December 2011 - anti-abuse-wg

Re: [anti-abuse-wg] 2011-06 New Policy Proposal (Abuse Contact Management in the RIPE NCC Database)
by Gilles Massen 30 Mar '12

30 Mar '12

Hello, This policy proposal seems a bit incomplete to, as it fails to address the problem statement from the summary. >From the summary: "...it is not clear whether to use the "abuse-mailbox:" attribute, the "remark:" attribute or an irt object.". What is supposed to happen to IRT objects, or data from them? For existing records: at the very least it should be explicit which tags should no longer be used or would be deprecated / removed in order to give clear guidance. Another point: if the general idea of the policy is acceptable, wouldn't it be nice to have 2 abuse mailboxes: one for humans, one for bots? Best, Gilles -- Fondation RESTENA - DNS-LU 6, rue Coudenhove-Kalergi L-1359 Luxembourg tel: (+352) 424409 fax: (+352) 422473

25 73

Re: [anti-abuse-wg] 2011-06 New Policy Proposal (Abuse Contact Management in the RIPE NCC Database)
by Leo Vegoda 30 Jan '12

30 Jan '12

Hi, The proposed policy text includes: "The role objects used for abuse contact information will be required to contain a single "abuse-mailbox:" attribute which is intended for receiving automatic and manual reports about abusive behavior originating the resource holders' networks." Do the proposers intend the requirement for the "abuse-mailbox:" attribute to be enforced in any way and if so, how? Thanks, Leo

11 35

Re: [anti-abuse-wg] Spam FAQs need revision, was 2011-06 New Policy
by Joe St Sauver 29 Dec '11

29 Dec '11

Hi Laura, You mentioned: #We have published new FAQs on spam/hacking. You can find them online at: # http://www.ripe.net/data-tools/db/faq/faq-hacking-spamming Tremendous improvement, thank you! One suggestion for the last item ("Where can I find out more about spam/hacking?"), which currently only has two items, would be to add additional resources, perhaps: -- Messaging Anti-Abuse Working Group (http://www.maawg.org/) -- Spamhaus (http://www.spamhaus.org/) -- Spamwiki (http://spamtrackers.eu/wiki/index.php/Main_Page) Thanks for all the work on this, Merry Christmas/Happy New Year! Regards, Joe

14 41

Spam FAQs, Whois Query Restrictions etc
by Brian Nisbet 20 Dec '11

20 Dec '11

Morning, There's been an amount of useful discussion recently, but I think it might be all getting a little circular at this point. I'd like to thank the NCC, as others have done, for their work in updating the FAQs and I'm very glad the overall response has been positive. On the matter of network-tools.com and the whois restrictions, I think the point has been presented and argued, but it has also been argued against and I don't think we're getting anywhere. Russ, if you want to take this any further you have the option of lobbying the NCC directly either as or via a member, or seeing what's possible via the policy route. The Chairs of the working group (aa-wg-chairs(a)ripe.net) are happy to help you with the latter. I don't think that claims about other companies, especially those that involve judicial proceedings, are useful, and they are even less useful if they cannot be backed up, so let's not have any of that on the list please. Thanks, Brian.

1 0

Re: [anti-abuse-wg] Privacy requirements, was Spam FAQs
by Joe St Sauver 19 Dec '11

19 Dec '11

Niall commented: #There's also services like http://www.radb.net who mirror the data from #all the IRRs who you might like to deal with! Unfortunately, at least in my experience, the routing registry data is often stale or inaccurate, even for things as basic as ASN information. This is not the fault of the RADB folks, it's simply that many users don't take the time to keep their routing registry objects up-to-date. Therefore, while some whois clients query the RADB for ASN information, in my experience, you really want to always check the RIRs for the "last word" when it comes to who controls a given resource (and of course, the sort of data that the RADB offers doesn't have the same coverage as the RIRs, anyhow). That's the main reason why I'm always concerned when I bump into, or I hear about others who've bumped into, well-intentioned but operationally-problematic whois rate limits or anti-harvesting provisions. If systems are old and underprovisioned for modern loads, my recommendation would be to make upgrading them an operational priority, or work on plans to mirror/replicate the data so that normal operational traffic isn't going to result in systems becoming slow or overloaded. Regards, Joe

1 0

Privacy requirements, was Spam FAQs
by Karl-Josef Ziegler 18 Dec '11

18 Dec '11

> And if you want to access a European database then you are going to > have to deal with us nasty Europeans. Just 2 things: - Privavy laws in Europe seem to have much stronger restrictions compared to US laws. - And: a contract between ICANN/IANA and RIPE can't break European laws. European law is stronger than such a contract. If this should be changed it needs a mutual agreement between EU and US government. Is such an agreement in place? Just my 2 cents and IANAL, - Karl-Josef

