- anti-abuse-wg - mailman.ripe.net

Re: [anti-abuse-wg] WG Chair Mailing List Decision
by ox 18 Feb '17

18 Feb '17

On Fri, 17 Feb 2017 16:22:55 +0000 HRH Prince Sven Olaf von CyberBunker <svenk(a)xs4all.nl> wrote: > as for droning on... so far, this mailinglist, for the past month or > so has been: > > spam spam spam spam spam spam spam spam spam > > and 1 mail: law enforcement requests to the ripe ncc (a total of 4 in > 2016) - no replies whatsoever to that one. > > then more: spam spam spam spam spam. > > funny... > Actually no. Spam is a problem of many decades. It is a higher level service and SHOULD NOT EXIST in 2017. The simple and salient truth is: If spam abuse is stopped then everything else falls into place. If you cannot route/deliver/accept email - Even if you are a Tier 1 or Google.com You are screwed. Of course, other abuse issues, as below my name, are just as important and are also frequently discussed... my 2c Andre > cuz we thought it should be more like 'ddos ddos ddos' 'hijacked > prefix' 'ddos' 'mass hack' 'ddos' 'someone switched off the > electricity' 'someone cut some fibers'...'spamhaus illegally scraped > the ripe db for memberdata to blackmail them with on their criminal > slander site' 'the americans illegally 'seized' 20000 domains that > are not even in their territory and it's time to move icann out of > the usa for that reason' -that's network abuse- spam is not. (and the > latter only if we consider ripe and it's db a part of the network > itself) > >

1 0

Re: [anti-abuse-wg] WG Chair Mailing List Decision
by Marilson 17 Feb '17

17 Feb '17

Hi Shane, I used the KKK as a bad taste metaphor to match the previous KKKKKKK laugh. Look, *learn to live with the contradictory* does not mean that you have to accept any action... Note that this WG Chair Mailing List Decision is not discussing *actions* but ideas, comments and insults. What I wrote could also be said as follows, plagiarizing Evelyn B. Hall about Voltaire: I may not agree to any of the words you say, but I will defend to the death the right of you to say them. Censorship can not exist. It existed in the most negative periods of human history. We can not go back. Who use freedom of expression improperly, will answer for their actions in the courts. The WG is not a court, the co-chair is not a judge and the members are not a jury. I have stated that there are many ISPs who act as criminals and / or are accomplices to criminal customers. I can say that because I have proof. It is quite suspect someone claims should be banned from the group who are calling the ISPs of criminals. He should ask for evidence of this crime. Simply banishing, blocking, curtailing, is a fascist and suspicious attitude. But I will defend to the death the right of him to say it. Shane, I hope I have clarified my position better. Greetings Marilson From: Shane Kerr Sent: Friday, February 17, 2017 10:41 AM To: Marilson Subject: Re: [anti-abuse-wg] WG Chair Mailing List Decision

3 3

Re: [anti-abuse-wg] WG Chair Mailing List Decision
by Sascha Luck [ml] 17 Feb '17

17 Feb '17

On Fri, Feb 17, 2017 at 04:22:55PM +0000, HRH Prince Sven Olaf von CyberBunker wrote: >cuz we thought it should be more like 'ddos ddos ddos' 'hijacked >prefix' 'ddos' 'mass hack' 'ddos' 'someone switched off the >electricity' 'someone cut some fibers'...'spamhaus illegally >scraped the ripe db for memberdata to blackmail them with on >their criminal slander site' 'the americans illegally 'seized' >20000 domains that are not even in their territory and it's time >to move icann out of the usa for that reason' -that's network Yup, agree, all this should be on-topic on this list, also censorship in general and in particular the antics of a "Tier 1" backbone provider who have taken it upon themselves to protect the world from TPB and/or Cloudflare... FWIW, prefix 'jacking has occasionally been discussed here. rgds, Sascha Luck

