- anti-abuse-wg - mailman.ripe.net

How Not To Ask For A Website to Be taken Down
by Michele Neylon :: Blacknight 27 Dec '10

27 Dec '10

Got this earlier today (not to our abuse contact of course .. ) Couple of things to note Unless you read it a few times it's not easy to work out what the hell they are actually asking about If your first language isn't English then I suspect you'll dismiss it as spam .. .. I know some of my staff did and they supposedly speak English! "Dear Sir or Madame, As a result of our activities, Bank of America and/or its affiliates have acquired significant reputations in the field of banking and financial services worldwide and our trademark and brand (the “Marks”) are registered and/or used in the United States as well as many countries globally. We have now detected a website, or a redirect to a website, hosted on your network that purports to be a Bank of America or a Bank of America affiliate* website. The referenced site(s) uses the Marks, leading visitors to believe it is a website sponsored or endorsed by Bank of America or a Bank of America affiliate* while no such sponsorship or endorsement actually exists. The site requests visitors to supply sensitive personal or financial information. We have confirmed that this webpage is NOT authorized or endorsed by Bank of America and/or its affiliates. The use of our Marks in this way is likely to cause confusion in the mind of the public, leading them to believe that the website is associated with Bank of America or that we are otherwise supplying goods and services through it. As you know, “Phishing” sites such as this usually are part of larger criminal schemes that violate a number of federal, state and international laws. We request your immediate assistance in stopping the continued operation of this website and its unauthorized use of our Marks. Continued operation of the website in this way is not only likely to result in substantial damage to our reputation and goodwill but also perpetuates the appearance that your network is cooperating with the fraudulent purpose behind the website. We request that you please assist us in shutting down the website immediately. URL - http://xxxxxxxxx IP Address - xxxxxx As part of this action we request that you redirect all traffic going to this website to the following URL: http://education.apwg.org/r/en?xxxxxxxxxxxx By doing this it will provide a way for consumers to educate themselves about phishing. Information about implementing a redirect to this page can be found here: http://education.apwg.org/r/how_to.html Please forward this message with your response, directly to anti-phishing(a)bankofamerica.com. We thank you in advance for assisting us in stopping phishing and refusing to allow your network to be used for illegal activity. Thank you, Abuse Team Bank of America Contact Email: anti-phishing(a)bankofamerica.com *Bank of America affiliates include the following brands: MBNA Merrill Lynch Countrywide Military Bank LaSalle Fleet" Mr Michele Neylon Blacknight Solutions Hosting & Colocation, Brand Protection ICANN Accredited Registrar http://www.blacknight.com/ http://blog.blacknight.com/ http://blacknight.mobi/ http://mneylon.tel Intl. +353 (0) 59 9183072 US: 213-233-1612 UK: 0844 484 9361 Locall: 1850 929 929 Direct Dial: +353 (0)59 9183090 Twitter: http://twitter.com/mneylon PS: Check out our latest offers on domains & hosting: http://domainoffers.me/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,Ireland Company No.: 370845

10 18

Re: Additional Layers for Economic Incentives to improve Internet Security
by Mirjam Kuehne 27 Dec '10

27 Dec '10

Dear colleagues, Following up from his earlier posts on RIPE Labs, John Quarterman is now looking at 'ASN Ranking Correlations Between Spam Blocklists': http://labs.ripe.net/Members/jsq/asn-ranking-correlations-between-spam-bloc… Kind Regards and Happy Holidays, Mirjam Kuehne RIPE NCC

5 4

Fwd: [anti-abuse-wg] How Not To Ask For A Website to Be taken Down
by Mark Foster 24 Dec '10

