February 2011 - anti-abuse-wg

Re: [anti-abuse-wg] Re: Interaction between the RIPE and anti-abuse communities]
by Athina Fragkouli 10 Mar '11

10 Mar '11

Dear Kauto, all, In response to your email, here is some general information on abuse handling at the RIPE NCC. The RIPE NCC has a procedure for handling abuse complaints. Anyone can send a complaint to the email address abuse(a)ripe.net. All complaints are replied to in an appropriate manner. The timeline for the handling of a complaint varies depending on the type of abuse reported and the investigation/actions needed from our side. This procedure is currently not published. The RIPE NCC has realised the need for a publicly available procedural document in which all aspects of this procedure will be described in detail. The drafting of this document is in progress. To reply to your last question, there are some RIPE Database queries that will provide the information you require. Registration of an AS Number also requires this reference. The command: whois -r -Tinetnum,inet6num,aut-num -i org <LIRs organisation object> will give a list of all allocations and AS numbers for this LIR. It may also return assignments where the "org:" object is referenced. Using the command: whois -rM -Tinetnum,inet6num <allocation> for each allocation will give a list of all the assignments below the allocation. Please bear in mind, this may be a very long list and such a query may take time. These queries can be carried out from our web interfaces. But you might not get a full list as some of our web services have limits on the number of objects returned. Information about the sponsoring LIR is not publicly available. However, this issue has been raised by the RIPE community and a RIPE Task Force will be organised to discuss this and other relevant issues. Please see: http://www.ripe.net/ripe/policies/proposals/2010-10.html http://www.ripe.net/ripe/maillists/archives/db-wg/2011/msg00032.html Kind regards, Athina Fragkouli RIPE NCC -------- Original Message -------- Subject: Re: [anti-abuse-wg] Re: Interaction between the RIPE and anti-abuse communities Date: Wed, 02 Feb 2011 12:25:16 +0200 From: Kauto Huopio <kauto.huopio(a)ficora.fi> To: anti-abuse-wg(a)ripe.net Greetings all, I am a relative newcomer within RIPE community - but been working for some 10 years with CERT-FI, the national CERT team in Finland. During this period I have got a feeling (no statistics - yet) that the majority of cases where the validity of ipv4 / AS resource registration details can be questioned are within RIPE service area. APNIC, AFRINIC, LACNIC, ARIN -provided resources with this suspicion are quite rare on my radar. I have a couple of questions on my mind: 1) What is the current procedure to initiate an investigation with RIPE NCC on resource registration data consistency? 2) Are there any spesific requirements to be filled to trigger investiation procedures - what proof of suspicious registration data is needed? 3) Where I can find the current RIPE policies applied on this type of investigation request? 4) What kind of reply time one could expect from RIPE NCC for this type of request? 5) What methods I could use to extract -sponsoring LIR data of a inetnum / autnum object -all inetnum/autnum objects delegated by a spesified LIR from RIPE NCC WHOIS database? (personally I think there is no need to hide this information - all customer networks of an ISP can be easily extracted from BGP routing data, business protection needs IMHO do not warrant blocking this information) I have a couple of examples that could perhaps warrant a concentrated look. First is a recent and public one, documented here: http://www.abuse.ch/?p=3130 Could regisgtry consistency procedures be initiated on the suspicious resources mentioned in the blog post? A second case I would like to work with appropriate RIPE NCC staff directly. --Kauto -- Kauto Huopio - kauto.huopio(a)ficora.fi Senior information security adviser Finnish Communications Regulatory Authority / CERT-FI tel. +358-9-6966772, fax +358-9-6966515, mobile +358-50-5826131 CERT-FI watch desk daytime: +358-9-6966510 / http://www.cert.fi

5 5

Swindle
by Clara Esteve 14 Feb '11

14 Feb '11

Hello, I write you because some people swindled me out of money, and I want to find who are they. I think that it could be a quite well organisated team... They asked me money in advance via cash payment to rent a flat. I received quite a lot of emails that were going through the RIPE Network Coordination Centre . Could you tell me if this is to you that I have to send the headers of the emails received? I would be grateful if you could answer me as soon as possible. Thank you very much! Best regards, Clara Esteve

