anti-abuse-wg

Download

anti-abuse-wg@ripe.net

March 2011

23 participants
7 discussions

Proposed New Working Group Co-Chair
by Brian Nisbet 24 Mar '11

24 Mar '11

Colleagues, After the events of RIPE 61 I announced that it was my intention to have a new co-chair in place at or by RIPE 62 in Amsterdam this coming May. After the comments at that meeting and the emails I sent out in the interim, one person has put themselves forward. I believe this person to be eminently suitable for the position and so I would like to present him to the working group for your consideration. As there is one position and one candidate it is a matter of simple consensus. My intention is to give a period of two weeks on the list for any comments to be sent (either to the list or to me personally) and then to devote a short amount of time to this at our WG session in Amsterdam. However assuming there is no notable objection on the mailing list this should be a very small amount of time indeed. Anyway, that's a lot of preamble, the candidate to take up the position of Co-Chair of the RIPE Anti-Abuse WG is Tobias Knecht from Abusix. Many of you will already know Tobias and I believe that his knowledge of and connections to the anti-abuse community will be extremely useful in progressing the work of the AA-WG. If you have any questions for Tobias (or for me, obviously) then, as I said, please email them either directly to us or to the list. Thanks, Brian. Chair, RIPE Anti-Abuse WG

11 10

RIPE policy
by Ronald F. Guilmette 13 Mar '11

13 Mar '11

15 96

Closure of LIR and Deregistration of Internet Number Resources
by Axel Pawlik 10 Mar '11

10 Mar '11

[Apologies for duplicate emails] Dear colleagues, The RIPE NCC, after receiving feedback from the RIPE community on the draft version, has published the procedural RIPE Document ripe-517, "Closure of LIR and Deregistration of Internet Number Resources". The document is available at: https://www.ripe.net/ripe/docs/ripe-517 This document replaces sections in two RIPE Documents that deal with the closure of LIRs and the deregistration of resources: - Sections 3.0 and 4.0 of ripe-301, "Mergers, Acquisitions, Takeovers and Closures of Organisations Operating an LIR". These sections are entitled "Closing an LIR" and "When an LIR is Closed by the RIPE NCC", respectively. The updated version of this RIPE Document is available at: https://www.ripe.net/ripe/docs/ripe-515 - Sections 4.0, 4.1 and 4.2 of ripe-475, "Independent Internet Number Resources - Contractual Relationship Changes between sponsoring LIR and End User". These sections are entitled “De-registering of Independent Internet Number Resources”, “Closure of Sponsoring LIR” and "Violation of RIPE Policy, Law or Contract", respectively. The updated version of this RIPE Document is available at: https://www.ripe.net/ripe/docs/ripe-516 The RIPE NCC would like to thank the RIPE community for its feedback. An interactive chart that helps to explain the process of closure of LIRs and deregistration of Internet number resources will be available shortly. Best regards, Axel Pawlik Managing Director RIPE NCC

1 0

Re: [anti-abuse-wg] Re: Interaction between the RIPE and anti-abuse communities]
by Athina Fragkouli 10 Mar '11

