- anti-abuse-wg - mailman.ripe.net

Re: [anti-abuse-wg] Input request for system on how to approach abuse filtering on Route Servers - bad hosters
by Erik Bais 20 May '21

20 May '21

Hi Thomas, Thank you for your reply and insight. I’m not asking for IXP’s to look in the traffic.. I’m looking for a top 50 list of badhosts.. that is generated in a way that we as a community would feel comfortable with as a start. Use that top 50 list .. as the ASn filtering, to get to a way of clean internet for the default Routeserver customer. ( secure by design / default ) If that customer would like to receive the unfiltered option, they could set that via the IXP portal in their member account and receive the unfiltered view. Or setup direct peerings .. It is already possible to do this for someone if they know how to do it, via BGP communities or RPSL in the RIPE DB.. But the problem is that the list might not get updated .. and it is easier to do this for the whole group with regular updates, without re-configing all routers on a peering lan. As we are now talking about this in the Dutch community, it should be possible to push this also to other regions .. and it should be open for everyone to see why they would be listed and what the qualifiers are that they are there … That way we can avoid the real badhosts to pick out an internet exchange that doesn’t support filtering on this, just so they can push their bad packets into some networks. Regards, Erik Bais From: anti-abuse-wg <anti-abuse-wg-bounces(a)ripe.net> on behalf of Thomas King <thomas.king(a)de-cix.net> Date: Wednesday 19 May 2021 at 13:14 To: Erik Bais <erik(a)bais.name>, "connect-wg(a)ripe.net" <connect-wg(a)ripe.net>, "anti-abuse-wg(a)ripe.net" <anti-abuse-wg(a)ripe.net> Subject: Re: [anti-abuse-wg] Input request for system on how to approach abuse filtering on Route Servers - bad hosters Hi Erik, This is a vital topic! You focused a bit on the Dutch community. However, I think it is globally significant. We at DE-CIX are very active in reacting to abusive peers on our IXPs. We have disconnected peers who were (repeatedly) not obeying the law or the DE-CIX Terms and Conditions. I gave a talk about what DE-CIX does in this regard during RIPE75 (https://ripe75.ripe.net/archives/video/103/). Disclaimer: I am not a lawyer. The European telecommunication law does not allow IXPs to look into peers' traffic on the application level (for a good reason, I believe). So, we do not know if a peer hosts malware or is sending out spam only. DE-CIX is only allowed to look into the operational data (e.g., Route or ASN hijacks) or behavior (e.g., unwanted traffic due to static routes on the Peering LAN). Based on this information, DE-CIX is acting. I am highlighting this because I see issues if IXPs (or carriers and transit providers) are used as central infrastructure to filter data due to information they cannot verify or generate. Just think about the central DNS filtering and censoring discussion we had on a European level to stop certain abusive and harmful Internet services from being accessible. Best regards, Thomas -- Dr. Thomas King Chief Technology Officer (CTO) DE-CIX Management GmbH | Lindleystraße 12 | 60314 Frankfurt am Main | Germany | www.de-cix.net<http://www.de-cix.net> | Phone +49 69 1730902 87 | Mobile +49 175 1161428 | Fax +49 69 4056 2716 | thomas.king(a)de-cix.net<mailto:thomas.king@de-cix.net> | Geschaeftsfuehrer Harald A. Summa and Sebastian Seifert | Registergericht AG Koeln HRB 51135 DE-CIX 25th anniversary: Without you the Internet would not be the same! Join us on the journey at https://withoutyou.de-cix.net From: connect-wg <connect-wg-bounces(a)ripe.net<mailto:connect-wg-bounces@ripe.net>> On Behalf Of Erik Bais Sent: Tuesday, 18 May 2021 21:52 To: connect-wg(a)ripe.net<mailto:connect-wg@ripe.net>; anti-abuse-wg(a)ripe.net<mailto:anti-abuse-wg@ripe.net> Subject: [connect-wg] Input request for system on how to approach abuse filtering on Route Servers - bad hosters Hi, As I asked during the Connect WG today, there are discussions currently going on in the Dutch network community to see if there is a way to get a cleaner feed from routeservers on internet exchanges. ( by default ) As you may know there is an Dutch Anti Abuse Network initiative ( AAN ) – abuse.nl The companies associated with AAN setup and all signed a manifest ( in Dutch - https://www.abuse.nl/manifest/ ) that states that we will all do our best to provide a better and cleaner internet. As members of the member organisation of the largest Internet Exchange, AMS-IX, we like to start with the discussion on asking the AMS-IX to filter certain AS numbers from the default routeserver view. The issue is that even if you don’t peer with certain networks directly, the change is very real that you will receive or that the other network receive your prefixes and that you may not want to peer with those networks. What we like to have is an independent way of generating a list with badhosts ( say a top 50 ) .. ( and with our Dutch infrastructure we have a couple on the Dutch infrastructure as well.. ) A couple years ago there was the list of HostExploit .. or one could have a look at the drop-list of SH .. Personally I would like a proper model that one can explain why a certain network is listed on a certain list with a clear method explaining of what kind of abuse is noted in the said network. Topics that should be included on the rating for the list : * Phishing (hosting sites / domain registrations ) * Malware hosting ( binaries and C&C’s ) * DDOS traffic ( number of amplification devices in the network compared to the number of IP address ratio ) * Login attacks / excessive port scanning * Hosting of Child exploitation content * Infected websites / Zeus Botnets * Etc So yeah, something similar as the Top 50 of HostExploit ranking .. but HostExploit stopped producing these lists in 2014. By filtering a top 50 of badness hosters on the Routeservers would remove the cheap IXP option for network connectivity at the better Internet Exchanges and provide a way to remove any DDOS traffic via BGP null-routing via Transits. And companies that would still want to peer with a certain network, can still do so by direct peering setup via the IXP infra. And it will not bring the IXP in a position where it will be asked on why they are still offering services to certain parties .. as that might become legally difficult especially in a membership organisation. So we don’t mind if we take their money as long as are not forced to peer with them via the routeservers. Your constructive feedback is highly appreciated. Regards, Erik Bais A2B Internet