1 0

whois access
by russ＠consumer.net 16 Dec '11

16 Dec '11

Hi. I am a problem with RIPE mis-applying it anti-abuse procedures for the RIPE database. I have operated Network-Tools.com for 13 years. The site is often used by people tracing spam or other security issues that includes IP address block lookups so people can send in a complaint or otherwise contact the network they have an issue with. I find my web site is suddenly blocked from accessing the RIPE database and I cannot get answers to my questions from contacting the database administrator or IANA. First - I am being accused of wanting "bulk access" to the database. That is not true. My system is a pass-through system where many different people make requests through network-tools.com. The web site is merely a pass-through. I have asked many times how I can pass the requestor's IP address through so my web site won't be "penalized." I never get an answer from RIPE. ARIN told me they don't support such a scheme. One purpose of the whois is so that individuals can contact abuse contacts, verfify who owns address blocks, etc. so blocking pass-through systems thwarts the whole purpose of the RIPE database. Second- RIPE keeps claims the requests are for "personal information." IP address and abuse contacts are business contacts and role accounts meant for the public. this is nor "personal information" (ARIN calls it "sensitive" data). These are business contacts meant for the public, not "personal information" or "sensitive." If if were "sensitive" it would not be available to the public. In any case I do not want to display sensitive data or personal information, I want to display the abuse contacts. As for blocking IP from accessing the database I do not see the purpose anyway. Most harvesters use a distributed system of IP addresses so blocking IP only serves to disrupt pass-through systems doing legitimate tasks while harvesters continue to freely collect their data. For the most part the only thing it does is disrupt legitimate users and cause expense to those users for no purpose. How can I get answers to these questions? Thank you

8 19

Re: [anti-abuse-wg] How to find abandoned networks (was Spam FAQs need revision)
by Joe St Sauver 14 Dec '11

14 Dec '11

Shane commented: #What a great method for finding networks that are poorly monitored and #maintained! Simply check ARIN's Whois database until you find networks #with POC that are marked as invalid! # #I hope that RIPE does not adopt this address-hijacking-friendly #technique. :( If I were a person inclined toward hijacking netblocks, I think I'd likely use data from Routeviews (or a similar routing table analysis project) to identify IP address ranges that consistently are absent from the global routing table. You could certainly use whois database queries in an effort to verify or validate potential target IP address ranges, but I don't really see stale data flags in whois as materially worsening the existing problem of abusers scavening apparently unused (or underused) network resources. After all, if a bad guy or bad gal sees a "juicy" likely-"abandoned" /16 or whatever, it really isn't that hard for them to try emailing the points of contact, or to try calling the listed phone POCs, etc. If the goal is to seriously deter address hijacking, I think we need to talk about things like RPKI (folks who may be interested may want to see Bush and Austein's NANOG RPKI Tutorial from June 2011, http://www.nanog.org/meetings/nanog52/abstracts.php?pt=MTc3MyZuYW5vZzUy&nm=… or for those who find URL shorteners more convenient, try http://tinyurl.com/rpki-tutorial for that same page). Or, if you're skeptical of RPKI, encourage your friends to carefully monitor their space and how it's being announced. But I digress :-; Regards, Joe

4 6

Re: [anti-abuse-wg] Spam FAQs need revision
by Wout de Natris 13 Dec '11

13 Dec '11

Hi, > -- "Should I just ignore spam?" On the spam should be ignored discussion. It's time people realised and acted upon the fact that by reporting spam and all the content/fraud/phishing/malware related with spam to spam reporting centres and/or authorities, maybe just something will change. Somewhere in this data the identity of the spammers lies hidden, including the data of all involved, whether consciously or unconsciously. Also countries or agencies less active will be revealed. Transparency is what this discussion needs and that may just prove half of the much needed silver bullet. Without reporting there is no analyses of data. So please change the topic to report spam actively where possible. And perhaps even add that if there is no spam reporting centre in a country, to lobby to your local government to start one. Regards, Wout - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - De Natris Consult Raaphorst 33 Tel: +31 648388813 2352 KJ Leiderdorp Skype: wout.de.natris denatrisconsult(a)hotmail.nl http://www.denatrisconsult.nl Blog http://woutdenatris.wordpress.com ******** Due to privacy concerns, part of this message has been removed as per the sender's request ********

2 1

Re: [anti-abuse-wg] Spam FAQs need revision, was 2011-06 New Policy
by Joe St Sauver 13 Dec '11

