- anti-abuse-wg - mailman.ripe.net

82.221.130.64/26
by Ronald F. Guilmette 17 Aug '16

17 Aug '16

Additional information about security issues relating to the 82.221.130.64/26 IP address block: https://forum.eset.com/topic/2121-what-is-this-exactly/

1 0

Re: [anti-abuse-wg] Definition of Abuse
by ox 16 Aug '16

16 Aug '16

On Tue, 16 Aug 2016 14:23:21 +0000 David Hilario <fransossen(a)hotmail.com> wrote: > Hi Andre, > Thank you so much David That is a very complete, informed and direct answer I also do not foresee anything changing anytime soon, or that there is even a need for anything to change, for that matter. We do really need a definition of "abuse" though, as some actions may, or may not be abuse and/or crimes - and when there are general discussions about "abuse" it would be good to know the definition and/or parameters. It would be within the scope of an operational abuse list, to define what abuse is. So, we are still at this last definition: "The non sanctioned use of a resource to infringe upon the usage rights of another resource" Current discussions about what needs to be added still? (add if I am missing anyone or anything please) (1) Gert Doering suggested that "there are legal reason why someone could infringe on someon else's use rights" - added the 'non sanctioned' - seems fine now, Gert? (2) unauthorized access / hacking / and/or breaking in ( Dave Crocker - abuse concerns unauthorized access ) (Andre - breaking in is crime, abuse is use something for bad purpose ) (3) causing damage to others ( Dave Crocker - "and to actions that inflict damage on others" ) ( Michele Neylon - I like the idea of “damage” or “harm” on others The “infringe on usage .. “ thing didn’t seem very clear to me and I don’t see how that would apply to spam etc) (Andre - damage is a result of an action or result of abuse? crime?) > > >Maybe you can help, David? > > > >When RIPE investigates "abuse" what are they investigating? Crimes? > >Criminal activity? Fraud? or actual abuse? > > Short version: > RIPE NCC can only investigate and take actions against resource > holders based on RIPE policy violations and contractual agreement > violations. (With the exception of legal requirements such as court > orders enforceable under dutch law, embargo that apply to Dutch based > organisation, RIPE NCC functions under Dutch law and has to comply at > that level...but those things are outside of the scope of the RIPE > policies) > > Long version: > This is the document you are looking for: > https://www.ripe.net/publications/docs/ripe-640 > > It lists the reasons for being under violations and the eventual > consequences (de-registration of resources, closure of LIR). > > Anything else is actually sort of irrelevant, unless a RIPE policy is > to be put in place against something that would be defined as > "abuse". This would be decided here within the WG and not by the RIPE > NCC. > > The RIPE NCC will then be able to enforce the policy that has been > decided here. > > I don't really foresee any of that changing anytime soon though. > But actions are taken, where actions can be taken by the RIPE NCC, > based on the current set of policies. > > Cheers, > David

1 0

Re: [anti-abuse-wg] Definition of Abuse
by David Hilario 16 Aug '16

16 Aug '16

Hi Andre, >Maybe you can help, David? > >When RIPE investigates "abuse" what are they investigating? Crimes? >Criminal activity? Fraud? or actual abuse? Short version: RIPE NCC can only investigate and take actions against resource holders based on RIPE policy violations and contractual agreement violations. (With the exception of legal requirements such as court orders enforceable under dutch law, embargo that apply to Dutch based organisation, RIPE NCC functions under Dutch law and has to comply at that level...but those things are outside of the scope of the RIPE policies) Long version: This is the document you are looking for: https://www.ripe.net/publications/docs/ripe-640 It lists the reasons for being under violations and the eventual consequences (de-registration of resources, closure of LIR). Anything else is actually sort of irrelevant, unless a RIPE policy is to be put in place against something that would be defined as "abuse". This would be decided here within the WG and not by the RIPE NCC. The RIPE NCC will then be able to enforce the policy that has been decided here. I don't really foresee any of that changing anytime soon though. But actions are taken, where actions can be taken by the RIPE NCC, based on the current set of policies. Cheers, David

1 0

Re: [anti-abuse-wg] Definition of Abuse
by Suresh Ramasubramanian 16 Aug '16

16 Aug '16

Easier to ask – why do other RIRs not have nearly the same high quantum of such issues? What do they do to prevent these, and reclaim resources allocated to bogus entities? --srs On 15/08/16, 8:56 PM, "anti-abuse-wg on behalf of ox" <anti-abuse-wg-bounces(a)ripe.net on behalf of andre(a)ox.co.za> wrote: Unauthorized access is NOT ABUSE, in terms of the current definition: "The non sanctioned use of a resource to infringe upon the usage rights of another resource" And, this is the crux of it all, this defining of "abuse" is exactly why we require a definition.

