- anti-abuse-wg - mailman.ripe.net

Re: [anti-abuse-wg] update on netsecdb project
by Brian Nisbet 06 Apr '10

06 Apr '10

Frank, As discussed, I have copied my reply to the list. >> There has been an amount of discussion on this topic in both AA and DB >> working groups over the last few years but no concensus has been reached. >> >> At the meeting in Lisbon it was agreed between DB and AA that as no >> further comments had been made, the matter was to be closed. This does >> not, obviously, mean that it can't be raised again and both WGs would be >> most interested in any proposals you may have. > > This is simply weird. > How can anybody not agree what Spam is ? Many people agree what spam is, others disagree, the RIPE community is made up of many different people, but I'm not sure why a definition is important to this conversation? The matter was closed in Lisbon because no proposal had been produced since the last time one was asked for onlist. If there is now to be a proposal, then discussion will restart. > How can not anybody have an idea, how to solve the problem ? Many people have many ideas, not all of them work. There remains no silver bullet. And any recommendation made still needs to be adopted. > Usally there are to many ideas resulting in at least something to do. And many things have been discussed, and often solutions suggested. It is up to people to implement those suggestions or to make proposals to the RIPE community and perhaps ask the NCC to undertake a task. In addition, as we discussed in Lisbon and as we will be discussing again in Prague, the two chairs of the WG have been working with the NCC and international law enforcement to look at ways of furthering cooperation and putting procedures in place that can more directly tackle network abuse. However this is, as you must appreciate, not a simple or fast task. >> In this policy Tobias Knecht (tk(a)abusix.org) has stated that if he is >> successful in APNIC he plans to propose something similar in the RIPE >> region. I would suspect he is the best person to talk to about >> collaboration. > > I am already talking to him. Good stuff. > But as you know: he will need support from everybody to bring > this proposal also to RIPE. So it would be really nice if people on this > list dont strike him down because of politeness and instead support > what hes doing. Tobias and abusix have produced a number of different opinions in a very short period of time in operation, or at least in wide circulation. There is no mandate on how the members of any WG should treat the proposals of others, save to give them an honest and fair reading and treat everyone with respect. How the proposal is greeted will depend on how it is presented, but obviously the chairs will do what they can to allow for that fair hearing. >> we hope, in May, to chair another productive meeting. > > What will be discussed there ? > Agenda ? We're trying to finalise the agenda at the moment, but the work that is taking place with the NCC, the RIPE community and the LEAs will be playing a major part. I hope to have a first draft by the end of this week. Obviously if any proposals are brought to the WG before the meeting on Thursday 6th, discussion time for them will be allocated on the agenda. Brian.

1 0

Spam sent over IPv6 - See results on RIPE Labs
by Mirjam Kuehne 06 Apr '10

06 Apr '10

Dear colleagues, Sorry this comes a little late to this list. Last week we published some data about spam we receive over IPv6. Find the method and the results on RIPE Labs: http://labs.ripe.net/content/spam-over-ipv6 We will continue to measure this. If you have any comments or suggestions, please let us know. You can leave comments in the forum listed at the end of the article or send mail directly to me. Kind Regards, Mirjam Kühne RIPE NCC

1 0

RIPE 60 Agenda Items Reminder.
by Brian Nisbet 31 Mar '10

31 Mar '10

Afternoon, As we're now just over a month away from RIPE 60 in Prague, I'd like to remind you all that there is still agenda space for the WG session on Thursday 6th May at 16:00. As always we are interested in policy proposals, discussion points, presentations on new anti-abuse policies or methods and a wide range of other possible agenda items. Thanks, Brian.

1 0

RIPE 60 Agenda Items/Presentations
by Brian Nisbet 10 Mar '10

10 Mar '10

Colleagues, As we rapidly approach RIPE 60 now would be a wonderful time to propose material for the WG session, taking place on Thursday 6th May at 16:00. As always we are interested in policy proposals, discussion points, presentations on new anti-abuse policies or methods and a wide range of other possible agenda items. Richard and I look forward to seeing as many of you in Prague as possible! Regards, Brian.