13 Dec '11

Hi, When I look at http://www.ripe.net/data-tools/db/faq/faq-hacking-spamming/ I'd probably write something that looks quite a bit different than what's currently there. For example, just starting at the top: -- "What is spam? FAQ currently says: "Spam is junk email, usually offering bogus products and invitations to pornography sites. Sometimes, spam email is used to spread viruses. You may also receive 'phishing' emails. These are emails that look like they have been sent by a legitimate organisation and attempt to fraudulently acquire sensitive information, such as passwords and credit card details." I'd suggest that the definition of "spam" that's available at http://www.spamhaus.org/definition.html is significantly stronger. -- "Should I just ignore spam?" FAQ currently says: "Yes. We recommend that you simply ignore and delete any spam emails you get. Spam is a universal problem and there is not much that can be done to stop it. However, if you do want to try to find out where the spam is originating from you can follow the steps in FAQ 5." I'd suggest that's a passive/defeatist approach that spammers absolutely adore since it fails to put any back pressure on spammers. By NOT reporting spam, service providers hosting spam-related sites (and service providers with botted customers) get no feedback that will allow them to clean up their issues. That really needs to change. I'd suggest: "No. Consider reporting spam via a well-established spam reporting channel. This might be a "this is spam" button offered as part of your provider's web email interface, or via a third party spam reporting service such as Spamcop (http://spamcop.net/), which is free. If you want to report spam directly, you may find it helpful to see the abuse reporting addresses available from http://abuse.net/" I'd like to suggest that users report spam to appropriate government agencies, see for example: http://spamlinks.net/track-report-addresses.htm#country I would also note that encouraging user reporting is consistent with the explanation that's provided later in the FAQ under "What can I do to stop spam emails?" which goes into some detail when it comes to how to actually do manual spam reporting. -- "What can the RIPE NCC do about the spam email I have received?" FAQ currently says: "Unfortunately, the RIPE NCC can do nothing about spam email or 'phishing' email. The RIPE NCC does not send, or facilitate the sending of, spam email. Nor is it responsible for any spam you receive. It is also unable to investigate any complaints about spamming." Again, that's not the answer to this FAQ item that I'd like to see. I would like to see RIPE NCC acknowledge that it *does* have a role in combatting network abuse, particularly when it comes to ensuring that the resources it manages are not abused. For example, if RIPE NCC learns that a network resource has been acquired under fraudulent pretenses for the purpose of engaging in network abuse, or a network resource has bogus point of contact information, those behaviors are not acceptable and will result in a review by RIPE NCC and, if that abuse is confirmed, those resources will be reclaimed. Obviously that would also imply a change to "Why are there no contact details or incorrect contact details for reporting spam email listed in the RIPE Database for the IP address I searched on?" which states "The records in the Regional Internet Registries'(RIR) databases are entered and maintained by the organisations that receive IP addresses from each RIR. The RIRs do not check the accuracy of any of the records in the database or make any changes to the data maintained by these organisations. The RIPE NCC has no power to update any of these records." If nothing else, that FAQ answer should *at least* be updated to correct factual inaccuracies because at least *some* other RIRs *DO* check and/or correct inaccuracies in their databases, e.g., see, in the case of ARIN, APNIC and LACNIC, see: -- https://www.arin.net/policy/nrpm.html#three6 "3.6 Annual Whois POC Validation "3.6.1 Method of Annual Verification "During ARINs annual Whois POC validation, an email will be sent to every POC in the Whois database. Each POC will have a maximum of 60 days to respond with an affirmative that their Whois contact information is correct and complete. Unresponsive POC email addresses shall be marked as such in the database. If ARIN staff deems a POC to be completely and permanently abandoned or otherwise illegitimate, the POC record shall be marked invalid. ARIN will maintain, and make readily available to the community, a current list of number resources with no valid POC; this data will be subject to the current bulk Whois policy." -- http://www.apnic.net/apnic-info/whois_search/abuse-and-spamming/invalid-con… "Use this form to report invalid contact details found in the APNIC Whois Database. APNIC will take appropriate steps to try to have the database objects updated." See also http://www.apnic.net/policy/policy-environment#processing at 7.1 ("Validity of IP address delegations") -- http://lacnic.net/en/politicas/manual7-1.html ("Resource Recovery") See also http://lacnic.net/en/politicas/manual7-1.html "The organizations receiving IPs addresses from LACNIC have the commitment to keep their registration information updated. "But, in the case it is noticed that some information is invalid we ask you to communicated the fact to hostmaster(a)lacnic.net informing the IP address with invalid registration information." So, RIPE may not have processes for keeping their part of the global databases accurate, but other RIRs do... There are also many redundancies in the FAQ, e.g., see the "Can I stop spam?" item vis-a-vis "Should I just ignore spam?" Or "I want to know more about spam" vs. "Where can I find more information about spam" Or "How do I found out who's behind a suspect message?" vs. the tutorial on reading headers that's in "What can I do to stop spam emails?" And there are other duplications of that sort in the FAQ... I think it probably grew over time, but as stuff got slotted into the document, no deconfliction and reconciliation ever took place. I think that work to do that would strengthen the document and make it considerably stronger. Regards, Joe

7 6