24 Dec '10

Sent this directly to Ronald by mistake, it was meant for the list... ---------- Forwarded message ---------- From: Mark Foster <blakjak(a)gmail.com> Date: Fri, Dec 24, 2010 at 9:48 AM Subject: Re: [anti-abuse-wg] How Not To Ask For A Website to Be taken Down On Thu, Dec 23, 2010 at 7:59 PM, Ronald F. Guilmette <rfg(a)tristatelogic.com>wrote: > > > > #2) Even for those networks where abuse@ is not aliased to /dev/null, > sending anything other than a _spam_ report to that address will typically > engender either (a) no response at all (with the message being silently > discarded) or else (b) an irritated response of the form "Why are you > sending this to abuse@??" or else (c) a more or less automated response > (either from an actual program or else from a low-paid human who has been > trained to act like one) the form "We're sorry, but we cannot accept > abuse complaints without either (a) a full set of e-mail headers or else > (b) a complete set of system intrusion logs." > I find myself taking exception to this and whilst I usually lurk in the background here I think it needs to be said: - I would expect any malicious or illegal behavior to be reported to abuse@ - Whilst Spam reports will form the vast majority of these, I expect my Abuse-Queue-Staff to be plucking the _non_-Spam reports out for early attention (as other types of abuse are more frequently time sensitive). Those who do tech support are familiar with the idea of triage in a customer-facing sense; the stuff that's likely to have large ramifications, either in scale, or PR, or cost, will get early attention because that's just commonsense. For stuff happening in real-time that's a serious issue (say a DoS) I have (as an engineer) taken both emails and phonecalls directly - but I still expect a report to abuse@ so that the appropriate records are able to be created and placed on file for future legal or customer-service obligations. This logic has applied for ISPs operating with 1000 to 500,000 customers. Unfortunately as your organisation gets larger, the 'human touch' of handling abuse cases seems to dissapear and you do wind up with lesser-cloo'd people dealing with the complaints, and using templated answers that infuriate those who're actually taking the time to report abuse. The number of people these days who simply block, or ignore, abusive internet behavior, is counter-productive to those ISPs who are resultantly blind as to the actual negative impact their customers are having. So with these points in mind, (a) above is possible, but a move that demonstrates poor 'internet citizenship' on the part of the ISP, (b) shouldn't ever happen, and in my experience only happens when you land an idiot at the other end, and (c) again demonstrates poor internet citizenship. To the point where I will actively take my business away from any organisation that operates that way. My current issue is with Yahoo's requirement that all complaints comply with ARF. They're one of the biggest sources of spam and have opted to require complaints to fit into their particular brand of round-shaped-hole or they're going to ignore the report. I refuse to waste more of my time reporting spammers, and instead am much more prepared to simply block their domain(s) with a reject line similar to 'mail will not be accepted until Yahoo stops with the head-in-sand technique of operating, and instead deals with the spammers in its midst'. If your operation is big enough to spin millions of dollars per year in revenue, you're big enough to be a responsible netizen and show some respect to anyone taking the time to report abuse. Because if you deliberately ignore complaints, you become responsible for the behavior itself and become an accessory to the abuse, or crime, in effect. > > > #3) Although, for the various reasons noted above, and others, sending a > report like this to an abuse@ address might yield no meaningful or useful > action at all, the mere presence of the corporate abuse@ address, either > in the To: header or in the Cc: header would most likely cause any and > all other parties to whom such a report had been addressed (and who might > otherwise potentially be more responsive/responsible than abuse@) to > simply > trash the message, e.g. because they might reasonably assume that "Oh! > This was sent to abuse@ too, so the abuse department/person will surely > handle it, and I don't need to get involved." > If your abuse@ team are of any value, they will of course do exactly that. If you're an 'other recipient' then in good concience you should at least be checking with them to ensure it's followed up. That's customer service 101. Is the risk to your reputation worth it? > #4) Last but not least, in the circles I travel in, a clear and unambiguous > distinction is often drawn between "abuse ON the network" and "abuse OF the > network". As we all know, the latter occurs almost every second of the > day, > somewhere on the Internet, and it can range from undeserved insults and > slanders to sophisticated social engineering con games involving millions > of dollars. But none of that "abuse ON the network" in any way threatens > the operational status of any part of the net. Conversely, of course, spam > and DoS attack directly threaten the operational status of either parts of > the net or, in sum, even the whole thing, and thus, by tradition among the > people I commonly hang out with, "abuse OF the net" is widley considered to > be the only thing (a) that humans can reasonably fight and also (b) in many > people's minds, it is the only thing that's _worth_ fighting for. (After > all, the world and the net will go on even if you or I are heniously > slandered > or even defrauded, tomorrow, somewhere on the Internet.) > If someone reports a customer of mine breaching T&C I will expect our customer care team to enforce T&C. Antisocial behavior might not be a T&C breach. If it crosses that line, however, we'll act as a reasonable ISP should. If the customers conduct is illegal, or a DoS, or spam, or other behavior which will negatively affect our own online reputation, we'll similarly take steps to respond. Often an external report is the way that we find out about this behavior - we don't have eyes everywhere. > The upshot of all this line of thinking is that some (many?) believe that > it's not even the job of an ISP abuse desk to even delve into any matters > that do not clearly affect network operational status. At any and all > ISPs of this persuasion, a note to abuse@ regarding a clear trademark > violation (and a plausible/possible phishing threat) would be discarded > virtually the moment it was opened. > > The ISP is responsible for being a good online citzen (morally). But they're also obliged to preserve their own reputation if they want to ensure folks won't simply blackhole their traffic, so if they choose to turn a blind eye to the problems their customers cause, ultimately it will affect their bottom line. The ISP will then care - so the ISP's Abuse Desk, being the group who deal with the outside world in respects abusive behavior online, should be prepared to deal with this. Across the several ISP's I've worked for, this is certainly the case. And I will actively steer business away from any ISP who chooses to reneg on this obligation. Mark.

