November 2010 - anti-abuse-wg

2010-09 New Policy Proposal (Frequent Update Request)
by Emilio Madaio 01 Dec '10

01 Dec '10

Dear Colleagues A new RIPE Policy Proposal has been made and is now available for discussion. You can find the full proposal at: http://ripe.net/ripe/policies/proposals/2010-09.html We encourage you to review this proposal and send your comments to <anti-abuse-wg(a)ripe.net> before 7 December 2010. Regards Emilio Madaio Policy Development Officer RIPE NCC

8 7

2010-10 Policy Proposal Withdrawn (Adding reference to sponsoring LIR in inetnum, inet6num and aut-num objects)
by Emilio Madaio 29 Nov '10

29 Nov '10

Dear Colleagues, The proposed change to RIPE Document has been withdrawn. It is now archived and can be found at: http://www.ripe.net/ripe/policies/proposals/2010-10.html Reason for withdrawal: the proposer decided to withdraw the proposal based on the feedback received at RIPE 61. A task force will be organised to solve the implementation issues pointed out by the proposal discussion. Regards Emilio Madaio Policy Development Officer RIPE NCC

1 0

OECD report on SPAM
by julien tayon 24 Nov '10

24 Nov '10

Hello, http://www.oecd.org/officialdocuments/displaydocumentpdf/?cote=dsti/doc%282… In short, in this long report, abuse handling is pinpointed as essential in cutting off spam & crimes (there are no cyber crimes, only crimes imho). Sounds like trivial to me, but who knows ? I guess some pressure is directed from OECD to RIR for an «improved» abuse handling :) This may be the LEA pressure we heard of on this list sooner and the reason it came back to life after years of sleeping. :P Since there is a bimodal distribution with very few ISP (50) accounting for 30% of spam and they suggest to target legitimate ISP. Europa (RIPE region) seems to be the region with the most infected big ISP (which is not correlated with volume)... * making the asumption that these 50 ISP have a poor abuse handling ; * remembering that RIPE IP handling is linked to the respect of the procedure and the quality (contractually) ; * observing that RIPE region is one of the most infected ; My question is : does RIPE have a responsability in this topic by not enforcing the «we shall not give you new IP» rules when ISP failed to handle their abuse ? sed quis custodiet ipsos custodes?

4 4

RIPE 61 WG Session - Important Note
by Brian Nisbet 20 Nov '10

20 Nov '10

Colleagues, While the minutes for the RIPE 61 session will be distributed in due course, I felt it was important to notify the working group of one item that happened during the meeting. Concern was raised about Richard Cox's position as co-chair. After thirty minutes of discussion consensus was reached and it was decided that Richard was no longer a suitable person to continue as co-chair. This had been building for some months due to reasons which are laid out in the minuted discussion and transcript. This was not a decision reached lightly nor quickly and I can only express my pity that it came to this. I spoke to Richard on Tuesday, prior to the session, and I informed him of this decision after it was made. I would like to take this opportunity to thank him for the work he did as co-chair and express my hope that he will continue to be involved in the RIPE community and this working group. The full account of the meeting will, as previously mentioned, be recorded in the minutes. If you have any questions regarding this, please don't hesitate to contact me. Brian.

1 0

Support and comments - prop 2010-08
by Suresh Ramasubramanian 18 Nov '10

18 Nov '10

First - I support the addition of a mandatory abuse-mailbox: field in the IRT object. I have two caveats to raise - 1. There is no requirement that the contact information be accurate (that the mailbox exists and is monitored, action taken on reports) 2. There is no mention of what action should / will be taken in case this contact information turns out to be wrong (or deliberately faked) thanks suresh This statement of support is in my personal capacity as an antispam volunteer and postmaster for the past 15 years, and does not represent any statement or commitment made by my employer.

2 1

Webmail abuse mitigation
by Andy Davidson 18 Nov '10

18 Nov '10

Hi, There was question on Jabber in the Anti Abuse working group at RIPE 60. I cited an open source project of Loughbrough University (Kochi) that is designed to help with the automatic mitigation of webmail credential compromise (and the effects of the same). See : http://www.uknof.org.uk/uknof13/Fowler-Phish.pdf http://oss.lboro.ac.uk/kochi1.html Best wishes, Andy Davidson, NetSumo / LONAP.