1 0

WG Chair Mailing List Decision
by Brian Nisbet 17 Feb '17

17 Feb '17

Colleagues, This morning Tobias and I asked the NCC to take the very unusual step, effectively immediately, of removing the person behind svenk(a)xs4all.nl from the Anti-Abuse WG mailing list. This was not done lightly, rather it was done to safeguard this community. We would ask the members not to forward any of their mails to the list, nor to include them in list discussions. This mailing list is a place to discuss network abuse (of all sorts, not just spam) amongst ISPs, LEAs, Governments, Enterprise Networks and any concerned Internet Citizens. It is not a place to insult, to decry, to repeatedly state the same point over and over or to discriminate against other members of the community based on their race, creed, gender or sexual preferences. If we cannot maintain a list upon which reasonable discussion can take place, then it leaves our community in a weakened state. Tobias and I discussed this matter with Hans Petter Holen, the RIPE Chair, and we have arrived at this course of action. The Co-Chairs are happy to answer reasonable questions off-list. Of course this is a community mailing list, so we are also happy for discussion to take place here. However, as with all discussions, we would ask that if people do wish for this, that it remain respectful and on topic. If required we can devote some time to discussion of this at RIPE74. Brian & Tobias Co-Chairs, RIPE AA-WG

4 6

WG Chair Mailing List Decision
by Marilson 17 Feb '17

17 Feb '17

> While I agree, there are some others guilty of that, viz. the repeated accusation that ISPs (and the RIPE NCC) are criminals (or at least in league with such etc. Seemingly, they have yet to be banned from this list. KKKKKKKKKKKKKKKKKKKK > If nobody is to be allowed to ridicule or criticise the "other" side - and the contributor has a valid point, however annoyingly presented, it is not a "community" but a "cult". K K K > Agreed. So, if censorship be it, please remove all the other trolls, including their sockpuppets, from this list. I suspect it will be a very quiet one after that and perhaps deservedly so. Either we learn to live with the contradictory or we will burn crosses and wear hoods. Marilson From: anti-abuse-wg-request(a)ripe.net Sent: Thursday, February 16, 2017 2:45 PM To: anti-abuse-wg(a)ripe.net Subject: anti-abuse-wg Digest, Vol 63, Issue 19 Send anti-abuse-wg mailing list submissions to anti-abuse-wg(a)ripe.net To subscribe or unsubscribe via the World Wide Web, visit https://lists.ripe.net/mailman/listinfo/anti-abuse-wg or, via email, send a message with subject or body 'help' to anti-abuse-wg-request(a)ripe.net You can reach the person managing the list at anti-abuse-wg-owner(a)ripe.net When replying, please edit your Subject line so it is more specific than "Re: Contents of anti-abuse-wg digest..." Today's Topics: 1. WG Chair Mailing List Decision (Brian Nisbet) 2. Re: The well-behaved ISP's role in spamfight (Max Grobecker) 3. Re: WG Chair Mailing List Decision (Sascha Luck [ml]) 4. Re: WG Chair Mailing List Decision (Suresh Ramasubramanian) 5. Re: WG Chair Mailing List Decision (ox) 6. Re: WG Chair Mailing List Decision (Brian Nisbet) ---------------------------------------------------------------------- Message: 1 Date: Thu, 16 Feb 2017 13:05:19 +0000 From: Brian Nisbet <brian.nisbet(a)heanet.ie> To: "'anti-abuse-wg(a)ripe.net'" <anti-abuse-wg(a)ripe.net> Cc: "aa-wg-chair(a)ripe.net" <aa-wg-chair(a)ripe.net> Subject: [anti-abuse-wg] WG Chair Mailing List Decision Message-ID: <e3b44f81-c9d7-5680-c70e-526aba509889(a)heanet.ie> Content-Type: text/plain; charset=utf-8 Colleagues, This morning Tobias and I asked the NCC to take the very unusual step, effectively immediately, of removing the person behind svenk(a)xs4all.nl from the Anti-Abuse WG mailing list. This was not done lightly, rather it was done to safeguard this community. We would ask the members not to forward any of their mails