4 6

Input request for system on how to approach abuse filtering on Route Servers - bad hosters
by Erik Bais 19 May '21

19 May '21

Hi, As I asked during the Connect WG today, there are discussions currently going on in the Dutch network community to see if there is a way to get a cleaner feed from routeservers on internet exchanges. ( by default ) As you may know there is an Dutch Anti Abuse Network initiative ( AAN ) – abuse.nl The companies associated with AAN setup and all signed a manifest ( in Dutch - https://www.abuse.nl/manifest/ ) that states that we will all do our best to provide a better and cleaner internet. As members of the member organisation of the largest Internet Exchange, AMS-IX, we like to start with the discussion on asking the AMS-IX to filter certain AS numbers from the default routeserver view. The issue is that even if you don’t peer with certain networks directly, the change is very real that you will receive or that the other network receive your prefixes and that you may not want to peer with those networks. What we like to have is an independent way of generating a list with badhosts ( say a top 50 ) .. ( and with our Dutch infrastructure we have a couple on the Dutch infrastructure as well.. ) A couple years ago there was the list of HostExploit .. or one could have a look at the drop-list of SH .. Personally I would like a proper model that one can explain why a certain network is listed on a certain list with a clear method explaining of what kind of abuse is noted in the said network. Topics that should be included on the rating for the list : * Phishing (hosting sites / domain registrations ) * Malware hosting ( binaries and C&C’s ) * DDOS traffic ( number of amplification devices in the network compared to the number of IP address ratio ) * Login attacks / excessive port scanning * Hosting of Child exploitation content * Infected websites / Zeus Botnets * Etc So yeah, something similar as the Top 50 of HostExploit ranking .. but HostExploit stopped producing these lists in 2014. By filtering a top 50 of badness hosters on the Routeservers would remove the cheap IXP option for network connectivity at the better Internet Exchanges and provide a way to remove any DDOS traffic via BGP null-routing via Transits. And companies that would still want to peer with a certain network, can still do so by direct peering setup via the IXP infra. And it will not bring the IXP in a position where it will be asked on why they are still offering services to certain parties .. as that might become legally difficult especially in a membership organisation. So we don’t mind if we take their money as long as are not forced to peer with them via the routeservers. Your constructive feedback is highly appreciated. Regards, Erik Bais A2B Internet

3 2

Re: [anti-abuse-wg] Input request for system on how to approach abuse filtering on Route Servers - bad hosters
by Thomas King 19 May '21

