- anti-abuse-wg - mailman.ripe.net

Few Points on Documentation
by Bradley Freeman 27 Apr '09

27 Apr '09

Just a few questions, the only document I can find associated with the anti abuse wg is ripe-409 Good Practice in Minimising E-mail Abuse (Are there any more?). As it was initially crafted when the working groups focus was primarily on anti spam and now that the working group is looking at ways of reducing network abuse would there be any benefit to coming up with a new document which details best practices in reducing abuse and dealing with it? Also ripe-409 is becoming dated notably in its discussion of which abuse mailbox to use for abuse reports, would it be advisable to update this document to reflect changes. Cheers, Bradley

1 0

Final Call For Agenda Items
by Brian Nisbet 15 Apr '09

15 Apr '09

Colleagues, RIPE 58 is taking place in Amsterdam in a few short weeks. The WG session is on Thursday afternoon and if you would like to see anything included on the agenda now is the time to mention it. We will be looking to finalise the agenda shortly, so please get in contact should there be any points you wish to raise. Thanks, Brian.

1 0

(no subject)
by anna GFYS 03 Apr '09

03 Apr '09

I have this ip87.121.241.101. ssh remote login protocol that is trying to hack my compture and when i trace it this is whta i get orgname:Ripe Network Coordination Centre OrgID: Ripe address p.o box 10096 city: Amsterdam Stateprv: Postalcode:1001eb country: NL net range: 87.0.0.0-87.255.255.255 cidr:87.0.0.0/8 netname:87-ripe nethandle: Net-87-0-0-0-1 and so on need some help with? thank you anna _________________________________________________________________ Rediscover Hotmail®: Get quick friend updates right in your inbox. http://windowslive.com/RediscoverHotmail?ocid=TXT_TAGLM_WL_HM_Rediscover_Up…

3 2

Re: [anti-abuse-wg] how to detect spambots - SPAMTrusted
by Frank Gadegast 16 Mar '09

16 Mar '09

Jeffrey Race wrote: > This simple wheel reinvented many times; need only to apply > current knowledge. If someone will work with me we can > submit the described RFC as is or improved as needed > > > <http://www.camblab.com/misc/univ_std.txt> > based on > <http://www.camblab.com/nugget/spam_03.pdf> > Great. I see two points here: - the group should define regulations to force RIPE-members to detect spam originating from their own IPs - the group should force members to have a working abuse email address (its sad, that the once defined abuse-mailbox field in RIPEs whois never made it to be a needed field, this should be changed ASAP) Our own blacklist under http://www.dnsbl.de sends out thousands of spam reports daily to the email addresses of the network administrators found in RIPEs whois. Most email address do not work (user unknown, mailbox full aso), a lot do send auto-replier with ticket numbers (telefonica is great with this), but never an email, that the case has been solved, most do not react. Currently there are only 2% answering or fixing the problem. Why do we not recommend to implement a system at RIPE, where abuse reports could be CCed to (including the netblock and the email address a report was sent too, the system then could check, if it was the right address and store a timestamp, any ISP should then be informed how he could send an email to RIPE to inform that hes working on it or that the case was fixed) so that RIPE can messure, wich ISP is really fixing abuse cases ? And: if any ISP collects more than 100 cases that are open for more than two weeks without any reaction, the problem network blocks are simply revoked by RIPE ;o) RIPE should be able to implement such a harsh system, because any member signed to not pollute the internet already. Kind regards, Frank > > Jeffrey Race > > > -- Mit freundlichen Gruessen, -- PHADE Software - PowerWeb http://www.powerweb.de Inh. Dipl.-Inform. Frank Gadegast mailto:frank@powerweb.de Schinkelstrasse 17 fon: +49 33200 52920 14558 Nuthetal OT Rehbruecke, Germany fax: +49 33200 52921 ====================================================================== Public PGP Key available for frank(a)powerweb.de