to the list, nor to include them in list discussions. This mailing list is a place to discuss network abuse (of all sorts, not just spam) amongst ISPs, LEAs, Governments, Enterprise Networks and any concerned Internet Citizens. It is not a place to insult, to decry, to repeatedly state the same point over and over or to discriminate against other members of the community based on their race, creed, gender or sexual preferences. If we cannot maintain a list upon which reasonable discussion can take place, then it leaves our community in a weakened state. Tobias and I discussed this matter with Hans Petter Holen, the RIPE Chair, and we have arrived at this course of action. The Co-Chairs are happy to answer reasonable questions off-list. Of course this is a community mailing list, so we are also happy for discussion to take place here. However, as with all discussions, we would ask that if people do wish for this, that it remain respectful and on topic. If required we can devote some time to discussion of this at RIPE74. Brian & Tobias Co-Chairs, RIPE AA-WG ------------------------------ Message: 2 Date: Thu, 16 Feb 2017 14:42:19 +0100 From: Max Grobecker <max.grobecker(a)ml.grobecker.info> To: anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] The well-behaved ISP's role in spamfight Message-ID: <79675681-d0cd-9b0f-4f00-75b1f6bbb234(a)ml.grobecker.info> Content-Type: text/plain; charset="utf-8" Hi, Am 13.02.2017 um 22:18 schrieb peter h: > There is not any req that all customers always should be forced to use > ISP relays, the default behaviour might be to use ISP relays, and > to have DHCP given address. But for an extra service one could > obtain a fixed address, and as extra service, use port 25. The main > point is to have those "unaware" users, whos computers might be stolen, > prevented. They won't notice, and they don't get harmed. The best practice should be to (automatically?) block port 25 as soon as there are complaints about SPAM being sent from the according account. Maybe some good reputated blacklist providers could work together with ISPs to provide them real-time notifications for their IP allocations based on a kind of "push service". Then (as a provider) you have: A) Customers that can use any port unfiltered and are not complaining about blocked ports in your support department. B) If you receive notifications about SPAM being sent you have a good reason to block specific ports for this user (and, of course, send a notification to the customer). C) The customer is made aware that something inside his network is infected with malware which should get cleaned. The provider could offer help, fees apply. If I block port 25 outgoing by default, the user can sit there for ages in his home network while the malware is trying to send SPAM - but the customer won't notice. "Yes, of course, the computer is very slow, but..." As soon as the user moves his infected laptop to another network which don't have this blocking policy for whatever reason, the malware fires out its offers for medication to improve specific parts of the male body. And, besides of SPAM, there are also other services that are getting targeted by malware - for example SIP. You can set up a SIP server, reachable to the whole world on port 5060/UDP and you get a feeling that specific parts of the internet are trying to place phone calls to countries you wouldn't even find on a map ;-) THAT is more than a bit inconvenient - it's really harmful and costs real money (much money). But: Would you block port 5060 by default? And which other ports, too? And what about bruteforce attacks against websites? And why aren't ISPs blocking incoming packets to port 1900/UDP or port 5454/UDP by default, which are misused for DDoS attacks? I think blocking ports by default isn't the cure. It's just raising support volumes. IMHO the better way is to let customers learn from it (when they get instant notifications as soon as malware starts attacking others). Max