1 0

Draft Anti-Abuse WG Minutes – RIPE 61
by Brian Nisbet 21 Dec '10

21 Dec '10

Colleagues, These are the draft minutes for the WG session from RIPE61. If you have any comments, please do let me know. Brian. Draft Anti-Abuse WG Minutes – RIPE 61 Thursday, 18 November 2010, 14:00 – Westin Excelsior Hotel, Rome, Italy Co-Chairs: Brian Nisbet, Richard Cox Scribe: Fergal Cunningham Chat: Laura Cobley A. Administrative Matters A1. Welcome Working Group Co-Chair Brian Nisbet welcomed attendees and explained that co-chair Richard Cox regrettably was unable to attend today’s session. James Blessing, concerned Internet citizen, said that although it was good to have an active co-chair, the reputation of the Anti-Abuse Working Group was being impacted upon by the other co-chair, and he said he would like to see this addressed. Brian said this was a matter for the AOB section of the agenda. Brian thanked the RIPE NCC scribe and Chat monitor, and the stenographers. He asked that anyone who had a question on Chat give their full name and affiliations. Brian asked if there were any objections to the minutes from RIPE 60 being approved. There were none, so he said the minutes were approved. Action on RIPE NCC: Remove “Draft” status from RIPE 60 Anti-Abuse Working Group Minutes. Brian noted that the agenda was slightly changed from the agenda posted on the mailing list because Richard was unable to attend and there were some late requests for presentations from RIPE NCC staff. The updated agenda is available at: http://ripe61.ripe.net/presentations/343-AA-WG_RIPE61_Agenda.pdf B. Updates B1. Recent List Discussion - Reporting Fraud, Database Issues, Time Stamps (-B) Working Group Co-Chair Brian Nisbet noted that there was a lot of discussion on the mailing lists recently, and most of this was related to items that would be dealt with further down the agenda. He noted that the Anti-Abuse Working Group mailing list was not the place to report network abuse. He did remind attendees that the whois –B lookup gives the date of the last update to an object. B2. Registrar Issues - Michele Neylon, Blacknight Michele Neylon from Blacknight gave a presentation entitled “Abuse – Registrar Perspective”. At the beginning of the presentation, Michele asked for a show of hands on attendees who had had their credit card skimmed or Paypal account attacked, and there was quite a large number of hands. The presentation is available at: http://ripe61.ripe.net/presentations/244-blacknight-ripe-rome-2010.pdf Tobias Knecht, Abusix, asked how should all these things be reported in a machine and in a human readable format. He also suggested using xarf.org. Michele said they get manual reports and, if the reports are to be automated, there is no reason they can’t be provided in a particular order. He said everything has to be read and investigated anyway. Konstantin Bekreyev, DARS Telecom, asked, considering the recent increase in botnets, when spam is sent through the port tcp/80 via email systems such as Hotmail, what can he do. He is unable to close port 80 to these sites. Michele said he did not know and suggested reporting it to Hotmail. Brian said the big email companies have gotten better with spam and dealing with it. If abuse comes from a website then it should be reported to the original IP. Gilles Massen, Restena Foundation, asked, since abusers are moving quickly, how would Michele react to them efficiently while protecting the innocent. Michele said you have to carefully evaluate each report you receive and you need to have a measured a response. David Freedman, Claranet, asked what kind of proactive work the registrars do. Michele said there were a lot of registrars and their methods varied. He said often the registrars and hosting operators did not have full control of the network. He said he would like to see some best practices coming out of the Anti-Abuse Working Group. Brian said producing best practice documents is an action item for this working group, and although this was not on the agenda for the current meeting, he hoped to be able to come back to the mailing list with something soon. An attendee asked about the Google tool that was presented earlier by Michele. He said that an ISP would need to have specific examples of abuse before it would take action on a customer. He asked if the registrar would contact the customer based on a Google report alone. Brian explained that the Google safe browsing alerts tool lets Google notify you if a site you are hosting has malware. Michele said this used to be the case with registrars but now they have to take a more proactive approach because of the number of reports they receive each day. He said he would not contact anyone based on the alert alone, but the alert would give you an indication of where abuse was taking place and you can go there and see what is happening. Andy Davidson, Netsumo, in response to the question from Konstantin, recommended a tool from Loughborough University that looks in outbound mail for evidence that someone has been phished. He added that it locks the accounts of people who have been phished. Andy said he would send details to the mailing list. James Blessing, Limelight Networks, asked that the time stamp and correct time zone be noted in all reports. B3. RIPE NCC Draft Closure Agreement/Service Abuse Athina Fragkouli, RIPE NCC, gave a presentation on the new RIPE NCC document, Closure of an LIR and Deregistration of Resources. The presentation is available at: http://ripe61.ripe.net/presentations/281-Closure_of_LIRs_and_deregistration… Athina asked that attendees read the document and give feedback. James Blessing, Limelight Networks, asked if the only thing that could be effected under law was full termination of the service agreement. Athina said this was the case but if the RIPE NCC received a Dutch court order it could deregister resources. She confirmed that the RIPE NCC would comply with a Dutch court order no matter what it contained. David Freedman, Claranet, asked if there would be a way to let people know that resources were in the process of being deregistered. Athina said a tag would be added to such resources in the RIPE Database. Brian noted that there was a bigger version of Athina’s presentation available from the NCC Services Working Group and that it would be made available in that working group’s archive. Volodymyr Yakovenko, Google, asked if there was an example of a Dutch court order available and the conditions for such a court order. Athina said the RIPE NCC hadn’t received one yet but was working with Dutch national authorities on what should be contained in such an order. Brian asked that the RIPE NCC make known to the community the outcome of the RIPE NCC’s discussion with the Dutch legal authorities. Wilfried Woeber, Database Working Group Co-Chair, said it was important to get the provisions of the document correct as soon as possible, and he also advised against overreacting to a court order in terms of deregistration. Athina said termination of the service contract between the RIPE NCC and an LIR resulted in a loss of service, and that included registration of resources. Rob Blokzijl, RIPE Chair, said the RIPE NCC has been in contact with legal enforcement agencies (LEAs) for a number of years, and the police are doubtful that they will see a need to bring a court order or deregister resources. He said LEAs are interested in stopping criminals and removing information is not something they would see as helping this goal. Brian said further discussion of the document should take place on the RIPE NCC Services Working Group mailing list. B4. RIPE NCC Survey on Improving RIPE Database Quality Ferenc Csorba from the RIPE NCC gave a presentation on a survey aimed at improving RIPE Database quality. The presentation is available at: http://ripe61.ripe.net/presentations/279-RIPE_DB_Quality_Survey.key There were no questions and Brian said feedback on the survey should be directed to the Database Working Group mailing list. C. Policies C1. 2010-08 Abuse Contact Information Working Group Co-Chair Brian Nisbet called Tobias Knecht, Abusix, the proposer of 2010-08, on Skype. Brian noted that he had discussed the proposal with Tobias and they had talked to the Database Working Group and RIPE NCC staff. He said some changes had been recommended. Brian explained that the proposal was to “add a mandatory reference to IRT objects in the INETNUM, INET6NUM and AUT-NUM objects in the RIPE Database. He added that potential changes to the proposal include removal of implementation details. He said there would be a redraft of the proposal and asked for any comments on having the mandatory reference to abuse contacts in IRT objects. Michele Neylon, Blacknight, said there might be some confusion because some people seemed to be confusing introduction of a mandatory abuse contact with solving all problems. He said he foresaw problems with people expecting the proposal to have a broader impact that was originally intended. Tobias said the main point of the proposal was the mandatory nature of having the reference, but this was something people might have to decide for themselves and he was open to hearing comments on this. James Blessing, Limelight, said the proposal was a nice idea but there would have to be a lot of objects referenced. He recalled that there was a proposal to deregister objects that didn’t have accurate details. He foresaw a situation in three months where people who did not hear about this policy would have objects deregistered. Brian said the deregistration policy was not something that would happen overnight. He said there would have to be a proper process of negotiation with the LIR before anything would happen. Peter Koch, DENIC, said he failed to see a clear problem statement for this proposal. He said if people are not getting a response from abuse contacts, then making it mandatory would not change anything. He said if people are sending abuse reports and it’s not going to the correct address, then he would like to see evidence of this. Tobias said the problem was that there were too many places where people could add abuse contact details and people are confused. He said the main intention is to have one place where people know they have to put contact information and where other people will know they can find contact information. Peter said he disagreed there too many places to put contact information already and he said it seemed to be more of an education problem rather than anything else. Tobias said if you are going to educate people on where to find information, it is easier to do if you know the information is in one place rather than in one or more of 15 locations. Shane Kerr, Internet Systems Consortium, said there were already references to IRT objects in INETNUM and INET6NUM objects, and he asked if it was not to be mandatory then what was the point of having the proposal. Brian agreed that this was the crux of the issue. Tobias said there might be a better way to do things, but it is important that everyone knows how to do it. Sascha Eilms, ECO/CSA, said he wanted to support the proposal because it showed willingness from the industry to self-regulate and tackle the problem of abuse. Wilfried Woeber, Database Working Group Co-Chair, said he was a co-architect of the IRT object and had sympathy with the idea that there were too many choices on where to place contact information at the moment. He said that coming up with ways to simplify things does have merit. Brian asked Tobias if, based on the comments, they could sit down and redraft the policy to be resubmitted, and Tobias agreed to this. Shane said there was the issue of simplification that most people would agree with, but there was also the issue of making it mandatory. He suggested this should be discussed in the Address Policy Working Group because if the proposal to make this mandatory was accepted this would be a big issue for LIRs. Peter Koch said making such an attribute mandatory would have major operational implications for the RIPE Database and said the matter of how to apply the technology was also an important issue. Brian said they would take the comments on board when redrafting and the conversation could continue on the mailing list. C2. 