14 35

passive botnet tracker
by Dr. Alexander K. Seewald 09 Mar '09

09 Mar '09

We've built and run a prototype passive botnet tracking system in Austria for the last year. A journal paper is pending and should be ready for the conference - hopefully only a week away from the final version. The gist: Based on a darknet (i.e. unused IP addresses), we analyze incoming packets and classify them into (currently eight) different spambot types based on learned idiosyncrasies of packet and protocol, and reference data (currently by Marshall). The system is based on machine learning techniques, scales extremely well, and can utilize all kinds of reference data. However, to track all spambots worldwide (according to ShadowServer's estimates), we need about 1.5 million unused IP addresses. In times of IPv4 shortage, that is quite a tall order. Unfortunately, spammers have not switched to IPv6 yet - in the full past year, we could not find a single IPv6 packet originating from a spambot. This will probably change in the future, but until we have enough sample data to train our models, IPv6 cannot be used reliably. Lack of reference data (i.e. known botnets, bot types, DDoS/spam sending activity etc.) has been our greatest obstacle so far. We intend to extend the system towards TCP/IP stack fingerprinting (for those bots which have their own stack) and towards true botnet tracking (e.g. by analyzing access patterns & timings) Any comments are welcome. We will try to be at RIPE-58, provided we can get a small talking slot there - half an hour should suffice. Best, Alex -- Dr. Alexander K. Seewald Seewald Solutions www.seewald.at Tel. +43(664)1106886 Fax. +43(1)2533033/2764

12 17

Re: [anti-abuse-wg] survey ?
by Frank Gadegast 06 Mar '09

06 Mar '09

Leo Vegoda wrote: > Hi Frank, > > Frank Gadegast wrote: > > [...] > >> Somebody responsible simply has to step forward and do >> something, there will be no consensus with that many members. > > You mean you want an autocracy? No, thats democracy. Some people step forward and take responsibility. Some of them are being elected and do the job. And you can vote for somebody else, when you dont like, what they are doing. > How will you get everyone to follow the rules of this leader or king? The reason the decision making process is the way it is, is because there is no way to compel network operators to obey a king. If RIPE and the RIPE NCC began to operate in a way that most people thought was unreasonable then most people would ignore RIPE and the RIPE NCC. Well, the provider are ignoring RIPE anyway. They can ignore whatever is helpful to protect the users from spam, because there are no strict rules from RIPE to help against spam-friendly provider. The abuse-field is not mandatory. There are no regulations in RIPE membership contracts, that members are responsible for abuse they cause. But thats, what RIPE has to do to stop abuse. This workgroup is absolutely useless, if there is no interest or consense between all members, because there are members, that will block all regulations against abuse, because they make profit with spam or are not willing to invest time and money to protect the internet. Guess why the abuse-field never made it to be mandatory. Think about, why we are talking over a year now about a clear definition of abuse, without any result. So what now ? Will this group generate a recommendation soon ? Ever ? A test: ------------------------------------------------------------------ everybody on this list, should simply reply now ( ) I want RIPE to have regulations against abuse ( ) I want RIPE to take consequences against spam friendly members ------------------------------------------------------------------ We can stop talking, if we do not get 100% positive response to the first question, because any minority can then stop the whole definition process. We can also stop talking, if we do not get a 100% positive response to the second question, because regulations without consequences will be ignored like it is now. And: if some on this list are not answering, they are not against abuse and will block any progress. Kind regards, Frank > Regards, > > Leo > > > -- Mit freundlichen Gruessen, -- PHADE Software - PowerWeb http://www.powerweb.de Inh. Dipl.-Inform. Frank Gadegast mailto:frank@powerweb.de Schinkelstrasse 17 fon: +49 33200 52920 14558 Nuthetal OT Rehbruecke, Germany fax: +49 33200 52921 ====================================================================== Public PGP Key available for frank(a)powerweb.de