1 0

Invalid abuse contact - reported to RIPE (fwd)
by Peter Hakanson 16 Dec '09

16 Dec '09

---------- Forwarded message ---------- Date: Wed, 16 Dec 2009 09:09:25 -0600 From: Alfred Moshurchak <alfredm(a)sasktel.net> To: tangoit(a)tango.lu, ops(a)ripe.net Cc: vpiocel(a)tango.lu, anti-abuse-wg(a)ripe.net Subject: [anti-abuse-wg] Invalid abuse contact - reported to RIPE The original message was received at Wed, 16 Dec 2009 08:27:06 -0600 from gluon [127.0.0.1] This seems to be a tele2 company, try mailing staff(a)swip.net as they has done a proper job. peter h ----- The following addresses had permanent fatal errors ----- <abuse(a)tele2.lu> (reason: 550 5.1.1 <abuse(a)tele2.lu>: Recipient address rejected: User unknown) ----- Transcript of session follows ----- ... while talking to mail.tango.lu.: >>> DATA <<< 550 5.1.1 <abuse(a)tele2.lu>: Recipient address rejected: User unknown 550 5.1.1 <abuse(a)tele2.lu>... User unknown <<< 554 5.5.1 Error: no valid recipients 212.66.87.232 = [ ] (Asked whois.ripe.net:43 about 212.66.87.232) inetnum: 212.66.64.0 - 212.66.95.255 netname: LU-TANGOMOBILE-19990118 descr: Tango Mobile S.A. country: LU org: ORG-TMS6-RIPE admin-c: tvdw14-ripe tech-c: VP612-RIPE status: ALLOCATED PA mnt-by: RIPE-NCC-HM-MNT mnt-lower: TANGO-MNT mnt-routes: TANGO-MNT mnt-domains: TANGO-MNT source: RIPE Filtered organisation: ORG-TMS6-RIPE org-name: Tango Mobile S.A. org-type: LIR descr: tango-mnt address: Tango Mobile S.A. Route de Luxembourg 177 L-8077 Bertrange Luxembourg phone: 35227777101 fax-no: 35227777333 e-mail: tangoit(a)tango.lu admin-c: tvdw14-ripe admin-c: vp612-ripe mnt-ref: mnt-tango mnt-ref: RIPE-NCC-HM-MNT mnt-ref: TANGO-MNT mnt-by: RIPE-NCC-HM-MNT source: RIPE Filtered person: Tanguy van de Walle address: Tango Mobile S.A. address: rue de Luxembourg 177 address: 8077 Bertrange address: Luxembourg phone: 35227777445 nic-hdl: TvdW14-RIPE source: RIPE Filtered person: Vincent Piocel address: Tango Mobile SA address: 177 rue de Luxembourg address: L-8077 Bertrange address: Luxembourg mnt-by: tango-mnt e-mail: vpiocel(a)tango.lu phone: 352 27 777 440 fax-no: 352 27 777 333 nic-hdl: VP612-RIPE source: RIPE Filtered route: 212.66.64.0/19 descr: Tele2 Luxembourg descr: TELE2 / SWIPNET descr: In case of improper use originating from our network please mail abuse(a)tele2.lu origin: AS9045 mnt-by: TELE2EUROPE-MNT mnt-routes: AS1257-MNT source: RIPE Filtered