1 0

The well-behaved ISP's role in spamfight
by peter h 16 Feb '17

16 Feb '17

As my wife urged me to clarify things :-) The role for an ISP in fighting abuse is to detect and prevent it's customer from sending malware & spam out of it's network. Not filter incoming stuff, that would be censoring. A number of means is available for an ISP, most provided that a customer has signed implicity or in some form a AUP where rules for use of it's services are stated. The very simplest thing to do is make sure any outbound smtp is relaye through the ISP's mailrelays, where spam could be detected and subsequently blocked. A large number of other measures exists, it's only a matter of priority. Relying on operating systems ( read MS) to solve spam is hopeless, just think of MS track record. And open source won't help either. Junking SMTP would mean that we loose a independent vendor-independent autonomous decentralized way of exchanging messages. It vwon't stop the bad guys, they can always find ways around it, but it will stop you and me from freedom to express ourself and exchange thoughts. Thanks for the opportunity to express my thoughts. -- Peter Håkanson There's never money to do it right, but always money to do it again ... and again ... and again ... and again. ( Det är billigare att göra rätt. Det är dyrt att laga fel. )

6 6

Re: [anti-abuse-wg] The well-behaved ISP's role in spamfight
by Marilson 15 Feb '17

15 Feb '17

Peter: > The role for an ISP in fighting abuse is to detect and prevent it's customer from sending malware & spam out of it's network. Not filter incoming stuff, that would be censoring. Suresh: >> I wish it were that clear cut. You also have a role to protect your customers against threats, and to ensure that their mailbox is at least usable rather than deluged with spam. Richard: >>> this is very unpopular with legitimate businesses who wish to be fully in control of their email sending destiny -- and ISPs generally do not wish to discourage the people who cause no trouble and pay their bills regularly and on time. Sascha: >>>> And requiring to submit publications to a third party for approval prior to sending them is *not* censorship? Unbelievable!!! Impressive!!! Awesome!!! Discussing rules or tools for legitimate companies it is underestimating the intelligence of ISP owners. You will only create unnecessary embarrassment. You look like a bunch of public servants, who, in the absence of what to do, devise regulations as if the taxpayers were children to whom we must say how they should behave. I suggest you report spam to ISPs to find out what should be discussed in an anti-abuse group. ISP owners do not need new control tools. They all already have what they need and everyone has AUPs, TOSs and contractual ASPs with appropriate penalties. Since you apparently never reported spam and scam to providers, I'll tell you how it works. 1- It is necessary to discriminate in the text of the complaint the ISPs involved: Sender, originating ISP, the host of URL domain, the host of final URL domain; Include full header and paste message text by removing hyperlink. The Sender ISP needs to know that his customer is practicing spam and the Host needs to know that your customer is sending scam or spam out of it's network. Eventually and in specific cases: Include links of scanners and images with the spammer's bad reputation; Include legal problems, prosecutions and convictions in the Judiciary, if any. By default the spammer will be alerted by your provider. 2- In case of recurrence, alert the provider. In legitimate companies this will suffice. The problem is when the ISP refuses to prohibit or suspend its criminal client and the denunciations are repeated in vain. The teamabuses always inform what steps have been taken but only change the domain of the spammer. Legally what we have here is complicity, formation of gang for the practice of crime. This situation is very common and involves many providers. Before someone says *Call the Feds!* it is good to remember that there are still geographic borders and sovereignties. Should I call Pope Francisco? This WG needs to find solutions to attack those you call, bad guys and what I call, greedy sociopaths. If the statute does not allow such actions, look for possible associations that can do something. Now, implementing actions in a generic way as you are arguing is wrong and no one here is qualified to tell an ISP owner how he or she should act and which tool to use. Marilson Never so few done so much harm to so many.

1 0

LEA requests 2016
by Athina Fragkouli 13 Feb '17

13 Feb '17

Dear colleagues, The RIPE NCC has published a transparency report that details the nature of the requests we received from law enforcement agencies (LEAs) in 2016. https://www.ripe.net/publications/docs/ripe-678 Kind regards, Athina Fragkouli Head of Legal RIPE NCC