19 May '21

Hi Erik, This is a vital topic! You focused a bit on the Dutch community. However, I think it is globally significant. We at DE-CIX are very active in reacting to abusive peers on our IXPs. We have disconnected peers who were (repeatedly) not obeying the law or the DE-CIX Terms and Conditions. I gave a talk about what DE-CIX does in this regard during RIPE75 (https://ripe75.ripe.net/archives/video/103/). Disclaimer: I am not a lawyer. The European telecommunication law does not allow IXPs to look into peers' traffic on the application level (for a good reason, I believe). So, we do not know if a peer hosts malware or is sending out spam only. DE-CIX is only allowed to look into the operational data (e.g., Route or ASN hijacks) or behavior (e.g., unwanted traffic due to static routes on the Peering LAN). Based on this information, DE-CIX is acting. I am highlighting this because I see issues if IXPs (or carriers and transit providers) are used as central infrastructure to filter data due to information they cannot verify or generate. Just think about the central DNS filtering and censoring discussion we had on a European level to stop certain abusive and harmful Internet services from being accessible. Best regards, Thomas -- Dr. Thomas King Chief Technology Officer (CTO) DE-CIX Management GmbH | Lindleystraße 12 | 60314 Frankfurt am Main | Germany | www.de-cix.net <http://www.de-cix.net> | Phone +49 69 1730902 87 | Mobile +49 175 1161428 | Fax +49 69 4056 2716 | thomas.king(a)de-cix.net <mailto:thomas.king@de-cix.net> | Geschaeftsfuehrer Harald A. Summa and Sebastian Seifert | Registergericht AG Koeln HRB 51135 DE-CIX 25th anniversary: Without you the Internet would not be the same! Join us on the journey at https://withoutyou.de-cix.net From: connect-wg <connect-wg-bounces(a)ripe.net <mailto:connect-wg-bounces@ripe.net> > On Behalf Of Erik Bais Sent: Tuesday, 18 May 2021 21:52 To: connect-wg(a)ripe.net <mailto:connect-wg@ripe.net> ; anti-abuse-wg(a)ripe.net <mailto:anti-abuse-wg@ripe.net> Subject: [connect-wg] Input request for system on how to approach abuse filtering on Route Servers - bad hosters Hi, As I asked during the Connect WG today, there are discussions currently going on in the Dutch network community to see if there is a way to get a cleaner feed from routeservers on internet exchanges. ( by default ) As you may know there is an Dutch Anti Abuse Network initiative ( AAN ) – abuse.nl The companies associated with AAN setup and all signed a manifest ( in Dutch - https://www.abuse.nl/manifest/ ) that states that we will all do our best to provide a better and cleaner internet. As members of the member organisation of the largest Internet Exchange, AMS-IX, we like to start with the discussion on asking the AMS-IX to filter certain AS numbers from the default routeserver view. The issue is that even if you don’t peer with certain networks directly, the change is very real that you will receive or that the other network receive your prefixes and that you may not want to peer with those networks. What we like to have is an independent way of generating a list with badhosts ( say a top 50 ) .. ( and with our Dutch infrastructure we have a couple on the Dutch infrastructure as well.. ) A couple years ago there was the list of HostExploit .. or one could have a look at the drop-list of SH .. Personally I would like a proper model that one can explain why a certain network is listed on a certain list with a clear method explaining of what kind of abuse is noted in the said network. Topics that should be included on the rating for the list : * Phishing (hosting sites / domain registrations ) * Malware hosting ( binaries and C&C’s ) * DDOS traffic ( number of amplification devices in the network compared to the number of IP address ratio ) * Login attacks / excessive port scanning * Hosting of Child exploitation content * Infected websites / Zeus Botnets * Etc So yeah, something similar as the Top 50 of HostExploit ranking .. but HostExploit stopped producing these lists in 2014. By filtering a top 50 of badness hosters on the Routeservers would remove the cheap IXP option for network connectivity at the better Internet Exchanges and provide a way to remove any DDOS traffic via BGP null-routing via Transits. And companies that would still want to peer with a certain network, can still do so by direct peering setup via the IXP infra. And it will not bring the IXP in a position where it will be asked on why they are still offering services to certain parties .. as that might become legally difficult especially in a membership organisation. So we don’t mind if we take their money as long as are not forced to peer with them via the routeservers. Your constructive feedback is highly appreciated. Regards, Erik Bais A2B Internet

