- anti-abuse-wg - mailman.ripe.net

When email verification behavior is abusive
by ac 18 Jul '18

18 Jul '18

Hi All, ESP and email relay services should verify recipient email addresses prior to sending bulk emails to any random email address. ESPs that simply start dumping bulk emails on victims often end up listed on RBLs for abusive behavior. But, when is verification emails themselves, spamvertising or email abuse? Our own email policy defines verification abuse as "more than 3 verify your email account" emails in the same 24 hour period and verify your email account emails lasting longer than five 24 hour periods. Do you think this is reasonable? Too reasonable? More? Less? If you receive say 4 "verify your email account" emails in 5 minutes, is this abuse? Andre

1 0

I'm sure this is totally accurate :-)
by Ronald F. Guilmette 13 Jul '18

13 Jul '18

Bummer. www.ripe.net is distributing malware. https://quttera.com/detailed_report/www.ripe.net :-)

3 2

Re: [anti-abuse-wg] Google & Cisco
by ac 10 Jul '18

10 Jul '18

Hi, So, I have received some off list email, about my post. The trouble with off list email is that sometimes things are discussed that is of value to the community. These are my additional comments: Abuse systems can also be abusive, for example: http://multirbl.valli.org - warning all about a 'fake' rbl Abuse systems can be used as weapons - both for war as well as for corporate war. Abuse systems and platforms can be used to the detriment of the EU Where corporations club together and could be used to influence the growth/decline of services of a country or group of countries. Anyway, included is an extract of headers where SpamCop ignores date: Tue, 10 Jul 2018 03:08:27 -0700 (and the Google Relay ipv4 - which for the record was: mail-oi0-f44.google.com(a)209.85.218.44 and on Tue, 10 Jul 2018 03:08:27 -0700) and fails the report on date (older than 48 hours) as SpamCop trusts the Google relay and wants to report about: 2002:a4a:4841:0:0:0:0:0 with HTTP; Sat, 7 Jul 2018 19:37:11 -0700 (PDT) Which usually would have been the TELECOM company IP number (of the telecom user/company) The 'Telecom' company IP number is not an email server and therefore SpamCop reports that many abuse admins on this list receives, are not really worth much any longer as any spamcop report that is not about your email servers, can be safely deleted. Cisco basically says that they do not have any deal with Google and that they are not protecting Twitter, Facebook, Amazon and Microsoft I am wondering what the benefit is to Cisco by devaluing the value of SpamCop for abuse admins? Or is it more a case of protecting the big 5 and keeping everyone else on their toes? Is this bullying? Is it nefarious? It is not good. It is not ethical and it is plainly EVIL. +++++++++++++ Received: by mail-oi0-f44.google.com with SMTP id n84-v6so41513085oib.9 for <victim>; Tue, 10 Jul 2018 03:08:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=jenreviews-email.20150623.gappssmtp.com; s=20150623; h=mime-version:from:date:message-id:subject:to; bh=EFkdASUSCy3UwqSvm2EX4abetipkteFp5j+2Y9kJF0c=; b=SUrZKZxQlMfl7LPwx6nTHoGJ9KnOH7k/7XJq80zGpkGERu4ogQnOIjJvbWC2NN3CK/ QwKh9JcBgnkdOHgnHcLlaoogt7o3+arGGjmNUBB9AP7jif35Hz74gurZ8vprFSO0mvjG sggWkN3rFq/wp+FuNKChWY4lT4PrsVbqo27UEvstouEsuMsH4OfBSAHpc7bb4QsuKvAd 0UglZIUWMxHGYYlFJB14SElmm4ILXXPEEZZky7JQa6OOpzvCV9Ak6cd+L6o1EuK04Npk A8+uM27v6UWsZLvX10+7D5CwL4t8oK97FG46cELHQE58nWlIVDm9PvAF5E970W46Pihy zceA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=EFkdASUSCy3UwqSvm2EX4abetipkteFp5j+2Y9kJF0c=; b=tJ0aM+VgmcMNhkOPlpYnhGNlP0/V0hWzttKZWMQxd9FZDEDbx5YbxGZn3dIrghNZY6 LOKdbKk5NUU61oqV/B0a/1ecm8mqFV4hP/qlDcFuu9HXeYsxgwZ9ieGF7EpBycnzJqLT 3n9ldMJuNL9RiKWJr1L4o4+JySpJ8Dp4zsuRfm4rn4V2cQQP8LT763r2sKXG1jEXG6Yy VQUL8eEdnsWgN4ON4LQA34MqHTejtHnTNTFYrWQUX8VjqIImedNl58Gx8RNW7nHSwt/F eaGw/xl3umn4bkONz8UVkpYVqgTI8nqVehhJlynKTPyTKxLFS9waGPieOOM9hLkeb+eA 2JeQ== X-Gm-Message-State: APt69E3m7PhKks5zjFEwDCJkBQzeDd3nggWlzc1bT0LzBBFYHQMSDN5F toEVWauopOgYRWJ7JSCN637aGLXOvTSpggI1GKu4aw== X-Google-Smtp-Source: AAOMgpdxfMce9VRJy0i9imFEwrYn4NZwGbhBzGfmH1WTfcicyUEVdX7DJIykmii9WZ7wnhUCy93cLp/a7T/At+cVdJE= X-Received: by 2002:aca:430b:: with SMTP id q11-v6mr28734957oia.127.1531217285617; Tue, 10 Jul 2018 03:08:05 -0700 (PDT) Received: from 776393159873 named unknown by gmailapi.google.com with HTTPREST; Tue, 10 Jul 2018 03:08:05 -0700 MIME-Version: 1.0 Received: by 2002:a4a:4841:0:0:0:0:0 with HTTP; Sat, 7 Jul 2018 19:37:11 -0700 (PDT) From: Jenn Miller <jenn(a)jenreviews.email> Date: Tue, 10 Jul 2018 03:08:05 -0700 Message-ID: <CALvVF876A17shGKhFmXEU2hD4Z0CNsY4mHy1=Sj1rASQStYDAQ(a)mail.gmail.com> ++++++++++++++++++++++++ On Thu, 5 Jul 2018 13:23:08 +0200 ac <ac(a)main.me> wrote: > Hello All, > > As we all know, Google and Microsoft dominates email relay in many > places and they are getting even larger with each passing year. > > They are not getting larger because they are offering great email > service but because they are ever more aggressive and sometimes under > handed and do not behave decently or in an ethical way. > > if the present trends continue, there will be almost no email relay > that does not operate through either Microsoft or Google. > > Interesting thing that all of us (and Microsoft) should take careful > note of is that Google has done a deal with Cisco (Talos SpamCop) > whereby reports about abuse (including spear phish, spam, scams, etc) > - are no longer sent to Google (abuse(a)google.com) but directly to the > relay ipv4/ipv6 abuse ISP contact. When there is no ipv4/ipv6 abuse > contact the complaints are discarded and in a minority of cases, > still go to abuse(a)google.com > > Microsoft of course has two attack vectors. One the 'custom' protocols > of their exchange servers and the other is that they mix legit email > and spear phish, payday loan scams from the same servers. Google has > now also started doing the same thing. Before Google used to be > more responsive to abuse complaints and there were fewer actual > criminal activity relayed by Google. So, it is becoming more frequent > and common to find spear phish attack on a client, from Google and > Microsoft and this motivates clients to move services to Microsoft or > Google. > > I do not think that there is much an abuse wg can discuss around this, > as there is not much or anything that any of us can actually do about > the present situation as both Google and Microsoft has simply become > too large and year on year they are getting larger. > > Any comments? > > > > > >

