- anti-abuse-wg - mailman.ripe.net

Fwd: [anti-abuse-wg] Antispam measures
by peter håkanson 21 Oct '09

21 Oct '09

Begin forwarded message: > From: peter håkanson <peter(a)hk.ipsec.se> > Date: October 21, 2009 11:33:51 AM GMT+02:00 > To: Florian Weimer <fweimer(a)bfk.de> > Subject: Re: [anti-abuse-wg] Antispam measures > content-type: text/plain; charset=iso-8859-1; format=flowed; delsp=yes > mime-version: 1.0 (Apple Message framework v1076) > x-universally-unique-identifier: fcad27c0-c289-49cd-80b3-1b91332e229d > in-reply-to: <82vdi9uo14.fsf(a)mid.bfk.de> > content-transfer-encoding: quoted-printable > x-smtp-server: bore.hk.ipsec.se > message-id: <5036E015-CC9D-4D2E-AD84-FB340601B07F(a)hk.ipsec.se> > references: <COL117-W30F981CC6FF1583F0A2A20D2C00(a)phx.gbl> <82vdi9uo14.fsf(a)mid.bfk.de > > > > > On Oct 21, 2009, at 10:52 AM, Florian Weimer wrote: > >> * Chimel Chimel: >> >>> 1) Does RIPE or other registrars impose antispam fighting measures >>> or a code of conduct to the ISPs or telcos it allocates IP ranges >>> to? >> >> No, not that I know. >> >>> For instance, do these registrar customers specifically sign an >>> agreement never to post spam themselves. Do they also sign an >>> agreement to terminate IP sub-allocation or contract with their own >>> customers who are using their IP addresses to post spam? >> >> No, surely not. That would be poor service. You don't want to lose >> your IP resources just because your infrastructure has been >> compromised. 8-( > > On the contrary, a real risk of loosing their allocation might be > a good motivation to run their shop accordingly. As of today some > providers don't care ( and will benefit from spammers). > > Just like alkohol-serving firms ( bars etc) if they don't run ther bar > according to local rules they will loose the permits. > We don't allow sleazy hospitals either. Why should we permit > sleazy ISP's to poison our vital infrastructure ?? > >> >>> 2) If there is such measures, how does RIPE enforce them? >> >> There is no enforcement. >> >>> 3) What does RIPE intends to do about Ukrtelecom, who is alone >>> responsible for hundreds of thousands of daily spam posts in >>> discussion forums and BBSs? >> >> Well ... >> >>> According to the people in stopforumspam.com, every single post >>> emanating from ukrtelecom is spam, there is not a single genuine >>> user from that telco. >> >> ... so you should be lucky that it's so easy to filter that type of >> spam. If you shut down netblocks, the badness just spreads far and >> wide and gets more difficult to track. >> >> Of course, if the activity is indeed illegal, it should be stopped. >> One problem we face is that a lot of questionable practices (DNS >> poisoning, injecting pop-ups with ads, installing software on PCs >> without informed consent) are also carried out by obviously >> legitimate >> businesses, so it's often difficult to convince a prosecutor that >> it's >> illegal. >> >> On top of that, many legal scholars claim that in the EU, once you >> say >> the magic word, "telco", you are no longer responsible for the >> traffic >> you handle, much like anyone could seek asylum in Germany (until we >> got rid of this constitutional guarantee in the 90s, which was rather >> disappointing because nothing expresses your national wealth better >> than an almost unconditional willingness to share it). This blanket >> liability exemption is the root of the problem, and it is pretty much >> unique to the telco sector, at least in its generality. It has to >> go. > > We don't have to resort to legal discussions here , if RIPE supplies > goods > under some conditions, any breakage of that condition is enought > to terminate the contract. It's a deal between business partners. >> >>> I'd like to see the whole list in order to ban it all from my forum, >>> even if it means banning genuine users from Ukraine. >> >> The relevant parts of the RIPE database is available from >> ftp.ripe.net. In the past, I've generated anti-abuse ACLs from mnt- >> by >> handles, which was surprisingly effective. Using BGP might help as >> well. >> >> -- >> Florian Weimer <fweimer(a)bfk.de> >> BFK edv-consulting GmbH http://www.bfk.de/ >> Kriegsstraße 100 tel: +49-721-96201-1 >> D-76133 Karlsruhe fax: +49-721-96201-99 >> >> >> > > > ====================================================== > Peter Håkanson Phone +46707328101 Fax +4631223190 > IPSec sverige Email peter(a)ipsec.se > "Safe by design" Address Bror Nilssons gata 16 > Lundbystrand > S-417 55 Gothenburg Sweden > > > ====================================================== Peter Håkanson Phone +46707328101 Fax +4631223190 IPSec sverige Email peter(a)ipsec.se "Safe by design" Address Bror Nilssons gata 16 Lundbystrand S-417 55 Gothenburg Sweden