3 2

Yay. More /14s in spamhaus.
by Suresh Ramasubramanian 11 Feb '11

11 Feb '11

v4 netblocks are not candy to be handed around for the asking, are they? Not sure. 2/8 and 46/8 are relatively new too .. http://www.spamhaus.org/sbl/listings.lasso?isp=ripe SBL103318 46.42.192.0/20 RIPE 11-Feb-2011 01:46 GMT SC Netclass Srl (dirty block) (AS48838) SBL102988 2.56.0.0/14 RIPE 06-Feb-2011 02:46 GMT Michael Lindsay / iMedia Networks AS44559 spammer blocks SBL102994 94.154.64.0/18 RIPE 06-Feb-2011 09:44 GMT Michael Lindsay / iMedia Networks E-Rent LLC - dirty block -- Suresh Ramasubramanian (ops.lists(a)gmail.com)

4 6

RIPE assignment-size attribute
by Suresh Ramasubramanian 11 Feb '11

11 Feb '11

Forwarded from another list with the poster's consent Marco makes sense as usual. And this is something that any whois client should have no problem getting. One of the major problems in v6 related blocking is figuring out just how large a cidr to block - this helps. -- Suresh Ramasubramanian (ops.lists(a)gmail.com) -----Original Message----- From: Marco d'Itri [mailto:md@Linux.IT] Sent: 11 February 2011 08:35 To: [REMOVED] Subject: RIPE assignment-size attribute This new value allows for the creation of inet6num objects indicating these are aggregated End User assignments, using the "assignment-size" attribute to indicate the size of the individual End User assignments in this aggregate. IOW, this DB feature allows to know how large a user-wide blacklisting should be. ----- Forwarded message from emadaio(a)ripe.net ----- From: emadaio(a)ripe.net To: policy-announce(a)ripe.net Cc: ipv6-wg(a)ripe.net, address-policy-wg(a)ripe.net, db-wg(a)ripe.net Reply-To: ipv6-wg(a)ripe.net Subject: [ipv6-wg] 2010-06 Proposal Accepted (Registration Requirements for IPv6 End User Assignments) Dear Colleagues, Consensus has been reached, and the proposal described in 2010-06 has been accepted by the RIPE community. The updated policy "IPv6 Address Allocation and Assignment Policy" is available at: http://www.ripe.net/ripe/docs/ripe-512 The new policy "Value of the "status:" and "assignment-size:" attributes in inet6num objects for sub-assigned PA space" is available at: http://www.ripe.net/ripe/docs/ripe-513 You can find the full proposal at: http://www.ripe.net/ripe/policies/proposals/2010-06 Thank you for your input. Regards Emilio Madaio Policy Development Officer RIPE NCC ----- End forwarded message ----- -- ciao, Marco

1 0

Recent Proposals, the Taskforce & v6 Discussion
by Brian Nisbet 03 Feb '11

03 Feb '11

Morning, It seemed easier to bring all of these things into one post. First off, the proposals. Suresh, I'm not sure which proposal from Uwe you're talking about, sorry, but Tobias & Piotr's proposals, or at least the addressing of the issues they identified are progressing. Tobias has been in discussion with the NCC DB group and the other proposals are, well, proposed to be dealt with by the task force. So, that task force... We've agreed the basic structure and aims and I'd expect an announcement to go out either this week or early next week. The TF will be an open, although in an attempt to focus the work, there will be some limits on the membership, however the ongoings and results will be public and discussed. I'm no fan of secrecy and while I appreciate it is required in some areas of anti-abuse, I strongly prefer to avoid it where possible. Finally, while discussion about and awareness of v6 is a very important thing, including how it will impact on anti-abuse, I think the current discussions have been veering more than a little off topic. Thanks, Brian.