1 0

Google & Cisco
by ac 05 Jul '18

05 Jul '18

Hello All, As we all know, Google and Microsoft dominates email relay in many places and they are getting even larger with each passing year. They are not getting larger because they are offering great email service but because they are ever more aggressive and sometimes under handed and do not behave decently or in an ethical way. if the present trends continue, there will be almost no email relay that does not operate through either Microsoft or Google. Interesting thing that all of us (and Microsoft) should take careful note of is that Google has done a deal with Cisco (Talos SpamCop) whereby reports about abuse (including spear phish, spam, scams, etc) - are no longer sent to Google (abuse(a)google.com) but directly to the relay ipv4/ipv6 abuse ISP contact. When there is no ipv4/ipv6 abuse contact the complaints are discarded and in a minority of cases, still go to abuse(a)google.com Microsoft of course has two attack vectors. One the 'custom' protocols of their exchange servers and the other is that they mix legit email and spear phish, payday loan scams from the same servers. Google has now also started doing the same thing. Before Google used to be more responsive to abuse complaints and there were fewer actual criminal activity relayed by Google. So, it is becoming more frequent and common to find spear phish attack on a client, from Google and Microsoft and this motivates clients to move services to Microsoft or Google. I do not think that there is much an abuse wg can discuss around this, as there is not much or anything that any of us can actually do about the present situation as both Google and Microsoft has simply become too large and year on year they are getting larger. Any comments?