1 0

Fwd: [anti-abuse-wg] Antispam measures
by peter håkanson 21 Oct '09

21 Oct '09

Begin forwarded message: > From: peter håkanson <peter(a)hk.ipsec.se> > Date: October 21, 2009 10:22:13 AM GMT+02:00 > To: Chimel Chimel <chimel31(a)live.fr> > Subject: Re: [anti-abuse-wg] Antispam measures > > > On Oct 20, 2009, at 11:10 PM, Chimel Chimel wrote: > >> Hi, >> >> I am not sure this mailing list is still active, the latest >> archived mail dates back from over a year ago. > > yes, the list is sprodically active, however the working group has > given up > with spam and calls itself 'anti-abuse' these days. > >> I have 3 questions for this mailing list: >> >> 1) Does RIPE or other registrars impose antispam fighting measures >> or a code of conduct to the ISPs or telcos it allocates IP ranges to? >> For instance, do these registrar customers specifically sign an >> agreement never to post spam themselves. Do they also sign an >> agreement to terminate IP sub-allocation or contract with their own >> customers who are using their IP addresses to post spam? >> >> 2) If there is such measures, how does RIPE enforce them? >> >> 3) What does RIPE intends to do about Ukrtelecom, who is alone >> responsible for hundreds of thousands of daily spam posts in >> discussion forums and BBSs? >> According to the people in stopforumspam.com, every single post >> emanating from ukrtelecom is spam, there is not a single genuine >> user from that telco. >> How can RIPE allocate hundreds of separate IP ranges to this single >> telco, especially if it is only a support for spam, not a telco at >> all. >> When querying the RIPE database for ukrtelecom, it returns 300 IP >> ranges, but that's only because the web site is limited to 300 >> answers. >> I'd like to see the whole list in order to ban it all from my >> forum, even if it means banning genuine users from Ukraine. >> And of course, when I say ukrtelecom is a spammer site, I really >> means it is a mafia site that makes millions of dollars every month >> in illegal activities, selling dangerous fake medicines such as >> viagra or tamiflu. >> In these times of IP addresses shortening, it would make a lot more >> IPs available if the registrars would cancel IP allocation from the >> customers who break the antispam rules. > > Amen ! > > In the meantime, block the offending ranges. This will make the ip's > isolated. A number > of blocklists is available that keeps current records of offending > ranges. > >> >> Thanks, >> Chimel. >> >> By the way, a BBS seems to be a more adequate way than a mailing >> list to handle this kind of discussion. Just my 2 cents. >> >> Gratuit : Hotmail plus rapide avec Internet Explorer 8 ! Cliquez >> ici ! > > > ====================================================== > Peter Håkanson Phone +46707328101 Fax +4631223190 > IPSec sverige Email peter(a)ipsec.se > "Safe by design" Address Bror Nilssons gata 16 > Lundbystrand > S-417 55 Gothenburg Sweden > > > ====================================================== Peter Håkanson Phone +46707328101 Fax +4631223190 IPSec sverige Email peter(a)ipsec.se "Safe by design" Address Bror Nilssons gata 16 Lundbystrand S-417 55 Gothenburg Sweden

1 0

AA-WG Draft Agenda - RIPE 59
by Brian Nisbet 25 Sep '09

25 Sep '09

Colleagues, Apologies for the delay, but here is the draft agenda for the meeting at 16:00 on Thursday 8th October. A. Administrative Matters * Welcome * Finalise agenda * Approve minutes from RIPE 58 B Update * B1. Fast-Flux Legitmacy & Network Abuse Update - Richard Cox * B2. Recent List Discussion - Abuse contacts, Sanctions etc. C. Technical Measures * C1. RIPE NCC Tools for Anti-Abuse - Mark Dranse, RIPE NCC D. Interactions * D1. Working Groups - Database Working Group, IRT objects. * D2. Law Enforcement Interaction E. Documents E1. BCP Documentation - IRT object/abuse contact recommendations X. A.O.B. Z. Agenda for RIPE 60; Plenary Presentations Regards, Brian.

1 0

Further Call for Agenda Items
by Brian Nisbet 10 Sep '09

10 Sep '09

Afternoon, There is still some space left on the agenda for the WG meeting in Lisbon. The meeting plan can be found here: http://www.ripe.net/ripe/meetings/ripe-59/meeting-plan.html The Anti-Abuse WG meeting will be taking place on Thursday at 16:00. If you have anything you'd like to discuss or present, please let me know as soon as you can. Regards, Brian.

1 0

RIPE 59: Call for Agenda Items
by Brian Nisbet 19 Aug '09

19 Aug '09

Afternoon, As you will have seen, the meeting plan for RIPE 59 in Lisbon has been published here: http://www.ripe.net/ripe/meetings/ripe-59/meeting-plan.html The Anti-Abuse WG meeting will be taking place on Thursday at 16:00. If you have any think you think would be of benefit to the WG to discuss, any policy proposals you would like to air (although, of course, any such things will need to go through the PDP) or anything of the like, please let Richard or I know. Thanks, Brian.

