- anti-abuse-wg - mailman.ripe.net

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 7, Issue 18
by Karl-Josef Ziegler 29 Mar '12

29 Mar '12

> You seem to require something else. Maybe, some sort of 'Criminal Records Bureau check'? Best regards, - Karl-Josef Ziegler

1 0

Contact for 91.211.88.29
by Everett, Alex D 29 Mar '12

29 Mar '12

All: I joined this group as some percentage of the time (30% or so) I am unable to contact an organization to report abuse. I feel that if we see a problem, it behooves us to reach out and let others know. I know that when my organization is hosting malicious content, we want to know. What prompted me to join was this issue occurring multiple times, sending emails to abuse(a)ripe.net, and no resolution. The latest example was from March 15th, for a web server serving malware at 91.211.88.29. Does anyone have any way to contact this organization other than the email addresses below (which fail)? To: "noc(a)bigus-net.com" <noc(a)bigus-net.com> Cc: "constructelectro(a)mail.ru" <constructelectro(a)mail.ru> Subject: Abuse from 91.211.88.29 Sincerely, Alex Everett, CISSP, CCNA University of North Carolina Chapel Hill, NC, USA

4 6

Re: [anti-abuse-wg] National PSDN "UZPAK"
by Joe St Sauver 29 Mar '12

29 Mar '12

Fearghas commented: #You miss the point - there are many different kinds of commercial organisation #structures that are not Limited/PLC/Limited by Guarantee companies that can #hold LIR assets and be members. Why should I be a Limited/PLC/Limited by #Guarantee company just to hold LIR membership or an ASN/PA/PI/etc space ? There is precedent for the legal organization of an entity to be scrutinized as part of the process of trusting that entity. One example that comes to mind is the vetting that takes place for Extended Validation SSL certificates under norms established by the Certificate and Browser Forum, see: http://www.cabforum.org/vetting.html Or consider requests for proposal that may require prequalification of potential bidders as responsible bidders able to actually undertake and complete the work that's being bid -- again, that sort of vetting is often far easier for a corporation than for a sole proprietorship or a partnership, etc. Public corporations have important properties that typically include transparency, verifiability, and accountability, although obviously we can all find counter examples from recent practice in any given economy :-; Regards, Joe

2 1

Re: [anti-abuse-wg] Enabling community self-help?
by Joe St Sauver 29 Mar '12

29 Mar '12

Suresh commented: #Eh. The term itself originated because capone set up a chain of laundries #which earned him lots of profits, to account for all the money he was #raking in from bootleg booze If folks want to understand the topic of modern money laundering, by far the best publicly available treatment of this topic that I've seen is the 2005 US Money Laundering Threat Assessment, 81 pages, available online at http://www.treasury.gov/resource-center/terrorist-illicit-finance/Documents… Regards, Joe