1 0

RIPE 77 CfP and AA-WG Agenda
by Brian Nisbet 04 Jul '18

04 Jul '18

Colleagues, As I'm hoping you're all aware the RIPE 77 Call for Presentations is now open: https://ripe77.ripe.net/submit-topic/cfp/ At the same time I would ask you to consider if you may have anything to bring to the Working Group in October, whether that is a new policy, process, point of information or more general presentation. If so, please do email Tobias and I and we can discuss it! Thanks, Brian Co-Chair, RIPE AA-WG Brian Nisbet Network Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

1 0

New on RIPE Labs: Mini series on network security (by Kathleen Moriarty)
by Mirjam Kuehne 14 Jun '18

14 Jun '18

Dear colleagues, We published a mini series on network security on RIPE Labs, contributed by Kathleen Moriarty: 1. Network Monitoring is Dead… What Now? TLS, QUIC and Beyond https://labs.ripe.net/Members/kathleen_moriarty/network-monitoring-is-dead-… 2. They Are Looking At WHAT? Service Provider Monitoring https://labs.ripe.net/Members/kathleen_moriarty/they-are-looking-at-what-se… 3. What Are My Options? Session Encryption Protocols Looking Forward https://labs.ripe.net/Members/kathleen_moriarty/what-are-my-options-session… You can find the full series here: https://labs.ripe.net/Members/kathleen_moriarty Kind regards, Mirjam Kühne RIPE NCC

1 0

Draft Minutes - AA-WG Session at RIPE76
by Brian Nisbet 05 Jun '18

05 Jun '18

Colleagues, Thanks again for a great session at our recent meeting in Marseille. Here are the draft minutes as prepared by the NCC. Could you please read them and comment with any corrections that are required? Anti-Abuse Working Group RIPE 76 17 May 2018, 11:00-12:30 WG co-Chairs: Brian Nisbet, Tobias Knecht Scribe: Emile Aben Status: Draft A. Administrative Matters The video archive is online at: https://ripe76.ripe.net/archives/video/109 The chairs welcomed the room, and addressed the administrative matters. B. Update B1. Working Group Chair Selection Brian Nisbet was selected for another term as co-chair for this working group. The video archive is online at: https://ripe76.ripe.net/archives/video/111 B1. Recent List Discussion The video archive is online at: https://ripe76.ripe.net/archives/video/112 C. Policies Brian summarised the discussions on the mailing list. C1. 2017-02 Regular abuse-c Validation - Herve Clement (Orange), Sara Marcolla (Europol) The video archive is available at: https://ripe76.ripe.net/archives/video/113 There were no questions C1. 2017-02 Regular abuse-c Validation, Marco Schmidt (RIPE NCC) The video archive is available at: https://ripe76.ripe.net/archives/video/113 Alexander Isavnin (Internet Protection Society) asked for exact numbers and lacking these suggested to postpone decision. Brian rejected this suggestion. Julien Escario (Altinea) asked for more serious validations checks. Brian said this was discussed already. Jordi Palet Martinez (The IPv6 Company) considered starting a new policy proposal discussion, after this proposal reaching consensus, based on the proposal he submitted to other RIRs. Piotr Strzyżewsk (Silesian University of Technology, Computer Centre) asked about legacy resource holders. Marco said legacy address space will not be part of this. Piotr said email checking is tricky and used the example of putting abuse(a)ripe.net on arbitrary resources. Brian said this was discussed on the mailing list. Piotr said they will not know how much money this will cost. Marco said that if 25% is incorrect, it will cause frustration to a lot of people. Peter Koch (DENIC) asked for guarantees of the RIPE NCC's interpretation of the text and it not changing its mind. Marco said the guarantee is in that things must be within the policy framework. Peter Koch said the text allows for much harsher interpretation, and was not convinced this is good policy making. Brian said that the RIPE NCC's interpretation at this point is as set as it can be. Ruediger Volk (Deutsche Telekom) unravelled the discussion in three parts: 1) A technical question on how to validate email addresses, and he saw no obstacle on validating all contacts that are relevant 2) Consequences for incorrect email addresses 3) Fixing incorrect email addresses Ruediger said fixing and checking emails could be considered a Database WG task, and was afraid that this work created the illusion of achievement. Tobias Knecht (Abuseix) said 10-25% sounds a correct number for invalid mailboxes and he would be happy to write a proposal with Ruediger. Tobias added that the RIPE NCC is charged with running a clean and valid registry and legacy checking would also be no problem. Brian summarised that no new information was brought to the discussion, and the proposal was still open for a few more days. D. Interactions D1. Global Abuse Community Updates Tobias Knecht - Abuseix The video archive is available at: https://ripe76.ripe.net/archives/video/117 Ruediger asked about the schema language, and answered that JSON doesn't have a schema language. Ruediger suggested creating a list of tools for creating data in this format. Tobias said that keeping the JSON as simple as possible as abuse handling is in essence simple. Ruediger said was interested in the results of this effort that could be easily tracked and expressed doubt about the need for a MIME type for this. Tobias said the MIME type discussion took place in other fora. Tobias said he will connect the community doing this to the anti-abuse working group community. Ruediger said it's essential to provide pointers to tools that use this. E. Presentation E1. Internet Abuse by Russian LEAs Alexander Isavnin (Internet Protection Society) The video archive is available at: https://ripe76.ripe.net/archives/video/119 There were no questions. X. A.O.B. There were no AOBs. Brian closed the session. Thanks, Brian Co-Chair, RIPE AA-WG Brian Nisbet Network Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