3 4

Invitation to particpate in a RIPE Task-Force
by Wilfried Woeber, UniVie/ACOnet 03 Feb '11

03 Feb '11

Invitation to join and actively contribute to a RIPE Taskforce on "Abuse Contact Management in the RIPE Database" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Background: The RIPE Database serves as a data repository for Internet resource assignments and allocations in the RIPE NCC's service region. Among other purposes, it serves as a contact repository for administrative, technical and operational matters regarding IP address ranges and autonomous system numbers. Over time, some mechanisms became available, such as the Incident Response Team (IRT) object and an abuse-mailbox: attribute. Different communities seem to have developed varying expectations and understanding of how the data quality for such contact information can be maintained at a high level, and how and when a report sent to such a contact mechanism will be responded to or otherwise acted upon. Recently, some RIPE Policy Proposals were submitted for consideration and these proposals (2010-08, 2010-09 and 2010-10) were discussed in the Address Policy Working Group, the Anti-Abuse Working Group and briefly in the Database Working Group during the RIPE 61 Meeting in Rome. Deliberations among the responsible working group chairs and senior policy experts suggested that investigation be carried out to get a deeper understanding of the motivations behind the policy proposals, the expected outcomes, the operational and maintenance implications and the role the RIPE Database could perform to support the desired results. It was then suggested to the community and the policy proponents that the most efficient way to progress the issue would be the creation of a RIPE Task Force. There was no objection raised by the members of the community present at the meeting. Call for Participation ----------------------- We invite members of the RIPE community, from the security as well as from the anti-abuse areas, to volunteer and contribute to the proposed task force. Ideally, we would like to bring together the security and anti-abuse communities and the IP resource management and network operations communities to jointly analyse and refine the issue. *Draft* Mandate for the Task Force ---------------------------------- [This draft mandate is for consideration, modification and refinement by the task force] The task force is mandated to: - Agree on a useful name for the task force and, with the help of the RIPE NCC, arrange the logistics and report back to the community about the establishment of the task force - Collect all relevant input that is readily available, in particular policy proposals, information from presentations given recently by the RIPE NCC regarding ideas on the future structure, credibility and quality of data, and the maintenance mechanisms for entries in the RIPE Database - Collect and document comparable mechanisms and proposals in the other RIR Regions (APNIC, AfriNIC, ARIN and LACNIC) - Work with the interested community and the RIPE NCC to understand the problem at hand and the environment in which to develop a proposal. This analysis of the environment should include legal aspects, formal responsibilities for the use of resources on the Internet, well-established operating procedures and relevant operational aspects. - Develop one or more (policy) proposals and/or general recommendations on how collection and maintainace of relevant information in the Registry Database should be organised, including a description of potentially alternative implementations or approaches and the related impact on all parties involved *Draft* Timeline ----------------- The Taskforce should: - Try to collect the core group of participants before end of February 2010 - Start work on the dedicated mailing list as soon as possible, with a view to meet for a face-to-face meeting in advance of RIPE 62 (May 2011) - Report on the task force's progress during RIPE 62 (May 2011) and collect regular input from the RIPE community - Submit a first draft of a recommendation(s) and/or policy proposal(s) before RIPE 63 - Agree on the proposal(s) and agree on the expected implementation deadline Submitting statements of intent to actively participate -------------------------------------------------------- If you would like to participate in the task force, please email the RIPE NCC's Database Manager, Paul Palse, at <ppalse(a)ripe.net>. ________________________________________________________________________ Best regards, Wilfried, circulating this invitation on behalf of the group of the proponents, with kudos to the colleagues at the RIPE NCC for their help with wording!

1 0

Re: [anti-abuse-wg] Draft Anti-Abuse WG Minutes ? RIPE 61
by Suresh Ramasubramanian 03 Feb '11