2010-09 – “Frequent Update Request” and 2010-10 “Change to RIPE 452” Brian explained that 2010-09 was a proposal to have the RIPE NCC regularly contact all current RIPE Database object holders with resources in the RIPE Database to ask them to actively check that all their details are up-to-date. He explained that 2010-10 proposed to add a reference to the sponsoring LIR in INETNUM, INET6NUM and AUT-NUM objects to increase the possibility of abuse tracking and handling. Brian said that these were two huge proposals with major implications. He said he agreed with the proposers to withdraw these proposals, at least temporarily, and set up a RIPE Task Force featuring people from the RIPE Database Working Group and the Anti-Abuse Working Group among others to look at improving the registry and the RIPE Database. He said they wanted to consult the RIPE NCC and other parties to see what was the best way to deal with the issues rather than bringing a number of proposals. Brian said the two proposals would be withdrawn with the knowledge that the proposers resubmit them if the task force did not make sufficient progress D. Interactions D1. Working Groups Working Group Co-Chair Brian Nisbet noted that there has been a lot of interaction with the RIPE Database Working Group and the RIPE NCC Services Working Group. He said the RIPE Task Force to address issues with the RIPE Database arose from communication with the RIPE NCC Service Working Group, and this task force would feed back to both those working groups as well as the Anti-Abuse Working Group. D2. CCWP Brian explained that Wout de Natris chaired the Cybercrime Working Party (CCWP). He said there was a meeting today that saw a number of inputs/outputs from this group. He said the main thing to come out of the meeting was the need for cross training of the groups – technical and policy training for legal enforcements agencies, and information on how to detect dubious registrations for the RIPE NCC and RIPE community. Brian said the CCWP met approximately four times a year and it has proved to be very useful so far. He said if anyone had any input to bring to the CCWP they should talk to either Brian himself or Jochem de Ruig from the RIPE NCC. D3. RIPE NCC Gov/LEA Interactions Update Brian said Paul Rendek from the RIPE NCC covered this area extensively in the RIPE NCC Services Working Group and he did not want to revisit it here. X. A.O.B. James Blessing, concerned Internet citizen, said he noticed that Co-Chair Richard Cox tends often not to be present at RIPE Meetings or not involved, unless it is to be hostile towards RIPE itself. He asked if Richard was the correct person to be working group co-chair. Working Group Co-Chair Brian Nisbet said he contacted Richard and asked him to respond to comments that had been made, but Brian had not heard back from Richard in relation to this. Jim Reid, Internet citizen, said this was a delicate issue, and even if the co-chair of a working group was critical of RIPE, that is not necessarily a bad thing. He said, however, that his opinion was that Richard crossed a line insofar as his comments were unfair and unjustified, and he confused RIPE with the RIPE NCC in his comments, which is not helpful. He said Richard’s comments unfairly damaged the reputation of RIPE, the RIPE NCC and the Anti-Abuse Working Group. Rob Blokzijl, RIPE Chair, noted that this is the first time there has been a situation like this in the history of RIPE. Rob noted that the RIPE Chair, the Chairman of the RIPE NCC Executive Board and the RIPE NCC Managing Director met with Richard where they tried to clear up some misunderstandings. He said all three who met with Richard are disappointed that the outcome of this meeting, where they thought issues had been cleared up, were not reflected in subsequent posts from Richard that were published on websites. He said he felt that if you were elected to chair a working group by the RIPE community then you had a responsibility to that community and to its secretariat, the RIPE NCC. He concluded that it would be better for the community if Richard would step down so it would be clear that when he spoke he was speaking for himself and not the RIPE community. David Freedman, Claranet, read verbatim a public post from Richard to give context to the discussion. Brian said there was no written procedure for the current situation. Rob said that if you accept that it is up to the RIPE community to appoint working group chairs, then it is implicit that the community has the same responsibility to remove a chair when necessary. Brian said he did not want to see a protracted discussion about this on the mailing list. He added that he spoke to Richard and asked him to consider his position but there has been no response. He asked if anyone felt the Anti-Abuse Working Group should deal with the situation of if there was any particular way that this situation should be approached. Michele Neylon, Blacknight, said it was unfortunate there was no written procedure for this situation. He said one individual can cause major problems for a working group, whether they are a co-chair or not, and in such a situation it might be best for that person to move on. He said he respected Richard and the work he does but in this situation some decisive action was needed. Rob said a possible solution would for both co-chairs to step down, new chairs to be elected at the next RIPE Meeting and for Brian to act as interim chair of the working group until then. He said the simplest solution would be for this working group to decide Richard Cox was no longer a co-chair of the working group and to elect a new co-chair at the next RIPE Meeting. Peter Koch said the session was already overrun by 15 minutes and this delicate issue should be resolved at another time. Jim Reid said that changes of co-chair happen for various reasons and it’s a natural process. He said it seemed as though Richard’s time as co-chair might be over but he would be free to be involved with the working group as any other individual is welcome to be. Rob said that if nothing were done at this session, there would be potentially six months of damage to the RIPE NCC and six months of damage to the RIPE community. He urged the community to take action at this session. Sander Steffann, Address Policy Working Group Co-Chair, said if there was a lack of support for a working group chair then that chair should step down. Shane Kerr, ISC, said he thought this situation might be a reflection of a larger disconnect between the Anti-Abuse Working Group and the ISPs. He said people in the Anti-Abuse Working Group often had goals that were very disconnected from the Internet community at large. He said the people in the working group would use this as another example of people in the Internet community not listening to their wishes. Nick Hilliard, INEX, asked what were the contingency plans if Richard refused to step down as co-chair. He said he wasn’t sure it was typical in RIPE for someone to be forced to step down as a working group chair because that working group has lost faith in that chair. He said the RIPE community should address the lack of a formal procedure as a matter of urgency. James Blessing suggested it might be possible to suspend his chairmanship but it must be made clear that the working group did not support him 100% as co-chair. Rob said it was not for Richard to decide that he represented the community; rather it was for the community to decide this. He asked the working group to make a decision or else expect to have a difficult six months ahead. He said he did not care what Richard published as long as it was disconnected from the RIPE community. Remco van Mook, Equinix, said if this working group could not make a decision then it could be disbanded and reformed at the RIPE Plenary with new co-chairs. Rob said he was happy to support Remco’s proposal. He said he the Anti-Abuse Working Group had until the Closing Plenary session to resolve this matter. He added that it would be good for the whole RIPE community to be aware of its responsibilities in matters such as this one. Brian said that he was not in favour of this option. He noted that no one had stood up to support Richard’s position as co-chair. Jim Reid said someone should post a motion of no confidence in Richard to the mailing list. Brian said the chairs were always elected at RIPE Meetings and there was no requirement to go to the mailing list with this. Rob said he felt that matters were clear but that no one was willing to say anything formally. James Blessing said he would be willing to do what was required if he could be told exactly what that was. He asked for audible consensus from the room. The reaction was judged to be consensus. Brian said he had discussed the matter with Rob prior to the working group session and they agreed that the working group had the authority to appoint its co-chairs and, therefore, to remove them. Brian asked if anyone was willing to stand up and object to Richard Cox being removed as Co-Chair of the Anti-Abuse Working Group. As nobody took this action, Brian declared that consensus had been reached. He said that he would require a new co-chair and he expressed his wishes that one could be in place by the RIPE 62 Meeting. Z. Close Brian thanked everyone for attending and for their patience and said he hoped to see everyone at RIPE 62. The Agenda and all presentations are available at: http://ripe61.ripe.net/programme/meeting-plan/anti-abuse-agenda/ The stenography transcript of this session is available at: http://ripe61.ripe.net/archives/steno/4