5 4

Re: [anti-abuse-wg] survey ?
by Frank Gadegast 06 Mar '09

06 Mar '09

Leo Vegoda wrote: > Hi Frank, > > Frank Gadegast wrote: > > [...] > >> Somebody responsible simply has to step forward and do >> something, there will be no consensus with that many members. > > You mean you want an autocracy? No, thats democracy. Some people step forward and take responsibility. Some of them are being elected and do the job. And you can vote for somebody else, when you dont like, what they are doing. > How will you get everyone to follow the rules of this leader or king? The reason the decision making process is the way it is, is because there is no way to compel network operators to obey a king. If RIPE and the RIPE NCC began to operate in a way that most people thought was unreasonable then most people would ignore RIPE and the RIPE NCC. Well, the provider are ignoring RIPE anyway. They can ignore whatever is helpful to protect the users from spam, because there are no strict rules from RIPE to help against spam-friendly provider. The abuse-field is not mandatory. There are no regulations in RIPE membership contracts, that members are responsible for abuse they cause. But thats, what RIPE has to do to stop abuse. This workgroup is absolutely useless, if there is no interest or consense between all members, because there are members, that will block all regulations against abuse, because they make profit with spam or are not willing to invest time and money to protect the internet. Guess why the abuse-field never made it to be mandatory. Think about, why we are talking over a year now about a clear definition of abuse, without any result. So what now ? Will this group generate a recommendation soon ? Ever ? A test: ------------------------------------------------------------------ everybody on this list, should simply reply now ( ) I want RIPE to have regulations against abuse ( ) I want RIPE to take consequences against spam friendly members ------------------------------------------------------------------ We can stop talking, if we do not get 100% positive response to the first question, because any minority can then stop the whole definition process. We can also stop talking, if we do not get a 100% positive response to the second question, because regulations without consequences will be ignored like it is now. And: if some on this list are not answering, they are not against abuse and will block any progress. Kind regards, Frank > Regards, > > Leo > > > -- Mit freundlichen Gruessen, -- PHADE Software - PowerWeb http://www.powerweb.de Inh. Dipl.-Inform. Frank Gadegast mailto:frank@powerweb.de Schinkelstrasse 17 fon: +49 33200 52920 14558 Nuthetal OT Rehbruecke, Germany fax: +49 33200 52921 ====================================================================== Public PGP Key available for frank(a)powerweb.de

1 0

Re: [anti-abuse-wg] passive botnet tracker (combined reply)
by Dr. Alexander K. Seewald 04 Mar '09

04 Mar '09

Peter, I think that focussing just on spam is misleading. Although it is currently the most profitable use of botnets, other uses are already demonstrated, such as DDoS, distributed password/encryption cracking, phishing - which could work without spam in several scenarios (e.g. changing HOSTS on the local PC, hacking DNS servers, etc..) - and most of these would tend to give spammers a way to make money without spam. So it is important to find out what they are doing and how many there are. Frank, I applaud your system. By your fast response you even get rid of the problem with static vs. dynamic IP addresses. As long as the major business for botnets is spam, this will continue to work. Of course if only a small set of providers use it, spammers will simply stop using your mailserver to send spam, once it begins to hurt them. Yes, it is relatively trivial to get the IP from the full mail headers (although it is safer to check the IP during the SMTP conversation - I once did a test and there was a difference of about 1% where IP addresses did not match) I even once wrote a system in 2004 to analyze each mail, check whois, find out the abuse email address and send an automatically generated abuse report there... used it for a few months, but as there was absolutely no reponse (well, some email providers complained that they cannot control what their users do...) I stopped it. Our system could be used in a similar way, but tracks even inactive bots which are currently not used to send out spam. Of course they need to generate some other traffic, the nature of which is currently not well understood. Best, Alex -- Dr. Alexander K. Seewald Seewald Solutions www.seewald.at Tel. +43(664)1106886 Fax. +43(1)2533033/2764

1 0

Call for Agenda Items for RIPE 58
by Brian Nisbet 02 Mar '09

02 Mar '09

Colleagues, As you may have seen, registration has opened for RIPE 58 in Amsterdam. With this in mind I'd like to solicit agenda items for the WG session. We would be especially interested in anti-abuse experiences which involved interaction with government or evolution of legislation, but I do not, in any way, intend to be restrictive. If you have a presentation or any information that you think may be of interest to the working group, please let Richard or I know. Regards, Brian.