1 0

Enough is enoug
by info＠dhn.li 29 Mar '12

29 Mar '12

Dear sirs, i need help on people that every day try to hack our server for example this is just for to days log from fail2ban i made maximum try count 4 and 600 sec. than thay try later 600 sec again non stop please take control who they are and why they try endles, least 6 months our server IP 85.10.198.87 2012-03-08 11:40:24,591 fail2ban.actions: WARNING [ssh] Ban 61.188.179.27 2012-03-08 11:50:25,251 fail2ban.actions: WARNING [ssh] Unban 61.188.179.27 2012-03-08 12:24:17,438 fail2ban.actions: WARNING [ssh] Ban 175.45.42.26 2012-03-08 12:34:18,155 fail2ban.actions: WARNING [ssh] Unban 175.45.42.26 2012-03-08 16:05:56,897 fail2ban.actions: WARNING [ssh] Ban 80.13.90.126 2012-03-08 16:15:56,881 fail2ban.actions: WARNING [ssh] Unban 80.13.90.126 2012-03-08 16:18:51,182 fail2ban.actions: WARNING [ssh] Ban 80.13.90.126 2012-03-08 16:28:51,845 fail2ban.actions: WARNING [ssh] Unban 80.13.90.126 2012-03-08 16:31:53,052 fail2ban.actions: WARNING [ssh] Ban 80.13.90.126 2012-03-08 16:41:53,736 fail2ban.actions: WARNING [ssh] Unban 80.13.90.126 2012-03-08 16:44:58,987 fail2ban.actions: WARNING [ssh] Ban 80.13.90.126 2012-03-08 16:48:46,242 fail2ban.actions: WARNING [ssh] Ban 123.200.5.67 2012-03-08 16:54:59,662 fail2ban.actions: WARNING [ssh] Unban 80.13.90.126 2012-03-08 16:58:46,919 fail2ban.actions: WARNING [ssh] Unban 123.200.5.67 2012-03-08 17:07:23,488 fail2ban.actions: WARNING [ssh] Ban 80.13.90.126 2012-03-08 17:17:24,140 fail2ban.actions: WARNING [ssh] Unban 80.13.90.126 2012-03-08 17:19:59,319 fail2ban.actions: WARNING [ssh] Ban 80.13.90.126 2012-03-08 17:29:59,976 fail2ban.actions: WARNING [ssh] Unban 80.13.90.126 2012-03-08 17:36:36,416 fail2ban.actions: WARNING [ssh] Ban 80.13.90.126 2012-03-08 17:44:06,913 fail2ban.actions: WARNING [ssh] Ban 108.15.99.40 2012-03-08 17:46:37,111 fail2ban.actions: WARNING [ssh] Unban 80.13.90.126 2012-03-08 17:54:07,614 fail2ban.actions: WARNING [ssh] Unban 108.15.99.40 2012-03-08 18:14:54,932 fail2ban.actions: WARNING [ssh] Ban 80.13.90.126 2012-03-08 18:24:55,634 fail2ban.actions: WARNING [ssh] Unban 80.13.90.126 2012-03-08 18:32:08,092 fail2ban.actions: WARNING [ssh] Ban 175.45.42.26 2012-03-08 18:41:24,809 fail2ban.actions: WARNING [ssh] Ban 80.13.90.126 2012-03-08 18:42:08,870 fail2ban.actions: WARNING [ssh] Unban 175.45.42.26 2012-03-08 18:51:25,466 fail2ban.actions: WARNING [ssh] Unban 80.13.90.126 2012-03-08 22:45:58,511 fail2ban.actions: WARNING [ssh] Ban 113.108.103.11 2012-03-08 22:55:59,386 fail2ban.actions: WARNING [ssh] Unban 113.108.103.11 2012-03-09 01:03:14,565 fail2ban.actions: WARNING [ssh] Ban 175.45.42.26 2012-03-09 01:13:15,311 fail2ban.actions: WARNING [ssh] Unban 175.45.42.26

10 19

weird ERX networks ?
by Frank Gadegast 27 Mar '12

27 Mar '12

Hi, we receive Spam from some networks we cannot find any whois record for. An example: 62.61.196.0 (we found about 1000 networks like this) ARINs whois says, its RIPE RIPEs whois says, its AFRINIC LACNIC also says, its AFRINIC but AFRINICs whois says, its "world-wide" ... So, where is this really allocated too and where can we we find a whois record for those networks ? Unallocated, but still in use from somebody ? Anybody an idea ? Here are the whois records: ARIN: NetRange: 62.0.0.0 - 62.255.255.255 CIDR: 62.0.0.0/8 OriginAS: NetName: RIPE-C3 NetHandle: NET-62-0-0-0-1 RIPE: inetnum: 62.61.192.0 - 62.61.255.255 org: ORG-AFNC1-RIPE netname: AFRINIC-NET-TRANSFERRED-20050223 descr: This network has been transferred to AFRINIC remarks: These IP addresses are assigned in the AFRINIC region. AFRINIC: inetnum: 0.0.0.0 - 255.255.255.255 netname: IANA-BLK descr: The whole IPv4 address space country: EU # Country is really world wide org: ORG-IANA1-AFRINIC Kind regards, Frank -- MOTD: "have you enabled SSL on a website or mailbox today ?" -- PHADE Software - PowerWeb http://www.powerweb.de Inh. Dipl.-Inform. Frank Gadegast mailto:frank@powerweb.de Schinkelstrasse 17 fon: +49 33200 52920 14558 Nuthetal OT Rehbruecke, Germany fax: +49 33200 52921 ======================================================================

6 7

Draft Agenda: RIPE 64 AA-WG Meeting
by Brian Nisbet 20 Mar '12

20 Mar '12

Colleagues, This is the first draft agenda for the AA-WG meeting at RIPE 64. The meeting will take place at 11:00 CEST on Thursday 19th April. There is still some room on the agenda if anyone would like to bring any items to the attention of the WG. Please let me know if this is the case - aa-wg-chairs(a)ripe.net A. Administrative Matters * Welcome * Scribe, Jabber, Stenography * Microphone Etiquette * Approve Minutes from RIPE 63 * Finalise agenda B. Update * B1. Recent List Discussion * B2. CleanIT Project C. Policies * RIPE Policy 2011-06 D. Interactions * D1. Working Groups * D3. RIPE NCC Gov/LEA Interactions Update X. A.O.B. Z. Agenda for RIPE 65