2 1

Re: [anti-abuse-wg] Why SPAM exists in 2017
by peter h 13 Feb '17

13 Feb '17

On Monday 13 February 2017 16.27, HRH Prince Sven Olaf von CyberBunker wrote: > The above is , of course wrong. spam is illegal, and delivered by > illegal means, > > well. i hate to break it to you, but filtering it at an isp level, and > all activities of so-called self-declared 'blacklists' are illegal under > dutch law. it violates net-neutrality, and yes, there is a dutch law > against 'spam' but it does not 'protect' business entities, solely > natural persons. Net neutrality is a wholly different animal. Learn the difference. As regards to blocklist it's an opinion about trust, to act according to this is noones business. As mailservers are private property the owner has every right to whatever rules one wants. Reufusing to accept mail from untrusted sources is one such rule. Refusing to accept malware another rule. As for the sentence "blacklists' are illegal under dutch law" please quote the law mantioned. As for "indirect opt-ins" it's a fraud in it's entety, noone at it's sane mind will give carte blance to let enyone send spam. It's enterely a hidden clausure in micropic pront hidden under some banner. spam is theft and criminal, deliver of spam is done in a criminal fashion. Peter h / fighting spam since 1987, unfortently unsuccessful. ( i'll leave the comments below as reference for future standup comedians) > > > usually by breking into someones computer and using a bystanders Internet resources. > > > > As regards to opt-in, there is no thing as "indirect opt-ins" > yes there is. "hereby i request/agree to receive offers from <$party> OR > it's partners". > (which are left undefined) > > The rest of the confusing message is left out to save electrons ;.) > as for your vague "it is spread by illegal means"... well, if they > commit wire-fraud (or other hacks) to > distribute the spam, that seems to be a clear case... in such cases i > would not even bother with the 'spamming' aspect but just file charges > for hacking ay... doh. > > eventhough you lot of 'anti spam' idiots basically CAUSED them to take > that step, by constantly scaring email advertisers away from owning > their own infrastructure or using rented infrastructure at normal isps. > > either way to me the entire discussions seems pretty much irrelevant, as > none of you seem to have taken any steps to harden your protocol against > undesired communications, whatsoever... just 'bla bla ip reputation > rating' bla bla kinda dysfunctional crap, that never stopped any single > spam whatsoever, and at most, just generated income for competing isps, > in terms of 'setup fees' every time they changed isps. lolol. GET A > FUCKING FRIENDS LIST... d0h. and find some way in which the From: cannot > be set to random values as well, while you're at it. > > > zsnip> > > -- Peter Håkanson There's never money to do it right, but always money to do it again ... and again ... and again ... and again. ( Det är billigare att göra rätt. Det är dyrt att laga fel. )

1 0

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 63, Issue 12
by Marilson 13 Feb '17