1 0

Support of, and comments on, proposal 2010-08
by Vissers, Pepijn 17 Nov '10

17 Nov '10

Dear list, On behalf of the Team Internetsafety of the Dutch Telecommunications Authority OPTA, I would like to comment on the draft proposal 2010-08. The Team Internetsafety conducts spam- and malware investigations related to the Netherlands. Almost all of these investigations have components which require us to use RIPE (or other RIRs) for several pieces of information, most commonly valid abuse contacts for a netblock or ASN. We strongly support the mandatory addition of an abuse-mailbox: field in the irt object. However, we see several loopholes in the current contents of the proposal. 1. There is no mention in the policy about the validity of an abuse-mailbox: entry 2. There is no mention in the policy about the responsiveness of an abuse-mailbox: entry 3. There is (logically) no mention in the policy about a periodic check on (1) and (2) 4. There is no mitigating procedure in case of false/missing/invalid/... abuse-mailbox: information Ad 1: What will stop a RIPE member from entering an invalid e-mail address? If the purpose of the policy is to 'solve the problem of finding the right abuse contact', some additional procedure should be in place to make sure mail to the mentioned abuse-mailbox: does actually arrive somewhere and does not bounce. Ad 2: A valid e-mail address is no guarantee that abuse mail is being handled or even looked at. Although we recognize it might not be the responsibility of RIPE to ensure a maintainer has a proper abuse policy mechanism in place, we'd encourage some additional reflection on this issue. Ad 3: Requiring a field update with each object update is a good idea, however with largely static objects it might be a good idea to periodically check at least (1) and preferably (2). Ad 4: If a member (systematically) does not adhere to the mandatory policy, some kind of procedure should be in place to motivate the member to follow procedure. Without 'repercussions', a 'mandatory' policy becomes just mandatory in name, not in function. Kind regards, Pepijn Vissers Team Internetsafety OPTA - +++++++++++++++++++++++++++++++++++++++++++++ Disclaimer Dit e-mailbericht kan vertrouwelijke informatie bevatten of informatie die is beschermd door een beroepsgeheim. Indien dit bericht niet voor u is bestemd, wijzen wij u erop dat elke vorm van verspreiding, vermenigvuldiging of ander gebruik ervan niet is toegestaan. Indien dit bericht blijkbaar bij vergissing bij u terecht is gekomen, verzoeken wij u ons daarvan direct op de hoogte te stellen via tel.nr 070 315 3500 of e-mail mailto:mail@opta.nl en het bericht te vernietigen. Dit e-mailbericht is uitsluitend gecontroleerd op virussen. OPTA aanvaardt geen enkele aansprakelijkheid voor de feitelijke inhoud en juistheid van dit bericht en er kunnen geen rechten aan worden ontleend. This e-mail message may contain confidential information or information protected by professional privilege. If it is not intended for you, you should be aware that any distribution, copying or other form of use of this message is not permitted. If it has apparently reached you by mistake, we urge you to notify us by phone +31 70 315 3500 or e-mail mailto:mail@opta.nl and destroy the message immediately. This e-mail message has only been checked for viruses. The accuracy, relevance, timeliness or completeness of the information provided cannot be guaranteed. OPTA expressly disclaims any responsibility in relation to the information in this e-mail message. No rights can be derived from this message.

4 5

2010-10 New Policy Proposal (Adding reference to sponsoring LIR in inetnum, inet6num and aut-num objects)
by Emilio Madaio 17 Nov '10

17 Nov '10

Dear Colleagues, A proposed change to RIPE Document ripe-452,"Contractual Requirements for Provider Independent Resource Holders in the RIPE NCC Service Region", is now available for discussion. You can find the full proposal at: http://ripe.net/ripe/policies/proposals/2010-10.html We encourage you to review this proposal and send your comments to <anti-abuse-wg(a)ripe.net> before 10 December 2010. Regards Emilio Madaio Policy Development Officer RIPE NCC

9 10

Request if Informations
by Carloalberto Sartor 17 Nov '10

17 Nov '10

Hi, I don't know if you are the correct contact for this kind of abuse. I have a great problem like this. The site attention-swindlers.com is registered by an identity theft. The apparent registrant, mr. Mokrane, reports me that he never registered that site. In that site there is an hard defamation about him, the Vatican State, and so on. This confirms that he isn't the true registrant. I wrote to nic.ru asking them to obscure site and domain, explaining the case (that involves diplomatic problems, I remark!). They repeated that I have to contact site admin and to solve the problem contracting with him and that they can't do nothing. I'll move an italian lawyer and activate the international legal procedure and surely with long time, I will obtain the end of this site but between the action and the solution the site will enter into search engines and so on... What can I do to stop this abuse? Thanks for you kind response!!! -- Carloalberto Sartor Digitalexpert.it, Consulenze informatiche Via Astichelli 14 - 36031 Dueville (VI) Tel.: 0444592675 Cell.: 3492517691 www.digitalexpert.it (generale, EMON ) www.descmain.it (monitoring apps) Consigli per gli acquisti: Usa "UBI ES" per posta con allegati giganti Usa "EMON" per il monitoraggio dei sistemi Usa "EBAK" per i tuo backup senza pensieri Usa "SeSi" per la sicurezza informatica Usa tanta pazienza con i computer!!!

2 1

2010-08 New Policy Proposal (Abuse contact information)
by Emilio Madaio 12 Nov '10

12 Nov '10

Dear Colleagues, A new RIPE Policy Proposal has been made and is now available for discussion. You can find the full proposal at: http://www.ripe.net/ripe/policies/proposals/2010-08.html We encourage you to review this proposal and send your comments to <anti-abuse-wg(a)ripe.net> before 6 December 2010. Regards Emilio Madaio Policy Development Officer RIPE NCC

16 81