2 1

AA-WG RIPE 63 Minutes
by Brian Nisbet 23 Feb '12

23 Feb '12

Colleagues, Here are the minutes from the AA-WG meeting at RIPE 63. If you have any questions, objections or corrections, please let me know. Draft RIPE Anti-Abuse Working Group Minutes – RIPE 63 Tuesday, 1 November 2011, 16:00-17:30, Vienna Co-Chairs: Brian Nisbet and Tobias Knecht Scribe: Fergal Cunningham Chat Monitor: Ingrid Wijte A: Administrative Matters Welcome The Anti-Abuse Working Group Co-Chair Brian Nisbet opened the session and welcomed the attendees. He thanked the scribe, chat monitor and stenographers and then introduced his co-chair, Tobias Knecht. Approve Minutes from RIPE 62 Brian noted that there was an initial comment on the draft minutes from RIPE 62. He said some small amendments were made and the minutes were then approved. Finalise agenda There were no additions to the agenda. B. Update B1: Recent List Discussion Brian noted there was a lot of recent list discussion, not all of it constructive. He said reporting abuse to the RIPE NCC was a main issue and that it would be addressed later in this session with a presentation from the RIPE NCC. B2: Passive DNS – Joao Damas, ISC Joao Damas from ISC gave a presentation on passive DNS. The presentation is available at: http://ripe63.ripe.net/presentations/64-PassiveDNS-ISC-RIPE63.pdf Aaron Kaplan, CERT.at, said there were passive DNS installations in Estonia, Austria and Luxembourg. He said there was effort between them to have a common query interface for passive DNS databases and he asked Joao if he would be interested in participating. Joao said that sounded like a good idea and he would ask his colleague to contact Aaron. Aaron asked if Joao thought about the data collection as being sensitive from a data protection point of view. He thought there was no easy answer for this. Joao agreed and said he also had no answer for that. He said most of the queries so far were from people they know so there hasn’t so far been a need to perform much verification. B3. RIPE NCC Abuse Contact Procedures Laura Cobley, Customer Services Manager at the RIPE NCC, gave a presentation on the procedures used to report abuse to the RIPE NCC. Her presentation is available at: http://ripe63.ripe.net/presentations/112-lauracobley.pdf Michele Neylon, Blacknight, asked where he could find the webform to report abuse and how to report abuse in the absence of the webform. Laura said the webform was a proposal and was not available yet, and people could send their reports to abuse(a)ripe.net. She added that she would ensure this information would be available on the RIPE NCC website. Peter Koch, DENIC, asked if the RIPE NCC would scrutinise the person making the report. Laura said there would be scrutiny of the reporter but that anyone could make a report. She said there could be an email verification check used in combination with the webform. Peter asked if, in that case, people could make reports with an anonymised name as long as they had a valid email address. Laura said there were no plans to keep track of identities but that there did need to be a way to communicate with the reporter. Sascha Luck, Cork Internet Exchange, asked if it would be better to have the webform available from the LIR Portal to prevent such things as DDoS attacks. Laura said this would limit it to only RIPE NCC members. Brian agreed with this and said he would not want it to be available only to members. Kaveh Ranjbar, Database Manager at the RIPE NCC, said that there is a list of email contacts, including abuse(a)ripe.net, on the RIPE NCC website. He said there is also a simple webform for contact the RIPE NCC although this does not contain all the options presented by Laura. Wilfried Woeber, Vienna Univerity/ACOnet, said he did not object to webforms but said there should be some safeguards to ensure that the identity of the person is verifiable and that the complaints are genuine. Wilfried added that many people used email and ticketing systems and it would be a good idea to consider this. Tobias Knecht, Abusix, said that there are email formats that can be set up to hold the same information as a webform and can be partly automated. He said he would send Laura information on these formats. Laura thanked Tobias and noted that the format has not been finalised so it would be good to get that information from Tobias. Brian asked what would happen to abuse(a)ripe.net when the webform became available. Laura said that the address is used for a range of issues and that it would remain available. Brian asked when the webform might become available. Laura said she did not have an exact date yet and the RIPE NCC was still gathering feedback. She said she hoped to be able to establish a production timeline soon after the RIPE 63 Meeting. B4. Hosters v Malware: Tools & Best Practice Michele Neylon, Blacknight, gave a presentation on tools and best practices from a hosting provider’s point of view. The presentation is available at: http://ripe63.ripe.net/presentations/70-blacknight-ripe-vienna.pdf During the presentation, Michele asked for a show of hands on the following questions: • Who is involved with hosting in some way? • Who provides dial-up or DSL-type services? • Who