1 0

2017-02 Proposal Accepted (Regular abuse-c Validation)
by Marco Schmidt 01 Jun '18

01 Jun '18

Dear colleagues, Consensus has been reached on 2017-02, "Regular abuse-c Validation". This proposal gives the RIPE NCC a mandate to regularly validate "abuse-mailbox:" information and to follow up in cases where the attribute is deemed to be incorrect. You can find the full proposal at: https://www.ripe.net/participate/policies/proposals/2017-02 The new RIPE Document is ripe-705 and is available at: https://www.ripe.net/publications/docs/ripe-705 The RIPE NCC has already begun preparations to implement this policy change. Details of the implementation status are available at: https://www.ripe.net/manage-ips-and-asns/resource-management/policy-impleme… We will send another announcement once the implementation is complete and the regular validation is in place for all “abuse-mailbox:” attributes. Thank you to everyone who provided input. Kind regards, Marco Schmidt Policy Officer RIPE NCC Sent via RIPE Forum -- https://www.ripe.net/participate/mail/forum

1 0

GDPR - ICANN vs Tucows
by Michele Neylon - Blacknight 31 May '18

31 May '18

https://www.internetnews.me/2018/05/31/icann-vs-epag-tucows-german-court-ru… -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845

1 0

Re: [anti-abuse-wg] GDPR - positive effects on email abuse
by Malcolm Hutty 30 May '18

30 May '18

On 30/05/2018 04:47, it was written: > Well, many people. let me start with myself: You claim that my opinions > are rubbish and you compare my opinions to those same people > (Fox/Republicans) whom: > > violently take babies away from mommies - yes, at a border Americans > grab little babies from the hands of their mothers and take the mommy > and the little baby to different "detention" facilities. I have been following this thread with great interest, and have found points I find persuasive and unpersuasive on both sides. It could be said that the thread is wandering off into unproductive theorising, but in the circumstances of the advent of GDPR, whether public WHOIS really is a necessary or important component of anti-abuse activities seems a broad topic worth debating fully. Some light has even been shed on GDPR's meaning. I also consider myself highly tolerant of passionate and occasionally intemperate comments. It seems to me that it is better to have it out, and to show the respect of tolerating less well mannered arguments, than to try to aggressively police language and so exclude many people from full participation in the debate. Usually those that go over the top do more harm to their own case than to others, and that has been how I have reacted to some of the comments in this thread. But can we please leave out accusations that your political opponents abduct babies? That surely crosses the line. The trope is, at least, Older Than Feudalism, and very likely Older Than Dirt, and as always raising it serves no purpose other than to demonise one group of people and to smear another by association, thereby shutting down the conversation. It's not an argument, it's a transparent attempt to exclude. Please stop. More generally, I believe this discussion would be improved if people stopped throwing around terms like "European" and "Republican" as though they are terms of abuse. Our community is, and should be, open to all. Regards, Malcolm. -- Malcolm Hutty | tel: +44 20 7645 3523 Head of Public Affairs | Read the LINX Public Affairs blog London Internet Exchange | http://publicaffairs.linx.net/ London Internet Exchange Ltd Monument Place, 24 Monument Street London EC3R 8AJ Company Registered in England No. 3137929 Trinity Court, Trinity Street, Peterborough PE1 1DA

4 3