4 5

Updated Draft Minutes - RIPE 61
by Brian Nisbet 21 Dec '10

21 Dec '10

Colleagues, I've made a couple of changes as requested, assuming this is ok I'll pass it back to the NCC. Brian. ********************************** Draft Anti-Abuse WG Minutes – RIPE 61 Thursday, 18 November 2010, 14:00 – Westin Excelsior Hotel, Rome, Italy Co-Chairs: Brian Nisbet, Richard Cox Scribe: Fergal Cunningham Chat: Laura Cobley A. Administrative Matters A1. Welcome Working Group Co-Chair Brian Nisbet welcomed attendees and explained that co-chair Richard Cox regrettably was unable to attend today’s session. James Blessing, concerned Internet citizen, said that although it was good to have an active co-chair, the reputation of the Anti-Abuse Working Group was being impacted upon by the other co-chair, and he said he would like to see this addressed. Brian said this was a matter for the AOB section of the agenda. Brian thanked the RIPE NCC scribe and Chat monitor, and the stenographers. He asked that anyone who had a question on Chat give their full name and affiliations. Brian asked if there were any objections to the minutes from RIPE 60 being approved. There were none, so he said the minutes were approved. Action on RIPE NCC: Remove “Draft” status from RIPE 60 Anti-Abuse Working Group Minutes. Brian noted that the agenda was slightly changed from the agenda posted on the mailing list because Richard was unable to attend and there were some late requests for presentations from RIPE NCC staff. The updated agenda is available at: http://ripe61.ripe.net/presentations/343-AA-WG_RIPE61_Agenda.pdf B. Updates B1. Recent List Discussion - Reporting Fraud, Database Issues, Time Stamps (-B) Working Group Co-Chair Brian Nisbet noted that there was a lot of discussion on the mailing lists recently, and most of this was related to items that would be dealt with further down the agenda. He noted that the Anti-Abuse Working Group mailing list was not the place to report network abuse. He did remind attendees that the whois –B lookup gives the date of the last update to an object. B2. Registrar Issues - Michele Neylon, Blacknight Michele Neylon from Blacknight gave a presentation entitled “Abuse – Registrar Perspective”. At the beginning of the presentation, Michele asked for a show of hands on attendees who had had their credit card skimmed or Paypal account attacked, and there was quite a large number of hands. The presentation is available at: http://ripe61.ripe.net/presentations/244-blacknight-ripe-rome-2010.pdf Tobias Knecht, Abusix, asked how should all these things be reported in a machine and in a human readable format. He also suggested using xarf.org. Michele said they get manual reports and, if the reports are to be automated, there is no reason they can’t be provided in a particular order. He said everything has to be read and investigated anyway. Konstantin Bekreyev, DARS Telecom, asked, considering the recent increase in botnets, when spam is sent through the port tcp/80 via email systems such as Hotmail, what can he do. He is unable to close port 80 to these sites. Michele said he did not know and suggested reporting it to Hotmail. Brian said the big email companies have gotten better with spam and dealing with it. If abuse comes from a website then it should be reported to the original IP. Gilles Massen, Restena Foundation, asked, since abusers are moving quickly, how would Michele react to them efficiently while protecting the innocent. Michele said you have to carefully evaluate each report you receive and you need to have a measured a response. David Freedman, Claranet, asked what kind of proactive work the registrars do. Michele said there were a lot of registrars and their methods varied. He said often the registrars and hosting operators did not have full control of the network. He said he would like to see some best practices coming out of the Anti-Abuse Working Group. Brian said producing best practice documents is an action item for this working group, and although this was not on the agenda for the current meeting, he hoped to be able to come back to the mailing list with something soon. An attendee asked about the Google tool that was presented earlier by Michele. He said that an ISP would need to have specific examples of abuse before it would take action on a customer. He asked if the registrar would contact the customer based on a Google report alone. Brian explained that the Google safe browsing alerts tool lets Google notify you if a site you are hosting has malware. Michele said this used to be the case with registrars but now they have to take a more proactive approach because of the number of reports they receive each day. He said he would not contact anyone based on the alert alone, but the alert would give you an indication of where abuse was taking place and you can go there and see what is happening. Andy Davidson, Netsumo, in response to the question from Konstantin, recommended a tool from Loughborough University that looks in outbound mail for evidence that someone has been phished. He added that it locks the accounts of people who have been phished. Andy said he would send details to the mailing list. James Blessing, Limelight Networks, asked that the time stamp and correct time zone be noted in all reports. B3. RIPE NCC Draft Closure Agreement/Service Abuse Athina Fragkouli, RIPE NCC, gave a presentation on the new RIPE NCC document, Closure of an LIR and Deregistration of Resources. The presentation is available at: http://ripe61.ripe.net/presentations/281-Closure_of_LIRs_and_deregistration… Athina asked that attendees read the document and give feedback. James Blessing, Limelight Networks, asked if the only thing that could be effected under law was full termination of the service agreement. Athina said this was the case but if the RIPE NCC received a Dutch court order it could deregister resources. She confirmed that the RIPE NCC would comply with a Dutch court order no matter what it contained. David Freedman, Claranet, asked if there would be a way to let people know that resources were in the process of being deregistered. Athina said a tag would be added to such resources in the RIPE Database. Brian noted that there was a bigger version of Athina’s presentation available from the NCC Services Working Group and that it would be made available in that working group’s archive. Volodymyr Yakovenko, Google, asked if there was an example of a Dutch court order available and the conditions for such a court order. Athina said the RIPE NCC hadn’t received one yet but was working with Dutch national authorities on what should be contained in such an order. Brian asked that the RIPE NCC make known to the community the outcome of the RIPE NCC’s discussion with the Dutch legal authorities. Wilfried Woeber, Database Working Group Co-Chair, said it was important to get the provisions of the document correct as soon as possible, and he also advised against overreacting to a court order in terms of deregistration. Athina said termination of the service contract between the RIPE NCC and an LIR resulted in a loss of service, and that included registration of resources. Rob Blokzijl, RIPE Chair, said the RIPE NCC has been in contact with legal enforcement agencies (LEAs) for a number of years, and the police are doubtful that they will see a need to bring a court order or deregister resources. He said LEAs are interested in stopping criminals and removing information is not something they would see as helping this goal. Brian said further discussion of the document should take place on the RIPE NCC Services Working Group mailing list. B4. RIPE NCC Survey on Improving RIPE Database Quality Ferenc Csorba from the RIPE NCC gave a presentation on a survey aimed at improving RIPE Database quality. The presentation is available at: http://ripe61.ripe.net/presentations/279-RIPE_DB_Quality_Survey.key There were no questions and Brian said feedback on the survey should be directed to the Database Working Group mailing list. C. Policies C1. 