deals with abuse reports on a daily basis? • Are you taking proactive measures to deal with the abuse reports? Several people raised their hands for all these questions. There were no questions for Michele from the floor. C. Policies C1: Abuse Contact Management Task Force Brian said the Abuse Contact Management Task Force was formed after the RIPE 61 Meeting. He said there were a number of policies proposed there and the task force was formed with the intention of combining common issues from a number of those policies. He noted that the task force concentrated on abuse contact management issues. Tobias gave an update on the work of the task force. He said they were close to making a proposal that addresses most of the issues seen. He said the proposal would include a request for an abuse-c contact in RIPE Database objects that is like the admin-c contact. He said the task force wants to ensure that everything is done in a way that makes life easy for maintainers. He said he hoped that the proposal could be published well in advance of the RIPE 64 Meeting. Brian said he didn’t want to have a discussion on the proposal until it was issued. He said that Policy Proposal 2011-06 would pass through the Policy Development Process and hopefully consensus would be reached. He said they would then determine whether the task force should continue or be discontinued. He said information on the task force is published on the Anti-Abuse Working Group webpages. He said the task force would work on the proposal together with the RIPE Database Working Group. He concluded by asking that people give a clear opinion on the proposal on the Anti-Abuse mailing list when it is posted. D. Interactions D1. Working Groups Brian said there would be interaction with the RIPE Database Working Group, as noted in agenda point C1. D3. RIPE NCC Gov/LEA Interactions Update Brian noted that legal enforcement agencies (LEAs) and governments are becoming more aware of how people are using the Internet. He said the RIPE NCC has done an excellent job of getting LEAs around table and there has been a noticeably more collegiate atmosphere between representatives of LEAs and the Internet community of late. He said LEAs have not been as visible lately because they better understanding of the work of the RIPE community and are concentrating on other things at the moment. Brian said he went to Europol with Jochem de Ruig and Marco Hogewoning from the RIPE NCC to talk about security issues. They have started to look at training investigators on IPv6 issues. He said there was also a Cyber Crime Working Party (CCWP) meeting in Paris the week before the RIPE 63 Meeting. Brian said RIPE community representatives would go to the SOCA meeting in London in March 2012 to maintain that relationship. He also noted that governments have some ideas on web filtering but they are trying to steer them in the right direction where possible. Aaron Kaplan, CERT.at, asked if anyone thought about collecting statistics from each country on IRT object entries. Wilfried Woeber, RIPE Database Working Group Co-Chair, he thought the Anti-Abuse Policy Proposal should be set in motion first to see what then happens. Brian reiterated that the proposal would go into the PDP as soon as possible. Michele Neylon, Blacknight, said that a problem LEAs had was that registrars were slow to have something official available for the LEAs. He recommended that this group learn from that lesson. Sasha Luck, Cork Internet Exchange, asked if the content of the discussion with LEAs would be published anywhere. Brian said that the discussions are usually confidential but it was agreed with that people involved with the CCWP could report back to their communities on the issues were discussed. Wilfried said that he has seen LEAs become more involved with Internet number resource issues. He said the Internet community should work with them as much as possible. Tobias said that he wanted a RIPE Policy in place as soon as possible for those very reasons. X. A.O.B. There was no other business to attend to. Z. Agenda for RIPE 64 Brian said the working group tries to have a good mix of technical and anti-abuse-related discussions. He concluded that if people wanted different areas discussed or if they wanted to present at RIPE 64, they should contact one of the working group chairs. Brian thanked everyone for attending and closed the session at 17:28 (UTC +1).

2 1

RIPE 64 Agenda Items
by Brian Nisbet 23 Feb '12

23 Feb '12

Colleagues, It is now just under two months to the next RIPE meeting in Ljubljana, Slovenia. RIPE 64 will be held from the 16th - 20th April 2012. Currently the AA-WG meeting should take place at 11:00 CET on Thursday April 19th. We are currently seeking agenda items for the working group session in any area relating to network abuse, law enforcement or associated matters and anything else you may feel is of interest to the group. Please mail any proposals to aa-wg-chairs(a)ripe.net, preferably before the 9th of March. Thanks, Brian.

1 0

no traffic? banned?
by U.Mutlu 20 Feb '12

20 Feb '12

I have got no new posting in this list since 2/2. Is here really no traffic anymore, or have I maybe been removed/banned from the list? :-)

2 1