13 Feb '17

Hi Olaf, How do you know what I wrote considering that my message about "Why SPAM exists" has not been published? If so, why did not I get it in my mail? And Olaf, my email manager blocks all messages I receive from you. Why? ;) Marilson From: HRH Prince Sven Olaf von CyberBunker Sent: Saturday, February 11, 2017 8:52 PM To: anti-abuse-wg(a)ripe.net ; Marilson Subject: Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 63, Issue 12 trump is the president of the usa, not of the internet. btw. trump prefers to use 'twitter'. not 'email'. twitter does have the option to select whose tweets one wants to see, and which ones -not-. you know... basic things... every protocol should have... and every protocol around today for that matter, DOES have... except for your silly old 'email' crap. can't just put @realDonaldTrump in a From: header and start to send viagra offers on twitter to all his followers... you can on smtp. that's one of the MAIN REASONS smtp should have died a loooong time ago, and most definately does not deserve any 'special protections' against dying out even more. On 11 فبر, 2017 م 01:02, Marilson wrote: Why SPAM exists... Because ISP exists. Because in 2004 Trump was not President... Marilson From: anti-abuse-wg-request(a)ripe.net Sent: Saturday, February 11, 2017 9:00 AM To: anti-abuse-wg(a)ripe.net Subject: anti-abuse-wg Digest, Vol 63, Issue 12 Send anti-abuse-wg mailing list submissions to anti-abuse-wg(a)ripe.net To subscribe or unsubscribe via the World Wide Web, visit https://lists.ripe.net/mailman/listinfo/anti-abuse-wg or, via email, send a message with subject or body 'help' to anti-abuse-wg-request(a)ripe.net You can reach the person managing the list at anti-abuse-wg-owner(a)ripe.net When replying, please edit your Subject line so it is more specific than "Re: Contents of anti-abuse-wg digest..." Today's Topics: 1. Why SPAM exists in 2017 (ox) 2. Re: Why SPAM exists in 2017 (peter h) 3. Re: Why SPAM exists in 2017 (Richard Clayton) ---------------------------------------------------------------------- Message: 1 Date: Sat, 11 Feb 2017 10:11:40 +0200 From: ox mailto:andre@ox.co.za To: anti-abuse-wg(a)ripe.net Subject: [anti-abuse-wg] Why SPAM exists in 2017 Message-ID: mailto:mailman.2.1486810802.25905.anti-abuse-wg@ripe.net Content-Type: text/plain; charset=US-ASCII Hello Everyone, Famously, during 2004, Bill Gates promised the world that Spam would no longer exist by 2006. More than a decade later, spam even penetrates the very best "insert whatever name here" technology. It is 2017 and apparently society does not understand why spam still exists. Of course, all of us know why there is still spam. //donning flame retardant suit (and tinfoil hat for good measure... ) For those that lurk to learn, or, for anyone with no pov on why there is still spam: ******************************** Spam exists because society does not agree on a single protocol to stop spam. (We do not all even agree on the definition of what spam is.) In society, some filter emails by DNS, some by IP number (worrying about dropping emails from co-located domains that have not updated their wordpress and are pumping out 1 legit email for every 1000 spam, etc etc - we should also discuss this sometime?) ******************************** The concern for "false positives" outrank that of sender reputation and is out of whack. (and we, society, do not want to change this) let us take a closer look at a practical (and factual) example of this imbalance: Fact: Both Google.com and Yahoo.com send out spam (unsolicited bulk email - where bulk is defined as more than one or two of the same email and unsolicited - as simply not requested or expected) Fact: We all receive many times more spam from yahoo.com as we do from google.com even though google.com transmits many times more ham than yahoo.com (Another simple truth: We all receive much more criminal activity from yahoo.com than from google.com) If you wish to dispute these simple and factual numbers you can look at the IP ranges in public data related to abuse, as the statistics report exactly the same facts that I am claiming (and experiencing)) Yet, we will be hard pressed to 'drop" incoming from yahoo.com simply based on sender score, we also do not use other RBL, that lists Google.com IP numbers, for drop. (as our users would have hissy fits if they did not get email from example@yahoo or example@gmail - in fact - they may simply move their email hosting to google... - because google/yahoo cannot be wrong, it has to be @example_of_small_isp... Our user(s) want to receive email from grandma, even though grandma has just dumped 10000 unsolicited emails asking for donations to send her old age club to the beach for "insert name of special and/or religious holiday here" Your thoughts? Andre ------------------------------ Message: 2 Date: Sat, 11 Feb 2017 09:40:44 +0100 From: peter h mailto:peter@hk.ipsec.se To: anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] Why SPAM exists in 2017 Message-ID: mailto:201702110940.44617.peter@hk.ipsec.se Content-Type: text/plain; charset="iso-8859-1" On Saturday 11 February 2017 09.11, ox wrote: > Hello Everyone, > > Famously, during 2004, Bill Gates promised the world that Spam would no > longer exist by 2006. > <snip> > Your thoughts? > > Andre Spam exists as ISP across the world, with some excemptions, don't do even the most basic procedures to detect and stop spam from their networks. Shame on them ( but it is cheap ) -- Peter H?kanson There's never money to do it right, but always money to do it again ... and again ... and again ... and again. ( Det ?r billigare att g?ra r?tt. Det ?r dyrt att laga fel. ) ------------------------------ Message: 3 Date: Sat, 11 Feb 2017 10:31:32 +0000 From: Richard Clayton mailto:richard@highwayman.com To: ox mailto:andre@ox.co.za Cc: anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] Why SPAM exists in 2017 Message-ID: mailto:TJ9nk8EEgunYFAxS@highwayman.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 In message , ox mailto:andre@ox.co.za writes >Famously, during 2004, Bill Gates promised the world that Spam would no >longer exist by 2006. he believed that the "Penny Black" scheme would work... he was wrong, the bad guys have more resources to hand than the good guys and so a system based on proof-of-work could not be effective some of us explained this at the time ... http://www.cl.cam.ac.uk/~rnc1/proofwork2.pdf - -- richard Richard Clayton They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety. Benjamin Franklin -----BEGIN PGP SIGNATURE----- Version: PGPsdk version 1.7.1 iQA/AwUBWJ7oBDu8z1Kouez7EQJJPgCfeXB+CvbraOtUzHi5FVPmio9x6XsAn2xS XzUinA/Dr9A0/PMQfqR6LFuu =hLfY -----END PGP SIGNATURE----- End of anti-abuse-wg Digest, Vol 63, Issue 12 *********************************************

3 3