Contact Management in the RIPE NCC Database)" asking for an ETA for the implementation. It makes me really angry to be ignored by people I pay to get service. It's not the first time I've been treated like this. >> >> Bengt Gördén >> Resilans AB >> Paying customer to RIPE >> > Mr Michele Neylon > Blacknight Solutions ♞ > Hosting & Domains > ICANN Accredited Registrar > http://www.blacknight.co > http://blog.blacknight.com/ > Intl. +353 (0) 59 9183072 > US: 213-233-1612 > Locall: 1850 929 929 > Facebook: http://fb.me/blacknight > Twitter: http://twitter.com/mneylon > ------------------------------- > Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty > Road,Graiguecullen,Carlow,Ireland Company No.: 370845 >

1 0

abuse-c mandatory
by U.Mutlu 12 Nov '12

12 Nov '12

As everybody knows, the proposal "Abuse Contact Management in the RIPE NCC Database" has already been ratified/accepted more than a month ago, but still some RIPE workers seem not to know this fact: https://www.ripe.net/ripe/policies/proposals/2011-06 Authors: Tobias Knecht, abusix Proposal Version: 3.0 06 June 2012 Accepted: 17 September 2012 Working Group: Anti-Abuse Working Group Proposal type: New Policy term: Indefinite New RIPE Document: ripe-563 Under §1.0 it says "The "abuse-c:" will be mandatory for all aut-nums. Due the hierarchical nature of IP address objects, at least every direct allocated inetnum and inet6num needs to have an "abuse-c:". Inherited objects might have their own "abuse-c:" attribute or they will be covered by the higher level objects. " Today I got the following reply from RIPE (I removed the name of the sender with XXX, but can give it if required). Why is this person at RIPE still saying this: "At this moment is the 'abuse-c' not yet a mandatory field. There is currently a discussion on our mailing list in order to make this a mandatory field, but this policy proposal is still under discussion." ??? An official from RIPE please explain to the community what this RIPE person means with such a statement...: -------- Original Message -------- Subject: Re: NCC#2012103209 abuse-c for inetnum 84.200.75.0 - 84.200.75.127 missing Date: Mon, 22 Oct 2012 08:32:35 +0200 From: RIPE NCC <ncc(a)ripe.net> Reply-To: RIPE NCC <ncc(a)ripe.net> To: U.Mutlu <security(a)mutluit.com> Dear madam/sir, Thank you for your e-mail. At this moment is the 'abuse-c' not yet a mandatory field. There is currently a discussion on our mailing list in order to make this a mandatory field, but this policy proposal is still under discussion. You can find the contact details that we have on file at: http://apps.db.ripe.net/whois/lookup/ripe/person-role/ACC-RIPE.html And: https://apps.db.ripe.net/whois/lookup/ripe/mntner/IWERK-MNT.html -- If you have any questions, please feel free to contact us. Best regards, XXXXXXX XXXXXXXXXXX Customer Services RIPE NCC ============================================================ RIPE NCC Customer Satisfaction Survey Tell us about your customer services experience by filling out the anonymous, one-minute RIPE NCC customer satisfaction survey: https://www.ripe.net/contact/survey/satisfaction-cs/ ============================================================ On Sat, 20 Oct 2012 14:20:19 +0200, U.Mutlu wrote: > Hello, > this is to inform you that the "abuse-c" entry for inetnum 84.200.75.0 - 84.200.75.127 > is missing in the RIPE WHOIS database. > > Regards, > U.Mutlu > security(a)mutluit.com

10 9

RIPE NCC Data Protection Report published
by Axel Pawlik 05 Nov '12

05 Nov '12

Dear colleagues, To comply with Dutch data protection legislation regarding personal data, the RIPE NCC has developed a legal framework that guarantees the proper and lawful use of personal data. This framework has been established in cooperation with the RIPE community through a task force created for this purpose, the RIPE Data Protection Task Force (DPTF). Recent discussion on this list has suggested that a clear overview of the legal background to the framework and procedures proposed by the DPTF may promote better community understanding of the RIPE Database rules and the justification for them. In the interests of transparency and understanding, the RIPE NCC has produced a report that provides the legal background to the framework and procedures relating to personal data in the RIPE Database and other RIPE NCC services. The RIPE NCC Data Protection Report is available at: https://www.ripe.net/lir-services/ncc/legal/ripe-ncc-data-protection-report The RIPE NCC Data Protection Report was presented to the community at RIPE 65 in October 2012. The presentation can be viewed at: https://ripe65.ripe.net/archives/video/137/ Kind regards, Axel Pawlik Managing Director RIPE NCC

1 0