4 6

Re: [anti-abuse-wg] Definition of Abuse
by Gert Doering 16 Aug '16

16 Aug '16

Hi, On Sun, Aug 14, 2016 at 07:55:01AM +0200, andre(a)ox.co.za wrote: > Definition of Abuse as it should be defined by RIPE > --------------------------------------------------------------------- > > The use of a resource to infringe upon the usage rights of another resource I like this. I'm not sure if there are "false positives", but the general idea feels good, and thinking about it a bit, it seems to match what I consider "abuse" and does not match "non-abuse" - of course, this is now tied to what someone would consider as "infringe upon usage rights". Gert Doering -- NetMaster -- have you enabled IPv6 on something today...? SpaceNet AG Vorstand: Sebastian v. Bomhard Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279

7 8

Re: [anti-abuse-wg] Definition of Abuse
by Marilson 15 Aug '16

15 Aug '16

“Define abuse” Are you kidding? In this WG? “Complicated” Only for those who feed with the practice of abuse. “meaningless political expression” Are you with nefarious intent? (using Andre words) “it should be defined by RIPE” This just keeps getting better than stand-up comic. Until... Marilson From: anti-abuse-wg-request(a)ripe.net Sent: Monday, August 15, 2016 5:37 AM To: anti-abuse-wg(a)ripe.net Subject: anti-abuse-wg Digest, Vol 58, Issue 21 Send anti-abuse-wg mailing list submissions to anti-abuse-wg(a)ripe.net To subscribe or unsubscribe via the World Wide Web, visit https://lists.ripe.net/mailman/listinfo/anti-abuse-wg or, via email, send a message with subject or body 'help' to anti-abuse-wg-request(a)ripe.net You can reach the person managing the list at anti-abuse-wg-owner(a)ripe.net When replying, please edit your Subject line so it is more specific than "Re: Contents of anti-abuse-wg digest..." Today's Topics: 1. Re: Definition of Abuse (Gert Doering) 2. Re: Definition of Abuse (Gert Doering) 3. Re: Definition of Abuse (Sascha Luck [ml]) 4. Re: Definition of Abuse (andre(a)ox.co.za) 5. Re: Definition of Abuse (andre(a)ox.co.za) 6. Unsubscribe (Eoin C. Bair?ad) ---------------------------------------------------------------------- Message: 1 Date: Sun, 14 Aug 2016 21:15:19 +0200 From: Gert Doering <gert(a)space.net> To: andre(a)ox.co.za Cc: anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] Definition of Abuse Message-ID: <20160814191519.GM79185(a)Space.Net> Content-Type: text/plain; charset="us-ascii" Hi, On Sun, Aug 14, 2016 at 07:55:01AM +0200, andre(a)ox.co.za wrote: > Definition of Abuse as it should be defined by RIPE > --------------------------------------------------------------------- > > The use of a resource to infringe upon the usage rights of another resource I like this. I'm not sure if there are "false positives", but the general idea feels good, and thinking about it a bit, it seems to match what I consider "abuse" and does not match "non-abuse" - of course, this is now tied to what someone would consider as "infringe upon usage rights". Gert Doering -- NetMaster -- have you enabled IPv6 on something today...? SpaceNet AG Vorstand: Sebastian v. Bomhard Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279