1 0

Invalid abuse contact - reported to RIPE
by Alfred Moshurchak 16 Dec '09

16 Dec '09

The original message was received at Wed, 16 Dec 2009 08:27:06 -0600 from gluon [127.0.0.1] ----- The following addresses had permanent fatal errors ----- <abuse(a)tele2.lu> (reason: 550 5.1.1 <abuse(a)tele2.lu>: Recipient address rejected: User unknown) ----- Transcript of session follows ----- ... while talking to mail.tango.lu.: >>> DATA <<< 550 5.1.1 <abuse(a)tele2.lu>: Recipient address rejected: User unknown 550 5.1.1 <abuse(a)tele2.lu>... User unknown <<< 554 5.5.1 Error: no valid recipients 212.66.87.232 = [ ] (Asked whois.ripe.net:43 about 212.66.87.232) inetnum: 212.66.64.0 - 212.66.95.255 netname: LU-TANGOMOBILE-19990118 descr: Tango Mobile S.A. country: LU org: ORG-TMS6-RIPE admin-c: tvdw14-ripe tech-c: VP612-RIPE status: ALLOCATED PA mnt-by: RIPE-NCC-HM-MNT mnt-lower: TANGO-MNT mnt-routes: TANGO-MNT mnt-domains: TANGO-MNT source: RIPE Filtered organisation: ORG-TMS6-RIPE org-name: Tango Mobile S.A. org-type: LIR descr: tango-mnt address: Tango Mobile S.A. Route de Luxembourg 177 L-8077 Bertrange Luxembourg phone: 35227777101 fax-no: 35227777333 e-mail: tangoit(a)tango.lu admin-c: tvdw14-ripe admin-c: vp612-ripe mnt-ref: mnt-tango mnt-ref: RIPE-NCC-HM-MNT mnt-ref: TANGO-MNT mnt-by: RIPE-NCC-HM-MNT source: RIPE Filtered person: Tanguy van de Walle address: Tango Mobile S.A. address: rue de Luxembourg 177 address: 8077 Bertrange address: Luxembourg phone: 35227777445 nic-hdl: TvdW14-RIPE source: RIPE Filtered person: Vincent Piocel address: Tango Mobile SA address: 177 rue de Luxembourg address: L-8077 Bertrange address: Luxembourg mnt-by: tango-mnt e-mail: vpiocel(a)tango.lu phone: 352 27 777 440 fax-no: 352 27 777 333 nic-hdl: VP612-RIPE source: RIPE Filtered route: 212.66.64.0/19 descr: Tele2 Luxembourg descr: TELE2 / SWIPNET descr: In case of improper use originating from our network please mail abuse(a)tele2.lu origin: AS9045 mnt-by: TELE2EUROPE-MNT mnt-routes: AS1257-MNT source: RIPE Filtered