1 0

blacklisted IPs
by Danijel Kovacic 17 Aug '09

17 Aug '09

Hi, We have a problem with allocated address range to CARNet (Croatian Academic and Research Network) which RIPE have assigned to us a few months ago. The range is 82.132.0.0 /17. Some of the world wide companies keep old records about IP addresses in their databases so that makes problems to our users. The problem is that our new IP range was in use in some company in Teheran, Iran so many of the companies have that range on their "black lists". For example, our users who have address 82.132.x.x are not allowed to use Pay Pal or download Google Earth ("Google Pack is not available in your county".) Please, can anyone advice us what we can do concerning this problem. x-ncc-regid: <hr.carnet> Regards, Danijel Kovacic CARNet, Croatia

2 2

RE: [anti-abuse-wg] blacklisted IPs
by Thor Kottelin 14 Aug '09

14 Aug '09

> Date: Fri, 14 Aug 2009 08:16:38 +0200 > From: Danijel Kovacic <danijel.kovacic(a)carnet.hr> > To: anti-abuse-wg(a)ripe.net > CC: "ripe(a)carnet.hr" <ripe(a)carnet.hr> > Some of the world wide companies keep old records about IP > addresses in > their databases so that makes problems to our users. > > The problem is that our new IP range was in use in some company in > Teheran, Iran so many of the companies have that range on their > "black > lists". For example, our users who have address 82.132.x.x are not > allowed to use Pay Pal or download Google Earth ("Google Pack is > not > available in your county".) Various services exist that attempt to map IP addresses to countries. Your problem is a good example of why that is not as good an idea as it may seem at first glance. Perhaps you could find out which services are causing the most trouble and have them update your information so that you will not need to contact each of their users separately. -- Thor Kottelin http://www.anta.net/

1 0

Attack
by Bruce Fornes 30 Jul '09

30 Jul '09

My home computer is being attacked by 78.47.186.165, 80. So far Symantec has stopped this illegal entry attempt. Following is the text from my Norton history: An intrusion attempt by 78.47.186.165 was blocked Application path \DEVICE\HARDDISKVOLUME1\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE Risk Name: HTTP Malicious Toolkit Variant Activity Attacking Computer: 78.47.186.165,80 Attacker URL: kb952069.in/eng.php?grp=15&trk=07292004728241237 Traffic Description: TCP-www-http I would appreciate if you stop these attacks coming through RIPE. Bruce Fornes Valdosta, GA USA

2 1

Re: [db-wg] please test email validity in whois records
by Marco Hogewoning 30 Jul '09

30 Jul '09

Hi Tobias, Have a look at the archives[1]. I think I answered them years ago already. IRT is virtually non existent and the database has already been changed to contain abuse related information in an attribute clearly named "abuse-mailbox" to try and get away from the freeform remarks fields people tend to use. So basically it's al there but nobody uses it, not every address user fills in the right details and when the information is there people are happily ignoring it by only searching for the least specific range. Now I might be a bit biased regarding the technical solutions being in place but I do think database wise all mechanisms and fields are there. What's left is to get people to use it and I'm not only talking about the people who register address blocks in the database but also the people who retrieve that information (or at least try to). Now obviously you could try and change the policy that any address blocks registered need to have certain information attached to it, but how to enforce this information is correct and more importantly stays correct and what to do with the over 3 billion addresses registered already today ? Secondly you might still want to try and get more information out there on how to use the information in the ripe database to get to the correct people, we had some attempts when working on the abuse-mailbox attr but it never really took off. Grtx, Marco [1] http://www.ripe.net/ripe/meetings/ripe-47/presentations/ripe47-db-abusec.pdf On Jul 29, 2009, at 8:31 PM, Tobias Knecht wrote: > Hi, > > we are talking to the Abuse Working Group at the moment and we will > start a discussion soon about exactly this. > > Parts of the discussion will be: > - IRT Object usage > - One place to put the abuse@ contact data. (not neccesarily making it > mandatory, but if somebody wants to offer it, everybody should do it > at > the same place. > - ... > > While waiting for that discussion you could have a look at this. > > http://www.abusix.de/abuse-contact-db/ > > We build up this Database and you can use it for free. > Next step is to get it out the beta status, which has nothing to do > with > the data accuracy, more with speeding up some update processes in the > backend. > > Another thing we are working on at the moment is a validation of email > addresses we offer and give back status codes for working or not > working > addresses. Since abusix.org is a volunteer driven project, this > takes a > little bit of time. ;-) > > So feel free to use it and give us hints or suggestions what is good > and > what is not good. > > Thanks, > > Tobias > > -- > abusix.org >

1 0

RIPE 409/BCP Document Update
by Brian Nisbet 08 Jun '09

08 Jun '09

Colleagues, As we mentioned at the recent meeting in Amsterdam we would very much like to work towards updating RIPE 409 to acknowledge both the changed focus of the WG and the changing nature of network abuse. I'm hoping that a relatively small group can be formed to work on this and some of you have already been kind enough to express your interest. If there is anyone else would would like to participate in this work then it would be great if you could let me know over the course of this week. The aim would be, at the very least, to present a draft document at RIPE 59 in Lisbon. Regards, Brian. -- Brian Nisbet HEAnet Limited, Ireland's Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin 1 Registered in Ireland, no 275301 tel: +35316609040 fax: +35316603666 web: http://www.heanet.ie/

1 0