2010-08 Abuse Contact Information Working Group Co-Chair Brian Nisbet called Tobias Knecht, Abusix, the proposer of 2010-08, on Skype. Brian noted that he had discussed the proposal with Tobias and they had talked to the Database Working Group and RIPE NCC staff. He said some changes had been recommended. Brian explained that the proposal was to “add a mandatory reference to IRT objects in the INETNUM, INET6NUM and AUT-NUM objects in the RIPE Database. He added that potential changes to the proposal include removal of implementation details. He said there would be a redraft of the proposal and asked for any comments on having the mandatory reference to abuse contacts in IRT objects. Michele Neylon, Blacknight, said there might be some confusion because some people seemed to be confusing introduction of a mandatory abuse contact with solving all problems. He said he foresaw problems with people expecting the proposal to have a broader impact that was originally intended. Tobias said the main point of the proposal was the mandatory nature of having the reference, but this was something people might have to decide for themselves and he was open to hearing comments on this. James Blessing, Limelight, said the proposal was a nice idea but there would have to be a lot of objects referenced. He recalled that there was a proposal to deregister objects that didn’t have accurate details. He foresaw a situation in three months where people who did not hear about this policy would have objects deregistered. Brian said the deregistration policy was not something that would happen overnight. He said there would have to be a proper process of negotiation with the LIR before anything would happen. Peter Koch, DENIC, said he failed to see a clear problem statement for this proposal. He said if people are not getting a response from abuse contacts, then making it mandatory would not change anything. He said if people are sending abuse reports and it’s not going to the correct address, then he would like to see evidence of this. Tobias said the problem was that there were too many places where people could add abuse contact details and people are confused. He said the main intention is to have one place where people know they have to put contact information and where other people will know they can find contact information. Peter said he disagreed there too many places to put contact information already and he said it seemed to be more of an education problem rather than anything else. Tobias said if you are going to educate people on where to find information, it is easier to do if you know the information is in one place rather than in one or more of 15 locations. Shane Kerr, Internet Systems Consortium, said there were already references to IRT objects in INETNUM and INET6NUM objects, and he asked if it was not to be mandatory then what was the point of having the proposal. Brian agreed that this was the crux of the issue. Tobias said there might be a better way to do things, but it is important that everyone knows how to do it. Sascha Eilms, ECO/CSA, said he wanted to support the proposal because it showed willingness from the industry to self-regulate and tackle the problem of abuse. Wilfried Woeber, Database Working Group Co-Chair, said he was a co-architect of the IRT object and had sympathy with the idea that there were too many choices on where to place contact information at the moment. He said that coming up with ways to simplify things does have merit. Brian asked Tobias if, based on the comments, they could sit down and redraft the policy to be resubmitted, and Tobias agreed to this. Shane said there was the issue of simplification that most people would agree with, but there was also the issue of making it mandatory. He suggested this should be discussed in the Address Policy Working Group because if the proposal to make this mandatory was accepted this would be a big issue for LIRs. Peter Koch said making such an attribute mandatory would have major operational implications for the RIPE Database and said the matter of how to apply the technology was also an important issue. Brian said they would take the comments on board when redrafting and the conversation could continue on the mailing list. C2. 2010-09 – “Frequent Update Request” and 2010-10 “Change to RIPE 452” Brian explained that 2010-09 was a proposal to have the RIPE NCC regularly contact all current RIPE Database object holders with resources in the RIPE Database to ask them to actively check that all their details are up-to-date. He explained that 2010-10 proposed to add a reference to the sponsoring LIR in INETNUM, INET6NUM and AUT-NUM objects to increase the possibility of abuse tracking and handling. Brian said that these were two huge proposals with major implications. He said he agreed with the proposers to withdraw these proposals, at least temporarily, and set up a RIPE Task Force featuring people from the RIPE Database Working Group and the Anti-Abuse Working Group among others to look at improving the registry and the RIPE Database. He said they wanted to consult the RIPE NCC and other parties to see what was the best way to deal with the issues rather than bringing a number of proposals. Brian said the two proposals would be withdrawn with the knowledge that the proposers resubmit them if the task force did not make sufficient progress D. Interactions D1. Working Groups Working Group Co-Chair Brian Nisbet noted that there has been a lot of interaction with the RIPE Database Working Group and the RIPE NCC Services Working Group. He said the RIPE Task Force to address issues with the RIPE Database arose from communication with the RIPE NCC Service Working Group, and this task force would feed back to both those working groups as well as the Anti-Abuse Working Group. D2. CCWP Brian explained that Wout de Natris chaired the Cybercrime Working Party (CCWP). He said there was a meeting today that saw a number of inputs/outputs from this group. He said the main thing to come out of the meeting was the need for cross training of the groups – technical and policy training for legal enforcements agencies, and information on how to detect dubious registrations for the RIPE NCC and RIPE community. Brian said the CCWP met approximately four times a year and it has proved to be very useful so far. He said if anyone had any input to bring to the CCWP they should talk to either Brian himself or Jochem de Ruig from the RIPE NCC. D3. RIPE NCC Gov/LEA Interactions Update Brian said Paul Rendek from the RIPE NCC covered this area extensively in the RIPE NCC Services