1 0

Re: [anti-abuse-wg] Definition of Abuse
by Erik Bais 15 Aug '16

15 Aug '16

Hi Andre, > Definition of Abuse as it should be defined by RIPE > --------------------------------------------------------------------- > The use of a resource to infringe upon the usage rights of another resource The core of the problem of a good definition of abuse, is the intend of the action ... And intend is in the eye of the beholder ... I'll give an example : BGP Hijacking ... BGP Leaks ... If someone is doing a BGP Hijacks in order to knowingly divert traffic to harm others, while either the AS or the prefix is not rightfully under their control, it could be considered a Hijack. ( similar as carjacking. ) If those prefixes are used in order to : deny service to the original legitimate owner of the prefix, or an un-used prefix is abused for spewing out spam .. or to regain control of a Command and Control server/infrastructure ( Hacking Team action after Santrex was closing and they stopped announcing their prefixes ... ) there is clear intent to take something that wasn't yours in order to benefit from the outcome. However .. when some Bulgarian dude hijacked a prefix from the Ministry of Foreign Affairs 1.5 years ago, with the intent to spam on it ( Domains were pointed to it and other space they hijacked was also quickly spammed on and abused before released..) it was interesting to learn that hijacking as an Act, isn’t a crime .. (the law doesn't mention it.. it isn't illegal.. hence .. it is legal..) There could be made a case that the wrongful intent is and if they would actually spammed on the space, it is directly a crime.. But they didn't (yet) and they stopped the hijack before spamming on it.. So nothing happened, as if your neighbor borrowed your bike and returned it to your doorstep before you knew it was missing. In the same pristine condition .. It could have been said, this is a denial of service, but as the particular ministry wasn't using the space, nothing was denied ... they didn't even noticed it for a complete week. ((!! ) But that is another topic..) Now let's do a similar thing .. but with Cyber Crime fighting or Anti-Abuse in mind .. here comes the DMCA lobby or TRA (Telecom Regulator Agency in some Middle East country..) or some similar organization that is fond of protecting digital content rights.. And they are going to inject routes in a network, fiddle with BGP routing, in order to take down : Dreambox Key Servers on the internet (useful for free satellite decoding without subscriptions.. ) or phishing sites or command and control servers in $country .. or hell, why not take down the complete /21 of North Korea in the process while we talk about it ... Just because we can.. Who defines the greater good ... who is defining the wrongful intent of party X or party Y. Is the DMCA lobby correct if they want to shutdown some hosters torrent site customer.. or if the hoster correct that they don't take action on it and are not disclosing any information unless they are forced by a court order. There have been BGP injections in the past, to see if that could help in TRA compliance .. just in a subset of AS's. If those actions would have had a larger effect ... ( so large that it would have been noticed outside the region and into (this?) community perhaps.. or in the media.. ) ... who are we going to investigate .. The TRA that would like to enforce their local / regional laws and compliance .. or the violators that are facilitating the dreambox key servers that are sharing satellite subscriptions cards over the internet ... or the actual users of the dreambox in various countries ... In either of these scenario's .. the actual hoster or ISP that is hosting the 'service' on their IP space, is most likely outside the local jurisdiction and might not even be aware ... ( they are naughty/ignorant, that is different from being bad. ) In the near future, we will see a lot of grey actions, done by people that in their own mind and under their local laws, stand in their right to fiddle with your routing, if that means they can enforce local censorship or re-gain access to certain infrastructure or deny $party to their infrastructure when they will have a tactical benefit in this.. ( think Turkey during a coup.. or Syria being completely removed from the internet during attacks in Aleppo.. ) Our community covers a huge set of countries and there are quite a lot of political issues ( there are several countries that are real warzones today in our region.) .. and some of those political issues are corruption ( people getting paid to look the other way .. ) and some are just not dealing with the Spam Source because $investigator is blown out of his mind in the US or France Riviera ... RIPE isn't the internet police and this working group isn't either .. I think we should educate each other on what is going on, keep reporting on the issues we see, specifically around certain rotten area's .. We should refrain from forcing the RIPE NCC in becoming an internet police .. as they are an impartial party (like the Red Cross). They provide resources to those that need/request it.. and register who are using it. The same as the Red Cross, they hand out food to all people. Some of them might pick up a rifle 15 minutes later and shoot someone or sell that food .. but you can't blame the Red Cross for handing out food in certain areas or tell them to change their mission. Disciplinary actions (like de-registration due to abuse for instance) should not be up to the NCC, unless the information provided for registration isn´t correct. Everything else is not within the scope of the NCC imho. It should be taken up to the local law enforcement if things are not in compliance with the law ... And that could be different in each country of this huge service region... Moving into any other direction might be a very slippery slope we are getting ourselves into ... Ambition is good, but we shouldn't outreach our place in this delicate environment ... Regards, Erik Bais