10 Mar '11

Dear Kauto, all, In response to your email, here is some general information on abuse handling at the RIPE NCC. The RIPE NCC has a procedure for handling abuse complaints. Anyone can send a complaint to the email address abuse(a)ripe.net. All complaints are replied to in an appropriate manner. The timeline for the handling of a complaint varies depending on the type of abuse reported and the investigation/actions needed from our side. This procedure is currently not published. The RIPE NCC has realised the need for a publicly available procedural document in which all aspects of this procedure will be described in detail. The drafting of this document is in progress. To reply to your last question, there are some RIPE Database queries that will provide the information you require. Registration of an AS Number also requires this reference. The command: whois -r -Tinetnum,inet6num,aut-num -i org <LIRs organisation object> will give a list of all allocations and AS numbers for this LIR. It may also return assignments where the "org:" object is referenced. Using the command: whois -rM -Tinetnum,inet6num <allocation> for each allocation will give a list of all the assignments below the allocation. Please bear in mind, this may be a very long list and such a query may take time. These queries can be carried out from our web interfaces. But you might not get a full list as some of our web services have limits on the number of objects returned. Information about the sponsoring LIR is not publicly available. However, this issue has been raised by the RIPE community and a RIPE Task Force will be organised to discuss this and other relevant issues. Please see: http://www.ripe.net/ripe/policies/proposals/2010-10.html http://www.ripe.net/ripe/maillists/archives/db-wg/2011/msg00032.html Kind regards, Athina Fragkouli RIPE NCC -------- Original Message -------- Subject: Re: [anti-abuse-wg] Re: Interaction between the RIPE and anti-abuse communities Date: Wed, 02 Feb 2011 12:25:16 +0200 From: Kauto Huopio <kauto.huopio(a)ficora.fi> To: anti-abuse-wg(a)ripe.net Greetings all, I am a relative newcomer within RIPE community - but been working for some 10 years with CERT-FI, the national CERT team in Finland. During this period I have got a feeling (no statistics - yet) that the majority of cases where the validity of ipv4 / AS resource registration details can be questioned are within RIPE service area. APNIC, AFRINIC, LACNIC, ARIN -provided resources with this suspicion are quite rare on my radar. I have a couple of questions on my mind: 1) What is the current procedure to initiate an investigation with RIPE NCC on resource registration data consistency? 2) Are there any spesific requirements to be filled to trigger investiation procedures - what proof of suspicious registration data is needed? 3) Where I can find the current RIPE policies applied on this type of investigation request? 4) What kind of reply time one could expect from RIPE NCC for this type of request? 5) What methods I could use to extract -sponsoring LIR data of a inetnum / autnum object -all inetnum/autnum objects delegated by a spesified LIR from RIPE NCC WHOIS database? (personally I think there is no need to hide this information - all customer networks of an ISP can be easily extracted from BGP routing data, business protection needs IMHO do not warrant blocking this information) I have a couple of examples that could perhaps warrant a concentrated look. First is a recent and public one, documented here: http://www.abuse.ch/?p=3130 Could regisgtry consistency procedures be initiated on the suspicious resources mentioned in the blog post? A second case I would like to work with appropriate RIPE NCC staff directly. --Kauto -- Kauto Huopio - kauto.huopio(a)ficora.fi Senior information security adviser Finnish Communications Regulatory Authority / CERT-FI tel. +358-9-6966772, fax +358-9-6966515, mobile +358-50-5826131 CERT-FI watch desk daytime: +358-9-6966510 / http://www.cert.fi

5 5

Recent Trends in List Discussion & RIPE Policy
by Brian Nisbet 09 Mar '11

09 Mar '11

Colleagues, While much of the conversation on the list today has been informative, I would ask you all to refrain from ad hominem attacks and to try to avoid a descent into flamewars. There are many mailing lists (especially anti-abuse/anti-spam) on the Internet you can post to if you want to achieve that end. This is, as we all know, an emotive issue, it is also one that, despite what people may say and think, is not being ignored by the RIPE Community nor the NCC. There is more work to be done, lots more, but there are limits to what can be done in some situations in the RIPE service region. Sending suggestions for policies, perhaps as a follow-up to sending a list of 4K IP addresses, is the best way to proceed if that is what you wish. Discuss those, go from there, contact aa-wg-chairs(a)ripe.net and we can discuss the Policy Development Process etc. But remember, policy, agreed by consensus, is the way to achieve things. As a final note, the recent policies (2010-08, 2010-09 & 2010-10) have not gone away, the task force discussed at RIPE 61 has now been formed and, at the very least, there will be progress report at the WG session in Amsterdam this May. Thanks, Brian, AA-WG Chair

1 0

Call for Agenda Items - RIPE 62
by Brian Nisbet 08 Mar '11

08 Mar '11

Colleagues, As the RIPE 62 meeting in Amsterdam is just two months away, now is a good time to solicit any items for the Anti-Abuse Working Group session at 14:00 on Thursday 5th May. If you have any items you would like to present on or discuss, please let me know. Thanks, Brian.

1 0

Working Group Co-Chairs - Final Call
by Brian Nisbet 01 Mar '11

01 Mar '11

Colleagues, As registration for RIPE 62 has now been opened, it seems like a good time to finalise the recruitment of a new co-chair for the working group. This isn't the first time this has been discussed, but I wanted to mention it one final time. There has already been some expression of interest in the job, which is great, but that's no reason not to make sure someone hasn't missed it the first two times! If you are interested in becoming co-chair of the group then please let me know (by email - aa-wg-chairs(a)ripe.net) before 16:00 UTC on Friday 4th March. The precise details of selection will depend on the number of expressions of interest. Thanks, Brian.

1 0