1 0

Anti-Abuse Working Group Chair Selection - RIPE 82
by alireza vaziri 17 May '21

17 May '21

Friends, The time has come and Brian's 3-year term as AA-WG Co-Chair will come to an end at RIPE 82. I would like to invite you for nominations, which could be done by yourself or others via email before Friday 7th of May. As explained here https://www.ripe.net/participate/ripe/wg/active-wg/anti-abuse/anti-abuse-wg… The AA-WG chair selection process would be reached over consensus, but if consensus cannot be reached, there will be a procedure for voting. The selection process outcome will be announced during the AA-WG session on Wednesday 19th of May. Cheers, -- Alireza Vaziri RIPE AA-WG Co-Chair

1 1

RIPE Abusing the Abuse contact check
by Nuno Vieira 04 May '21

04 May '21

Hello, This is at least the 2nd time in recent times that we got this behaviour below. I am now reporting the last one that happened this night, however similar one happened some months ago aswell. I believe something is miscoded at RIPE side, but here it goes: Yesterday, Sun, 2 May 2021 22:44:17 +0000 (UTC), i got an email from RIPE, via "zendesk" saying: ###################################################################### Subject: #371145 - Action Required: Confirm Abuse Contact Information (RIPE NCC) ... We have sent a validation link to this abuse contact. Please click on this link to confirm that the email address is valid and close this ticket. ###################################################################### Headers from email received from zendesk: (sent at 22:44:10 UTC) ###################################################################### Received: from x ([x]) by x (mail.x [x]) (amavisd-new, port x) with ESMTP id kNt8Ea9EyGXA for <x>; Sun, 2 May 2021 22:44:17 +0000 (UTC) Received: from outbyoip8.pod18.euc1.zdsys.com (outbyoip8.pod18.euc1.zdsys.com [188.172.138.8]) by x (Postfix) with ESMTPS id 4FYLkn3w7Yz2NlCH for <x>; Sun, 2 May 2021 22:44:17 +0000 (UTC) Received: from zendesk.com (unknown [10.218.219.234]) by outbyoip8.pod18.euc1.zdsys.com (Postfix) with ESMTP id 4FYLkf5rcyz14K2j; Sun, 2 May 2021 22:44:10 +0000 (UTC) Date: Sun, 02 May 2021 22:44:10 +0000 (02/05/2021 23:44:10) From: RIPE NCC Support <support(a)ripe.net> Reply-To: RIPE NCC Support <support(a)ripe.net> Cc: Nuno Vieira <x>, Member Contact <x> Message-Id: < DO8QLG3D2P_608f2b3a67286_2b2aeb05f3b964287882c_sprut(a)zendesk.com> In-Reply-To: <DO8QLG3D2P(a)zendesk.com> Subject: #371145 - Action Required: Confirm Abuse Contact Information (RIPE NCC) ###################################################################### Headers from RIPE with the magic link: (sent at 22:48:22 UTC) ###################################################################### Received: from x ([x]) by x (x [x]) (amavisd-new, port 10024) with ESMTP id 5Em8E0bGU80N for <x>; Sun, 2 May 2021 22:48:32 +0000 (UTC) Received: from pikapika.ripe.net (pikapika.ripe.net [IPv6:2001:67c:2e8:11::c100:1315]) by x (Postfix) with ESMTPS id 4FYLqh5LRtz2NlCH for <x>; Sun, 2 May 2021 22:48:32 +0000 (UTC) Received: from [193.0.1.40] (helo=limousin.ripe.net) by pikapika.ripe.net with esmtp (Exim 4.94) (envelope-from <unread(a)ripe.net>) id 1ldKsw-00010y-CN for x; Mon, 03 May 2021 00:48:22 +0200 Date: Mon, 3 May 2021 00:48:22 +0200 (CEST) (02/05/2021 23:48:22) From: RIPE Database Administration <unread(a)ripe.net> To: x Message-Id: <1840504553.488.1619995702382(a)limousin.ripe.net> Subject: Action Required: Confirm Abuse Contact Information (RIPE NCC) ###################################################################### Context: The allegated confirmation email with a link is only beign sent after the other contact to the LIR has been made, and those allegations are false. I have double checked mail server logs and there is no error, connection attempt or whatsoever that can support the "There was a transient network fault on the path to the mail server". ###################################################################### "The email address in the "abuse-mailbox:" attribute for the abuse-c ROLE object x-RIPE failed the automatic validation test: x There was a transient network fault on the path to the mail server. We have sent a validation link to this abuse contact. Please click on this link to confirm that the email address is valid and close this ticket." ###################################################################### My Questions are simple: - Did anyone else got this very same behaviour/situation ? - I would like to understand the rationale behind this, and if this is a bug or a feature... -- Kind regards, Nuno Vieira edgoo networks datacentre and it services