03 Feb '11

I am rather late to this thread as it was just drawn to my attention elsewhere. 1. Richard Cox's concerns were entirely valid, and the abuse issues documented at http://www.spamhaus.org/Sbl/listings.lasso?isp=RIPE - mostly PI / PA blocks, several as large as /15, can't be wished away by removing critics of this WG from a co-chair post. 2. I would echo Peter's concerns about this being brought up as AOB, discussed (or rather, not discussed) in overtime with very few people in the room, leading to the removal of a co-chair. A much wider consensus should have been obtained - at least by discussion on this list if not at the plenary. This was not consensus. WG participants (and I count several who are in the anti abuse community, engage regularly with RIRs at other fora, but don't typically have the budget to travel to RIPE) should have been consulted before this. Yes, nobody else had much to say about this removal, so I'll take this opportunity to comment. About Richard Cox's removal and about two other meta issues. First - the prevailing attitude I have seen from at least some participants (this is not "us vs them" in terms of routing / dns people vs abuse people .. you have colleagues in your own organizations who will disagree with your views - especially Shane, I won't speak for Paul Vixie but I am not at all sure he'd agree with you about your comment, even after its rephrase). Second - the mantra, meme, fallacy etc of the "we are not the XYZ police" that I keep hearing cited. It would be fun indeed if a bank manager sanctioned a loan for say a quarter of a million dollars (lets say comparable to an allocation for a /15) and then baldly state that he's not the document police .. That presentation I saw discussed is what I'd call partially shutting the barn door long after the horses, plural, have bolted. That damage's been done, a lot of IP space has been poisoned. It is high time to realize that shooting the messenger is not the best way to deal with such a situation. srs Peter Koch wrote: > > On Wed, Dec 15, 2010 at 03:47:42PM +0000, Brian Nisbet wrote: > > > Peter Koch said the session was already overrun by 15 minutes and this > delicate issue should be resolved at another time. > > I'd like to clarify that my point was that this topic was placed under AOB > _and_ mostly dealt with during overtime, which, absence of written process > and procedures nonwithstanding, did not meet my expectations and experiences > of appropriateness given delicacy. That said, I consider the issue closed. JD Falk wrote: > On Dec 15, 2010, at 3:15 PM, Shane Kerr wrote: > >> I think that my point was that there is a disconnect between people >> working on anti-abuse and the ISPs, not about the Anti-Abuse Working >> Group or its participants. I might not have said that of course... > > Many people who work for ISPs would agree. It's often simply a matter of scale > and imagination.... >

15 38

Re: [anti-abuse-wg] Draft Anti-Abuse WG Minutes - RIPE 61
by Suresh Ramasubramanian 02 Feb '11

02 Feb '11

I am rather late to this thread as it was just drawn to my attention elsewhere. 1. Richard Cox's concerns were entirely valid, and the abuse issues documented at http://www.spamhaus.org/sbl/listings.lasso?isp=RIPE - mostly PI / PA blocks, several as large as /15, can't be wished away by removing critics of this WG from a co-chair post. 2. I would echo Peter's concerns about this being brought up as AOB, discussed (or rather, not discussed) in overtime with very few people in the room, leading to the removal of a co-chair. A much wider consensus should have been obtained - at least by discussion on this list if not at the plenary. This was not consensus. WG participants (and I count several who are in the anti abuse community, engage regularly with RIRs at other fora, but don't typically have the budget to travel to RIPE) should have been consulted before this. Yes, nobody else had much to say about this removal, so I'll take this opportunity to comment. About Richard Cox's removal and about two other meta issues. First - the prevailing attitude I have seen from at least some participants (this is not "us vs them" in terms of routing / dns people vs abuse people .. you have colleagues in your own organizations who will disagree with your views - especially Shane, I won't speak for Paul Vixie but I am not at all sure he'd agree with you about your comment, even after its rephrase). Second - the mantra, meme, fallacy etc of the "we are not the XYZ police" that I keep hearing cited. It would be fun indeed if a bank manager sanctioned a loan for say a quarter of a million dollars (lets say comparable to an allocation for a /15) and then baldly state that he's not the document police .. That presentation about LIR deregistration is what I'd call partially shutting the barn door long after the horses, plural, have bolted. That damage's been done, a lot of IP space has been poisoned. It is high time to realize that shooting the messenger is not the best way to deal with such a situation. srs Peter Koch wrote: > > On Wed, Dec 15, 2010 at 03:47:42PM +0000, Brian Nisbet wrote: > > > Peter Koch said the session was already overrun by 15 minutes and this > delicate issue should be resolved at another time. > > I'd like to clarify that my point was that this topic was placed under AOB > _and_ mostly dealt with during overtime, which, absence of written process > and procedures nonwithstanding, did not meet my expectations and experiences > of appropriateness given delicacy. That said, I consider the issue closed. JD Falk wrote: > On Dec 15, 2010, at 3:15 PM, Shane Kerr wrote: > >> I think that my point was that there is a disconnect between people >> working on anti-abuse and the ISPs, not about the Anti-Abuse Working >> Group or its participants. I might not have said that of course... > > Many people who work for ISPs would agree. It's often simply a matter of scale > and imagination.... >

6 11