1 0

Reporting email abuse
by Choice Hosting Support 14 Dec '09

14 Dec '09

Hello Support Our hosting servers seem to be receiving bank phishing spam mail from one of your IP addresses. Could you please look into this? We have included the headers of one of these mails below. If you have any questions, please feel free to contact us. Kind Regards Stephen Waters www.ChoiceHosting.co.za Tel. 0878 058 729 Email: support(a)choicehosting.co.za Return-path: <internet(a)absa.co.za> Envelope-to: support(a)choicehosting.co.za Delivery-date: Mon, 14 Dec 2009 07:16:33 +0200 Received: from mx.bsslaw.net ([194.154.196.196]) by host.choiceserver1.com with esmtp (Exim 4.69) (envelope-from <internet(a)absa.co.za>) id 1NK3IK-0007rG-Fv for support(a)choicehosting.co.za; Mon, 14 Dec 2009 07:16:29 +0200 Received: from MAIL-SERVER.BSSLAW.local (Not Verified[192.168.10.1]) by mx.bsslaw.net with MailMarshal (v6,7,2,8378) id <B4b25ca050000>; Mon, 14 Dec 2009 06:15:49 +0100 Received: from User ([41.28.112.10]) by MAIL-SERVER.BSSLAW.local with Microsoft SMTPSVC(6.0.3790.3959); Mon, 14 Dec 2009 06:15:48 +0100 From: "ABSA ONLINE"<internet(a)absa.co.za> Subject: {Spam?} {Disarmed} ACCOUNT NOTIFICATION Date: Mon, 14 Dec 2009 05:16:12 -0000 MIME-Version: 1.0 Content-Type: text/html; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Bcc: Message-ID: <NODE01PXCFbN4TZyabY000001c6(a)MAIL-SERVER.BSSLAW.local> X-OriginalArrivalTime: 14 Dec 2009 05:15:48.0833 (UTC) FILETIME=[7F60F510:01CA7C7C] X-Choicehosting-MailScanner-Information: Please contact the ISP for more information X-Choicehosting-MailScanner-ID: 1NK3IK-0007rG-Fv X-Choicehosting-MailScanner: Found to be clean X-Choicehosting-MailScanner-SpamCheck: spam, SpamAssassin (not cached, score=11.434, required 5, FORGED_MUA_OUTLOOK 4.20, FORGED_OUTLOOK_HTML 0.00, FORGED_OUTLOOK_TAGS 0.00, HTML_IMAGE_ONLY_28 1.52, HTML_MESSAGE 0.00, MIME_HTML_ONLY 1.67, MISSING_HEADERS 1.58, SPF_SOFTFAIL 0.65, SUBJ_ALL_CAPS 1.81) X-Choicehosting-MailScanner-SpamScore: sssssssssss X-Choicehosting-MailScanner-From: internet(a)absa.co.za -----Original Message----- From: ABSA ONLINE [mailto:internet@absa.co.za] Sent: 14 December 2009 07:16 Subject: {Spam?} {Disarmed} ACCOUNT NOTIFICATION Absa Bank Group<http://www.absa.co.za/absacoza/images/homepage/logo_btm.gif> function checkForm() { var valid = false; if (document.form01.sq.value == '') { alert("Please type the word(s) you wish to search for."); } else { valid = true; } return valid; } INTRODUCING: Absa New Secure Server We have been warning customers to upgrade to our new server. Fraudsters have devised a new method of defrauding customers. With this new fraud scheme they use the traditional method of identity theft (phishing), Hacking into customers online banking, to avoid phishing and identity theft we advice you login to our secure server Go straight to your Absa for procedures to follow: Click Here to continue <http://marionlodge.sproductions.co.za/catalog/pub/get_ready/absa.htm> Absa Bank will not be responsible for loss of funds to hackers as a result of failure to comply with this important new directives. We are committed to serving you better. Bank and stay safe online.Security Management Absa Bank Group Please do not reply to this e-mail. Mail sent to this address cannot be answered. For assistance, log in to your absa Online account and choose the "Help" link on any page. absa bank Email ID # 1009

2 1

False address in database
by O. Kolesnikov 08 Dec '09

08 Dec '09

IP 89.248.175.0 - 89.248.175.127 Fake registration. No such company, no such place in Moscow (Chistie Prudi 22/1). (No "Chistie Prudi" street in "Moscow Russia"; Chistie Prudi - the name of ponds in old part of Moscow, here only 2 ponds, not 22 ;)) proper street is named "Chistoprudny boulevard". It just about "Thames 22/1, London GB".) In addition 89.248.175.0-24 = "Route object" for Ecatel (AS29073) hosting provider (ecatel.net) - known as hoster for spambots and malware. This provider, registered in Great Britain, used datacenter in Amsterdam, has no office (real address, but nobody from this company was found here), no phone, no website. Obviously, this false registration is used for the purpose of camouflaging of illegal activity on this provider. OK.