Working Group and he did not want to revisit it here. X. A.O.B. James Blessing, concerned Internet citizen, said he noticed that Co-Chair Richard Cox tends often not to be present at RIPE Meetings or not involved, unless it is to be hostile towards RIPE itself. He asked if Richard was the correct person to be working group co-chair. Working Group Co-Chair Brian Nisbet said he contacted Richard and asked him to respond to comments that had been made, but Brian had not heard back from Richard in relation to this. Jim Reid, Internet citizen, said this was a delicate issue, and even if the co-chair of a working group was critical of RIPE, that is not necessarily a bad thing. He said, however, that his opinion was that Richard crossed a line insofar as his comments were unfair and unjustified, and he confused RIPE with the RIPE NCC in his comments, which is not helpful. He said Richard’s comments unfairly damaged the reputation of RIPE, the RIPE NCC and the Anti-Abuse Working Group. Rob Blokzijl, RIPE Chair, noted that this is the first time there has been a situation like this in the history of RIPE. Rob noted that the RIPE Chair, the Chairman of the RIPE NCC Executive Board and the RIPE NCC Managing Director met with Richard where they tried to clear up some misunderstandings. He said all three who met with Richard are disappointed that the outcome of this meeting, where they thought issues had been cleared up, were not reflected in subsequent posts from Richard that were published on websites. He said he felt that if you were elected to chair a working group by the RIPE community then you had a responsibility to that community and to its secretariat, the RIPE NCC. He concluded that it would be better for the community if Richard would step down so it would be clear that when he spoke he was speaking for himself and not the RIPE community. David Freedman, Claranet, read verbatim a public post from Richard to give context to the discussion. (http://www.spamhaus.org/news.lasso?article=663) Brian said there was no written procedure for the current situation. Rob said that if you accept that it is up to the RIPE community to appoint working group chairs, then it is implicit that the community has the same responsibility to remove a chair when necessary. Brian said he did not want to see a protracted discussion about this on the mailing list. He added that he spoke to Richard and asked him to consider his position but there has been no response. He asked if anyone felt the Anti-Abuse Working Group should deal with the situation of if there was any particular way that this situation should be approached. Michele Neylon, Blacknight, said it was unfortunate there was no written procedure for this situation. He said one individual can cause major problems for a working group, whether they are a co-chair or not, and in such a situation it might be best for that person to move on. He said he respected Richard and the work he does but in this situation some decisive action was needed. Rob said a possible solution would for both co-chairs to step down, new chairs to be elected at the next RIPE Meeting and for Brian to act as interim chair of the working group until then. He said the simplest solution would be for this working group to decide Richard Cox was no longer a co-chair of the working group and to elect a new co-chair at the next RIPE Meeting. Peter Koch said the session was already overrun by 15 minutes and that such a delicate issue should not be handled in AOB and overtime for the Working Group. Jim Reid said that changes of co-chair happen for various reasons and it’s a natural process. He said it seemed as though Richard’s time as co-chair might be over but he would be free to be involved with the working group as any other individual is welcome to be. Rob said that if nothing were done at this session, there would be potentially six months of damage to the RIPE NCC and six months of damage to the RIPE community. He urged the community to take action at this session. Sander Steffann, Address Policy Working Group Co-Chair, said if there was a lack of support for a working group chair then that chair should step down. Shane Kerr, ISC, said he thought this situation might be a reflection of a larger disconnect between people working in Anti-Abuse and the ISPs. He said the Anti-Abuse community often had goals that were very disconnected from the Internet community at large. He said such people could use this as another example of people in the Internet community not listening to their wishes. Nick Hilliard, INEX, asked what were the contingency plans if Richard refused to step down as co-chair. He said he wasn’t sure it was typical in RIPE for someone to be forced to step down as a working group chair because that working group has lost faith in that chair. He said the RIPE community should address the lack of a formal procedure as a matter of urgency. James Blessing suggested it might be possible to suspend his chairmanship but it must be made clear that the working group did not support him 100% as co-chair. Rob said it was not for Richard to decide that he represented the community; rather it was for the community to decide this. He asked the working group to make a decision or else expect to have a difficult six months ahead. He said he did not care what Richard published as long as it was disconnected from the RIPE community. Remco van Mook, Equinix, said if this working group could not make a decision then it could be disbanded and reformed at the RIPE Plenary with new co-chairs. Rob said he was happy to support Remco’s proposal. He said he the Anti-Abuse Working Group had until the Closing Plenary session to resolve this matter. He added that it would be good for the whole RIPE community to be aware of its responsibilities in matters such as this one. Brian said that he was not in favour of this option. He noted that no one had stood up to support Richard’s position as co-chair. Jim Reid said someone should post a motion of no confidence in Richard to the mailing list. Brian said the chairs were always elected at RIPE Meetings and there was no requirement to go to the mailing list with this. Rob said he felt that matters were clear but that no one was willing to say anything formally. James Blessing said he would be willing to do what was required if he could be told exactly what that was. He asked for audible consensus from the room. The reaction was judged to be consensus. Brian said he had discussed the matter with Rob prior to the working group session and they agreed that the working group had the authority to appoint its co-chairs and, therefore, to remove them. Brian asked if anyone was willing to stand up and object to Richard Cox being removed as Co-Chair of the Anti-Abuse Working Group. As nobody took this action, Brian declared that consensus had been reached. He said that he would require a new co-chair and he expressed his wishes that one could be in place by the RIPE 62 Meeting. Z. Close Brian thanked everyone for attending and for their patience and said he hoped to see everyone at RIPE 62. The Agenda and all presentations are available at: http://ripe61.ripe.net/programme/meeting-plan/anti-abuse-agenda/ The stenography transcript of this session is available at: http://ripe61.ripe.net/archives/steno/4