3 2

New on RIPE Labs: Remote Attestation Enabling Posture Assessment for Automated GRC
by Alun Davies 03 May '21

03 May '21

Dear colleagues, Our latest guest post from Kathleen Moriarty explains how attestation can provide system-level remediation and resiliency. Read more on RIPE Labs: https://labs.ripe.net/author/kathleen_moriarty/remote-attestation-enabling-… Kind regards, Alun Davies RIPE Labs Editor RIPE NCC

1 0

Revised DRAFT Agenda - AA-WG Session RIPE 82
by Brian Nisbet 29 Apr '21

29 Apr '21

Colleagues, Here is an updated draft agenda for our session on Wednesday 19th May at 10:30 CEST. A. Administrative Matters * Welcome * Scribe, Chat, Stenography * Chat Etiquette * Ratings Where Appropriate * Approve Minutes from RIPE 81 * Finalise agenda * Working Group Chair Selection B. Update * B1. Recent List Discussion C. Policies - *C.1. Continued? open discussion on abuse validation & next steps D. Interactions - *D.1. The DNS Abuse Institute, Graeme Bunton E. Presentation - *E.1. 'DDoS Never Dies? - An IXP Perspective on DDoS Amplification Attacks' - Daniel Kopp, DE-CIX X. A.O.B. Z. Agenda for RIPE 83 As always, please contact aa-wg-chair(a)ripe.net if you have any questions, suggestions, submissions or updates. Thanks, Brian Co-Chair, RIPE AA-WG Brian Nisbet (he/him) Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

1 0

AS8003 and U.S. Department of Defense routing
by Ronald F. Guilmette 28 Apr '21

28 Apr '21

Greetings friends, I though that you all might like to be aware of this: https://apnews.com/article/technology-business-government-and-politics-b26a… Regards, rfg

3 5

New article on RIPE Labs: Artificial Intelligence and Policy-Making Developments
by Athina Fragkouli 21 Apr '21

21 Apr '21

Dear all, I would like to announce a new RIPE Labs article "Artificial Intelligence and Policy-Making Developments – Council of Europe’s CAHAI" published today: https://labs.ripe.net/author/athina/artificial-intelligence-and-policy-maki… <https://labs.ripe.net/author/athina/artificial-intelligence-and-policy-maki…> As the first in a series of articles aimed at exploring how policy-making institutions are reacting to challenges posed by AI, I’ve written about how the Council of Europe seeks to examine the feasibility of a legal framework for the development, design and application of AI. As the series continues, our goal will be to raise awareness of these issues so that the technical community can get involved at the early stages of relevant discussions and provide appropriate input to policy makers. Thank you, Athina Fragkouli Chief Legal Officer RIPE NCC

1 0

DRAFT Agenda: RIPE82 Anti-Abuse WG Meeting
by Brian Nisbet 21 Apr '21

21 Apr '21

Colleagues, Here is the current draft agenda for the meeting. I do expect there to be a couple of changes between now and the session in May, but early drafts are good? I should also point out that there is still time in the meeting slot if anyone else would like to submit any content/work items/discussions etc. A. Administrative Matters * Welcome * Scribe, Chat, Stenography * Chat Etiquette * Ratings Where Appropriate * Approve Minutes from RIPE 80 * Finalise agenda * Working Group Chair Selection B. Update * B1. Recent List Discussion C. Policies - *C.1. Continued? open discussion on abuse validation & next steps D. Interactions - E. Presentation - *E.1. 'DDoS Never Dies? - An IXP Perspective on DDoS Amplification Attacks' - Daniel Kopp, DE-CIX X. A.O.B. Z. Agenda for RIPE 83 Brian Nisbet (he/him) Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

1 1