1 0

RIPE 59 WG Minutes
by Brian Nisbet 04 Nov '09

04 Nov '09

Afternoon, Thanks to the lovely people in the NCC here are the draft minutes for the WG Session in Lisbon. Please let me know if you have any comments or objections: RIPE 59 Meeting Lisbon Anti-Abuse Working Group Thursday, 8 October 2009, 16:00 Chair: Brian Nisbet Scribe: Pedro Vaz, RIPE NCC Jabber: Gerardo Viviers, RIPE NCC A. Administrative Matters The Working Group (WG) Chair, Brian Nisbet, welcomed the attendees and explained that the WG Co-Chair, Richard Cox, was unable to attend. He announced an extra presentation that was not included in the initial agenda: "Phishing Lock" Ian Meikle, Nominet presented The minutes from RIPE 58 were approved without any comments. B2. Recent List Discussion - Abuse contacts, Sanctions etc. Brian asked if there was someone in the audience who had any opinion about about methods of contacting ISPs about abuse and if the audience could contribute any suggestions on how to handle it. Marco Hogewoning (xs4all) mentioned that there has been an increase in people trying to contact, for example, admin contacts in the organisation attribute in the Database. He added that it all comes down to educating people. He suggested that tutorials on how to use the RIPE Database to get to the correct contacts are created. They could be made available on RIPE Labs. He also added that there seemed to have been better common sense but this has been slipping away lately. Pavel Kácha (CESNET) said that he sees this from both sides. He stands on the side that generates the email and that side that reaches the abuse box. He pointed out a problem that they often run into, which is that the contact mailboxes are often not valid so they have to escalate and use other means. Brian asked Pavel what his default action was. Pavel replied that it is to use the right box. Brian asked on what level checking can be done on the validity of anti-abuse contacts in the database and what kind of sanctions could be applied if these are not valid. Marco said that these kind of checks were very difficult to perform, took a lot of work and might not even be valid. This is the same with the sanctions to be applied. Wilfred Woeber (Vienna University) said that he saw a couple of developments. He mentioned that it's now fashionable to install automatic tools which perform intrusion detection. An individual complaint is created every time a new case is verified. The problem is that this could be become another sort of spam and could even be used as a way to perform a 'denial of service' attack, if you get it from many sources at the same time. Wilfred added that some parties claim that the right way to go is to retrieve the responsible party for some resources up the tree, and then send them an individual notification. He said however, that his own experience tells him that no one really sees this as the way to go. He asked the community if anyone agrees that this is the right method. Lance Wright (Chocolate Redhead) stated that people spam because they make money with it. He mentioned that he worked with a number of companies that use a community-based system, where if someone marks a piece of spam, then everyone else in the community will know it. This makes it possible to detect spam and send it back to where it came from. It deals with spam on the financial level and ends up demotivating spammers and this will end up leaving the community members alone. He added that in the UK this community consists of about 150,000-170,000 users. Marco asked how the system knows where the mails are sent from because normally these emails use fake envelopes. Lance answered that it is proprietary information but that that if Marco would sign a Non-Disclosure Agreement he would be glad to discuss it offline. Brian agreed with Marco on the point that he doesn't know of any way to test if an abuse contact is valid or not. He posed the question of whether it is appropriate for people to search for admin or billing contacts if the abuse contact is not valid. And, if people, by default, already consider the abuse contact less likely to be valid they go immediately in search of admin or billing contacts. Lance said that it depended on the spam. If the spammer is a company trying to sell you something, you'd go back to them. The one offering the technology won't take any responsibility. Marco acknowledged that more or less everybody in the room kind of like behaves himself and looks for abuse contacts, and only when these are not valid, does he go to the admin contacts. However he said that these complaints also become a form of spam and might end up being filtered. He put the question to the audience: where would someone go next if everyone just starts filtering admin contacts? Brian asked if anyone thought that the right way to go is to get to the highest point of registration and handle things there, or contact the most accurate object, which was what's right in his opinion. Marco said that maybe this question should be asked in the plenary when there is a bigger audience. Brian posed a new question for people who operate an abuse desk: would they prefer a complaint email per incident would they would rather receive single emails, single points. Pavel replied absolutely not. Brian thought that individual emails would be preferable. Pavel said that he would prefer a method where complaints are aggregated in some way. He pointed out the fact that if a complaint was generated for each and every spam, then by definition, you would be generating spam as well. He added that this creates collateral damage. Brian thanked the WG for the comments. B3. Dutch ISPs Antibotnet Action Marco Hogewoning, XS4ALL http://www.ripe.net/ripe/meetings/ripe-59/presentations/hogewoning-ISP-botn… There were no questions. B4. Phishing Lock Ian Meikle, Nominet http://www.ripe.net/ripe/meetings/ripe-59/presentations/meikle-phishing-loc… There were no questions. C. Technical Measures C1. RIPE NCC Tools for Anti-Abuse Emile Aben, RIPE NCC http://www.ripe.net/ripe/meetings/ripe-59/presentations/aben-rex.pdf Shane Kerr (ISC) asked if anyone had approached him with concerns that this information is published in such an easy to get format would make them look bad. For example, someone with a network with lots of blacklisted entries. Emile answered no and added that this all publicly available information anyways. Shane said that this was like saying that DNS is public so he could do everything he wants with it, which is not strictly true. He added that he could discuss this offline afterwards. Brian said that if people did not like, it would just be a pity for them. Shane agreed but added that if he would have been an LIR with bad information published about it, he would have been annoyed. He said however, that he's glad that this is being done and that he was just asking if these issues have come up. Emile said that this is why it's on RIPE Labs. It's a prototype and not a production service. If serious issues arise it could be removed from the site. Brian said that it's a nice tool to get historical information from net blocks. D. Interactions D1. Working Groups Database Working Group: irt objects. No comments have been made, so this point was closed D2. Law Enforcement Interaction Brian brought up the topic of registry closures. He asked the attendees if it was clear what the RIPE NCC can and cannot do regarding root resources at the moment. There were no comments from the audience. He also asked if it was clear enough that if the community thought that the RIPE NCC should be able do something about this, it would have to be raised at policy level. He said that the Anti Abuse Working Group would be the most likely place for this to be done. There were no comments from the audience. Brian mentioned a set of meetings and talks with people from governments and law enforcement agencies where it's explained to them how the RIPE community and the RIPE NCC operate, and how they can be involved in the process. He asked the audience if there was anything that they thought could be brought to these meetings. There were no comments from the audience. E. Documents E1. BCP Documentation - irt object/abuse contact recommendations Brian said that this is not finished yet but it will be completed. X. A.O.B. There was no other business. Z. Agenda for RIPE 60 - Plenary Presentations Brian thanked the attendees and closed the Working Group session at 17:15.