1 0

JKHY Attack via RIPE Users
by Mark Mason 25 Feb '09

25 Feb '09

Ripe Anti-Abuse, On day number 2 of a attack. Can you mitigate any of the following addresses coming from the RIPE network ARIN space? Se1/0 89.208.176.155 Null 216.116.87.90 11 0E7D 0D67 1039 Se1/0 89.208.176.155 Null 216.116.87.90 11 0707 05F1 1039 Se1/0 89.208.176.155 Null 216.116.87.90 11 0C9C 0DEE 1039 Se1/0 89.208.176.155 Null 216.116.87.90 11 0B4D 0ACB 1039 Se1/0 89.208.176.155 Null 216.116.87.90 11 0CF0 0D7A 1039 Se1/0 89.208.176.155 Null 216.116.87.90 11 0EDC 0E41 1039 Se1/0 89.208.176.155 Null 216.116.87.90 11 0B04 0C30 1039 Se1/0 89.208.176.155 Null 216.116.87.90 11 0F4E 08E0 1039 Se1/0 89.208.176.155 Null 216.116.87.90 11 0FB0 0AD3 1039 Se1/0 89.208.176.155 Null 216.116.87.90 11 0D53 083A 1039 Se1/0 89.208.176.155 Null 216.116.87.90 11 0E58 0B77 1039 Se1/0 89.208.176.155 Null 216.116.87.90 11 0B49 0E75 1039 Se1/0 89.208.176.155 Null 216.116.87.90 11 0E5B 0B4C 1039 Se1/0 89.208.176.155 Null 216.116.87.90 11 1010 049D 1039 Se1/0 89.208.176.155 Null 216.116.87.90 11 09C0 129E 1039 Se1/0 89.208.176.155 Null 216.116.87.90 11 0918 12E7 1039 Se1/0 89.208.176.155 Null 216.116.87.90 11 1040 0B9A 1039 Se1/0 89.208.176.155 Null 216.116.87.90 11 0E10 0474 1039 Se1/0 89.208.176.155 Null 216.116.87.90 11 0BF2 1197 1039 Se1/0 89.208.176.155 Null 216.116.87.90 11 0E6A 041B 1039 Se1/0 89.208.176.155 Null 216.116.87.90 11 08A9 1288 1039 Se1/0 89.208.176.155 Null 216.116.87.90 11 0C80 0674 1039 Se1/0 89.208.176.155 Null 216.116.87.90 11 0901 03DF 1039 Se1/0 89.208.176.155 Null 216.116.87.90 11 0D0A 0781 1039 Se1/0 89.208.176.155 Null 216.116.87.90 11 09A6 00D7 1039 Se1/0 89.208.176.155 Null 216.116.87.90 11 0D98 0425 1039 Se1/0 89.208.176.155 Null 216.116.87.90 11 0F24 077E 1039 Se1/0 89.208.176.155 Null 216.116.87.90 11 091C 11B2 1039 Se1/0 89.208.176.155 Null 216.116.87.90 11 0FC9 0093 1039 Se1/0 89.208.176.155 Null 216.116.87.90 11 0F6D 10A0 1039 Se1/0 89.208.176.155 Null 216.116.87.90 11 0D64 02F9 1039 Se1/0 89.208.176.155 Null 216.116.87.90 11 0E9B 10BA 1039 Se1/0 89.208.176.155 Null 216.116.87.90 11 0FAC 11B9 1039 Se1/0 89.208.176.155 Null 216.116.87.90 11 0CB3 12A1 1039 Se1/0 89.208.176.155 Null 216.116.87.90 11 0FDB 0231 1039 Se1/0 89.208.176.155 Null 216.116.87.90 11 0F3D 12BF 1039 Se1/0 89.208.176.155 Null 216.116.87.90 11 0DC9 013E 1039 Se1/0 89.208.176.155 Null 216.116.87.90 11 0EB1 121F 1039 Se1/0 113.61.25.33 Null 216.116.87.90 11 1121 0654 1028 Se1/0 163.139.27.179 Null 216.116.87.90 11 0AF2 122F 1028 Se1/0 122.105.216.108 Null 216.116.87.90 11 092C 0932 1028 Se1/0 213.149.11.88 Null 216.116.87.90 11 0E48 0827 1028 Se1/0 222.69.219.24 Null 216.116.87.90 11 0D65 0B9C 1028 Se1/0 222.69.219.24 Null 216.116.87.90 11 0CB2 0A4B 1028 Se1/0 200.119.246.26 Null 216.116.87.90 11 05F5 1140 1028 Se1/0 163.139.27.179 Null 216.116.87.90 11 09D9 010B 1028 Se1/0 62.154.194.202 Null 216.116.87.90 11 071F 07F8 1028 Se1/0 58.141.17.44 Null 216.116.87.90 11 0B7F 0798 1028 Se1/0 163.139.27.179 Null 216.116.87.90 11 0A95 125F 1028 Se1/0 113.61.27.91 Null 216.116.87.90 11 1388 06DD 1028 Se1/0 163.139.27.179 Null 216.116.87.90 11 087F 00B4 1028 Se1/0 96.60.68.113 Null 216.116.87.90 11 0884 00BA 1028 Se1/0 