1 0

Question regarding IP address abuse
by Kong Posh Bhat 18 Dec '10

18 Dec '10

Greetings, We are trying to develop an architecture that is based around the premise that there is a special purpose local HTTPS server with a well known address. We intend to reserve the port number with IANA and define a well known local address in each of the following address spaces: 10.0.0.0, 172.16.0.0, 192.168.0.0, as well as in some private IPv6 address ranges. When a device comes up, as part of its startup logic it tries all these well known addresses one by one, until there is a hit. If there is no hit, the process terminates. However, if there is a hit, the device will make a special HTTPS request to this server, which in turn will deliver some management bootstrapping information to the device. One of my distinguished colleagues thinks that this constitutes an IP address abuse. Is that so? I do not seem to find any reference to this on the IANA Abuse FAQ site (http://www.iana.org/abuse/faq.html). Thanks in anticipation. I really appreciate your patience with me on this issue. Regards, Kong Posh Bhat Standards Research Lab Samsung Telecommunications America Ph: 972-761-7450 (Desk); 214-766-1743 (Mobile) Fax: 972-761-7631

4 3

2010-09 New Policy Proposal (Frequent Update Request)
by Emilio Madaio 01 Dec '10

01 Dec '10

Dear Colleagues A new RIPE Policy Proposal has been made and is now available for discussion. You can find the full proposal at: http://ripe.net/ripe/policies/proposals/2010-09.html We encourage you to review this proposal and send your comments to <anti-abuse-wg(a)ripe.net> before 7 December 2010. Regards Emilio Madaio Policy Development Officer RIPE NCC

8 7

2010-09 Policy Proposal Withdrawn (Frequent Update Request)
by Emilio Madaio 01 Dec '10

01 Dec '10

Dear Colleagues, The proposal has been withdrawn. It is now archived and can be found at: http://ripe.net/ripe/policies/proposals/2010-09.html Reason for withdrawal: the proposer decided to withdraw the proposal based on the feedback received at RIPE 61. A task force will be organised to solve the implementation issues pointed out by the proposal discussion. Regards Emilio Madaio Policy Development Officer RIPE NCC

1 0

2010-10 Policy Proposal Withdrawn (Adding reference to sponsoring LIR in inetnum, inet6num and aut-num objects)
by Emilio Madaio 29 Nov '10

29 Nov '10

Dear Colleagues, The proposed change to RIPE Document has been withdrawn. It is now archived and can be found at: http://www.ripe.net/ripe/policies/proposals/2010-10.html Reason for withdrawal: the proposer decided to withdraw the proposal based on the feedback received at RIPE 61. A task force will be organised to solve the implementation issues pointed out by the proposal discussion. Regards Emilio Madaio Policy Development Officer RIPE NCC

1 0

OECD report on SPAM
by julien tayon 24 Nov '10

24 Nov '10

Hello, http://www.oecd.org/officialdocuments/displaydocumentpdf/?cote=dsti/doc%282… In short, in this long report, abuse handling is pinpointed as essential in cutting off spam & crimes (there are no cyber crimes, only crimes imho). Sounds like trivial to me, but who knows ? I guess some pressure is directed from OECD to RIR for an «improved» abuse handling :) This may be the LEA pressure we heard of on this list sooner and the reason it came back to life after years of sleeping. :P Since there is a bimodal distribution with very few ISP (50) accounting for 30% of spam and they suggest to target legitimate ISP. Europa (RIPE region) seems to be the region with the most infected big ISP (which is not correlated with volume)... * making the asumption that these 50 ISP have a poor abuse handling ; * remembering that RIPE IP handling is linked to the respect of the procedure and the quality (contractually) ; * observing that RIPE region is one of the most infected ; My question is : does RIPE have a responsability in this topic by not enforcing the «we shall not give you new IP» rules when ISP failed to handle their abuse ? sed quis custodiet ipsos custodes?

4 4