1 0

Antispam measures
by Chimel Chimel 24 Oct '09

24 Oct '09

Hi, I am not sure this mailing list is still active, the latest archived mail dates back from over a year ago. I have 3 questions for this mailing list: 1) Does RIPE or other registrars impose antispam fighting measures or a code of conduct to the ISPs or telcos it allocates IP ranges to? For instance, do these registrar customers specifically sign an agreement never to post spam themselves. Do they also sign an agreement to terminate IP sub-allocation or contract with their own customers who are using their IP addresses to post spam? 2) If there is such measures, how does RIPE enforce them? 3) What does RIPE intends to do about Ukrtelecom, who is alone responsible for hundreds of thousands of daily spam posts in discussion forums and BBSs? According to the people in stopforumspam.com, every single post emanating from ukrtelecom is spam, there is not a single genuine user from that telco. How can RIPE allocate hundreds of separate IP ranges to this single telco, especially if it is only a support for spam, not a telco at all. When querying the RIPE database for ukrtelecom, it returns 300 IP ranges, but that's only because the web site is limited to 300 answers. I'd like to see the whole list in order to ban it all from my forum, even if it means banning genuine users from Ukraine. And of course, when I say ukrtelecom is a spammer site, I really means it is a mafia site that makes millions of dollars every month in illegal activities, selling dangerous fake medicines such as viagra or tamiflu. In these times of IP addresses shortening, it would make a lot more IPs available if the registrars would cancel IP allocation from the customers who break the antispam rules. Thanks, Chimel. By the way, a BBS seems to be a more adequate way than a mailing list to handle this kind of discussion. Just my 2 cents. _________________________________________________________________ A la recherche de bons plans pour une rentrée pas chère ? Bing ! Trouvez ! http://www.bing.com/search?q=bons+plans+rentr%C3%A9e&form=MVDE6

12 19