115.133.196.157 Null 216.116.87.90 11 1001 10FA 1028 Se1/0 113.61.25.33 Null 216.116.87.90 11 0C69 0B06 1028 Se1/0 222.253.249.145 Null 216.116.87.90 11 1227 0AF0 1028 Se1/0 89.252.232.245 Null 216.116.87.90 11 0C24 02AE 1028 Se1/0 195.130.48.60 Null 216.116.87.90 11 04E2 11EF 1028 Se1/0 122.105.216.108 Null 216.116.87.90 11 094B 0970 1028 Se1/0 93.113.232.20 Null 216.116.87.90 11 0F2E 03E8 1028 Se1/0 189.17.142.70 Null 216.116.87.90 11 09E0 10DB 1028 Se1/0 124.254.219.51 Null 216.116.87.90 11 1304 0CA8 1028 Se1/0 89.105.137.1 Null 216.116.87.90 11 0A50 0FF3 1028 Se1/0 163.139.27.179 Null 216.116.87.90 11 08C0 102D 1028 Se1/0 68.107.150.203 Null 216.116.87.90 11 04C3 031D 1028 Se1/0 68.107.150.203 Null 216.116.87.90 11 049A 1345 1028 Se1/0 116.1.68.214 Null 216.116.87.90 11 0A9E 0CCC 1028 Se1/0 68.107.150.203 Null 216.116.87.90 11 0421 03F5 1028 Se1/0 89.33.216.174 Null 216.116.87.90 11 0C57 1359 1028 Se1/0 89.33.216.174 Null 216.116.87.90 11 0DD8 12D4 1028 Se1/0 94.64.52.186 Null 216.116.87.90 11 0B4A 0765 1028 Se1/0 123.22.11.226 Null 216.116.87.90 11 07DC 0D34 1028 Se1/0 200.61.42.236 Null 216.116.87.90 11 B819 0232 1028 Se1/0 79.116.168.178 Null 216.116.87.90 11 0A9A 0656 1028 Se1/0 58.153.110.2 Null 216.116.87.90 11 0992 102A 1028 Se1/0 113.61.25.33 Null 216.116.87.90 11 0F6B 085B 1028 Se1/0 68.107.150.203 Null 216.116.87.90 11 12E3 054A 1028 Se1/0 93.113.232.20 Null 216.116.87.90 11 1100 0DAB 1028 Se1/0 68.107.150.203 Null 216.116.87.90 11 0447 03E1 1028 Se1/0 93.113.232.20 Null 216.116.87.90 11 1031 0C9E 1028 Se1/0 123.22.11.226 Null 216.116.87.90 11 07DA 0D5F 1028 Se1/0 89.252.232.245 Null 216.116.87.90 11 0CA8 026E 1028 Se1/0 217.27.145.246 Null 216.116.87.90 11 A8F5 0BDF 1028 Se1/0 222.69.219.24 Null 216.116.87.90 11 0D06 0BA3 1028 Se1/0 89.33.216.174 Null 216.116.87.90 11 0B21 0440 1028 Se1/0 222.69.219.24 Null 216.116.87.90 11 0A9F 0C35 1028 Se1/0 200.119.246.26 Null 216.116.87.90 11 05F9 011B 1028 Se1/0 119.236.7.65 Null 216.116.87.90 11 09D0 0056 1028 Se1/0 200.119.246.26 Null 216.116.87.90 11 FB95 0F70 1028 Se1/0 113.61.25.33 Null 216.116.87.90 11 1355 047F 1028 Se1/0 62.154.194.202 Null 216.116.87.90 11 0687 0616 1028 Se1/0 163.139.27.179 Null 216.116.87.90 11 0A8E 0238 1028 Se1/0 61.216.232.191 Null 216.116.87.90 11 EB2F 1054 1028 Se1/0 88.216.105.58 Null 216.116.87.90 11 390D 0576 1028 Se1/0 200.119.246.26 Null 216.116.87.90 11 059D 1154 1028 Se1/0 75.165.194.154 Null 216.116.87.90 11 0D69 0835 1028 Se1/0 163.139.27.179 Null 216.116.87.90 11 0AB9 1212 1028 Se1/0 58.213.231.201 Null 216.116.87.90 11 05D0 130B 1028 Kind Regards, Mark Mason JHA Communications - Network Engineer jack henry & ASSOCIATES Office 417.235.6652 Ext. 350501 Cell 417.669.1605 Fax 260.665.9454 NOTICE: This electronic mail message and any files transmitted with it are intended exclusively for the individual or entity to which it is addressed. The message, together with any attachment, may contain confidential and/or privileged information. Any unauthorized review, use, printing, saving, copying, disclosure or distribution is strictly prohibited. If you have received this message in error, please immediately advise the sender by reply email and delete all copies.

3 2