2 3

Unsubscribe
by Eoin C. Bairéad 15 Aug '16

15 Aug '16

Unsubscribe me please Eoin C. Bairéad IT Mazars Block 3 The Harcourt Centre Charlotte Street Dublin 2 phone: +353 (1) 4494490 fax: +353 (1) 4750089 mobile: +353 (87) 2311357 ##################################################################################### Internet communications are not secure and the firm does not accept legal responsibility for the contents of this message. Any views or opinions presented are solely those of the author and do not necessarily represent those of the firm. This message is for the named person's use only. It may contain confidential, proprietary or legally privileged information. You must not, directly or indirectly, use, disclose, distribute, print, or copy any part of this message if you are not the intended recipient. ##################################################################################### ##################################################################################### This e-mail message has been scanned for Viruses and Content and cleared by NetIQ MailMarshal #####################################################################################

1 0

Definition of Abuse
by andre＠ox.co.za 14 Aug '16

14 Aug '16

Definition of Abuse as it should be defined by RIPE --------------------------------------------------------------------- The use of a resource to infringe upon the usage rights of another resource Reasoning: ---------------- The above covers all abuse scenarios and it does not tell anyone what to do or what not to do. It is fair and reasonable and includes everything

1 0

Re: [anti-abuse-wg] (no subject)
by Ronald F. Guilmette 14 Aug '16

14 Aug '16

andre(a)ox.co.za wrote: >We should all be able to agree on the basics... Andre, You obviously don't have the historical context, and thus, because of that, you don't get the joke. But rather than watching you flail around needlessly and pointlessly for the next couple of weeks, I'll take pity on you, give you the historical context, and then you'll get the joke _and_ understand what you are up against. I already proposed what you are proposing, well more than a year ago now, right here on this list, i.e. coming up with a common accepted definition of the word "abuse". (It seemed then... as it does now... the very height of absurdity to even have a mailing list, let alone a whole working group, dedicated to discussing and formulating policy with respect to "abuse" as long as nobody can even agree what that is, but I digress.) Anyway, my poposal to develop a definition of the word "abuse"... one that could be used by this Working Group, and others... was met with reactions which ranged from people basically telling me to f... I'm sorry... to "sod" off, all the way through to abject stunned silence. Not a single soul on this list at the time said anything that could even remotely be construed as an endorsemdent of the proposal. (I couldn't even get Suresh, whose views and mine are often in alignment, to even second the motion.) (I had intended at that time to just resign from this list in utter disgust, but somehow never was able to bring myself to do so.) Anyway, the point is that it is highly likely that nothing at all has changed in the intervening time since then, and thus, your idea to develop a definition of "abuse" has about as much chance of going anywhere as mine did. In short, you have about as much chance for success here as the proverbial snowball in hell. What you don't understand is that there are people on this list... perhaps even a majority... who have been reading too much Ayn Rand. They adamantly hold the same view of the Internet that Alan Greenspan, head of the U.S. Federal Reserve prior to the 2008 Economic Crisis, held about regulating banks, pre-2008, i.e. that the ideal policy was that everybody should be allowed to do whatever the hell they want, whenever they want, period. Note that even when he was called on the carpet and grilled about the final result of his spectacularly idiotic policies by congressional inquiries in the wake of the 2008 economic meltdown, the best that Greenspan could do was to offer up the lame excuse that he had believed that the banks would never be so foolish as to take actions which might crash the entire system, and that he believed they would avoid doing so, simply because it was in their own best interests to avoid such an outcome. Bottom line: He was wrong. Greed and short-term thinking often make falible human beings act against their own long term interests. Even if nothing else proved that, 2008 certainly did. I don't mean to discourage you from persuing the creation of a definition of "abuse". In fact I wish you all the best of luck with that. I'm only posting now to give you some idea of the fact that we've seen this movie before, and that at this point in time there's no reason to believe that it will end any differently than it did last time. But for whatever it's worth, I second your motion to develop a common definition of the word "abuse". All those in favor, please say "aye". (and cue the crickets) Regards, rfg

2 1