August 2011 - anti-abuse-wg - mailman.ripe.net

regarding very persistent spammy isps on ripe
by Vijay Eranti (✌ విజయ్ ఈరంటి) 31 Aug '11

31 Aug '11

hi ripe folks, I work on spam filter and we notice very gross abuse of very large internet ranges by blatant spammers posing as ISPs - all of which are allocated by ripe. I totally understand that ripe is not to deal with the spam but it will be totally unjust to say they will allocate a /13 to a spammer and have spammer wreak havoc or do what ever crap he wants to do. I posted a couple of messages to ripe and all I get is the same routine message saying they wont police this. But, why are they giving the address ranges of such huge magnitude to criminals if they cannot police it ? It will be a great disservice if this continues to happen. We always notice the spammer is always from same place or address We already blocked a bunch of /13s allocated by ripe to spammers and at some point may have to block even wider range since all we see from every ip in that range is spam or phishing or no activity. Always, the whois refers to a guy with address in sector 3, bucharest, romania. I know ipv4 addresses are running out but even ipv6 will run out if we do same thing like allocating like crazy very large netblock ranges to spammers. Can ripe do anything here or of any help here other than just saying they just give away ip addresses ranges to ISPs (which inturn some are criminals) but do not police ? The thing that changes is the name of the person - either berar george or somethign else etc.,. for instance today the spammer is using range : vijaye@veranti:~$ whois 193.254.53.34 % This is the RIPE Database query service. % The objects are in RPSL format. % % The RIPE Database is subject to Terms and Conditions. % See http://www.ripe.net/db/support/db-terms-conditions.pdf % Note: this output has been filtered. % To receive output for a database update, use the "-B" flag. % Information related to '193.254.48.0 - 193.254.63.255' inetnum: 193.254.48.0 - 193.254.63.255 netname: COMTEL-SUPERNET descr: COMTEL Supernet srl descr: COMTEL dedicated customers country: RO tech-c: GDG620-RIPE admin-c: GDG620-RIPE admin-c: CT19-RIPE tech-c: CT19-RIPE status: ASSIGNED PA mnt-by: COMTEL-MNT source: RIPE # Filtered person: Corneliu Tanasa address: COMTEL TELECOM NETWORK SRL address: 18 Decebal Blvd., Sector 3 address: Bucharest, ROMANIA phone: +40-21-3229390 fax-no: +40-21-3229391 e-mail: ggoran(a)comtelnetworks.ro mnt-by: COMTEL-MNT nic-hdl: CT19-RIPE source: RIPE # Filtered

5 4

Call For Agenda Items
by Brian Nisbet 29 Aug '11

29 Aug '11

Colleagues, Now that registration for RIPE63 has opened, it seems timely to make a call for further agenda items for the Anti-Abuse WG session. If you have any proposals you would like to make, or presentations you would like to give, please let Tobias or I know. Thanks, Brian. Co-Chair, RIPE AA-WG

1 0

Introduction - Eric FREYSSINET
by Eric Freyssinet 23 Aug '11

23 Aug '11

Hello ! This short message to introduce myself to the list. I have registered to follow your discussions after a presentation at Europol where Brian Nisbet made a presentation. I am Eric FREYSSINET, and I work for the gendarmerie nationale in France, which is one of our two national police forces. Currently, I am the head of our national cybercrime division. I have been working since 1998 in the field of IT investigations, first as the head of our IT forensics lab, then at our headquarters in a coordination function, and now as the head of an Internet invesitigations unit. I look forward to exchanging with the community. Best regards, -- Eric Freyssinet perso: eric.freyssinet(a)m4x.org pro: eric.freyssinet(a)gendarmerie.interieur.gouv.fr blog: http://blog.crimenumerique.fr/

2 1

Fwd: Prefix hijacking by Michael Lindsay via Internap
by Suresh Ramasubramanian 20 Aug '11

20 Aug '11

Nice little thread on nanog that is rather a propos to what we're discussing. ---------- Forwarded message ---------- From: Denis Spirin <noc(a)link-telecom.net> Date: Sun, Aug 21, 2011 at 6:35 AM Subject: Prefix hijacking by Michael Lindsay via Internap To: nanog(a)nanog.org Hello All, I was hired by the Russian ISP company to get it back to the business. Due to impact of the financial crisis, the company was almost bankrupt, but then found the investor and have a big wish to life again. When I tried to announce it's networks, upstreams rejected to accept it because of Spamhaus listings. But our employer sworn there is not and was not any spamming from the company. The Spamhaus lists all our networks as spamming Zombies. And it IS announced and used now!!! The announce is from American based company Internap (AS12182). I wrote the abuse report them, but instead of stop unauthorized announces of our networks, I was contacted by a person named 'Michael Lindsay' - he tell me he buy our networks from some other people and demand we get back our abuse reports. Of course, we don't. After a short googling, I found this is well-known cyber crime person: http://www.spamhaus.org/rokso/listing.lasso?file=818&skip=0, and he did IP hijacking with the fake letter of authorization before: http://www.spamhaus.org/rokso/evidence.lasso?rokso_id=ROK8686 so our company is not a first victim of him. Yes, our company "help" him with the mistake of loosing old domain link-telecom.biz he was also squatted. This domain was listed as contact at RIPE Database. It is a good topic why these easy-to-forge LOAs is still in use, as RADB/RIPE DB/other routing database with the password access is a common thing. But this is not the main thing. The main thing is why Internap helps to commit a crime to the well-known felony person, and completely ignores our requests? Is there any way to push them to stop doing that immediately? If anybody can - please help... -- Suresh Ramasubramanian (ops.lists(a)gmail.com)

1 0

RIPE NCC Abuse Complaints, Audits and Reports
by Athina Fragkouli 18 Aug '11

18 Aug '11

Dear colleagues, Following discussions and comments on the mailing list, we would like to inform you about the current status of audits and handling abuse complaints, and on plans to improve the way we deal with these. Currently, abuse complaints come in via abuse(a)ripe.net. When this is a valid complaint, we investigate the matter, we contact the relevant LIR and we execute an audit on the LIR. Apart from audits initiated by complaints, we also execute audits of randomly selected LIRs as well as LIRs in whose registration records we notice inconsistencies. Here are some statistics on the number of audits and on the outcomes of those audits: - 2009: 319 audits, all LIRs were in order or complied with auditors’ instructions - 2010: 447 audits, seven PI assignments were deregistered - 2011: 234 audits, 124 are complete, two LIRs were closed as a result of the audits, two PI assignments were deregistered, 110 audits are ongoing For confidentiality reasons, the RIPE NCC does not report on individual audits, on the changes/amendments made in the audits or on the comments/communication with the LIR during the audit. Reports on audits will take place during the update from the RIPE NCC at the RIPE NCC Services Working Group at every RIPE Meeting. We acknowledge there is a lack of clarity and transparency on our abuse and complaint procedure. We are in the process of redeveloping this process to improve our services in this area. We will present the revised process during the RIPE 63 Meeting in Vienna. Because we are in the process of setting this up, we welcome your feedback and any experiences you would like to share on this mailing list. We will not comment on each and every suggestion, but we will take the feedback/comments into account in developing this new procedure. Kind regards, Athina Fragkouli RIPE NCC

10 11

Re: [anti-abuse-wg] RIPE NCC Abuse Complaints, Audits and Reports
by Athina Fragkouli 18 Aug '11

18 Aug '11

Dear all, Thank you very much for your comments. Regarding the nature of a valid complaint and the inconsistent registration: A complaint sent to the RIPE NCC is valid if it refers to a matter the RIPE NCC is responsible for. The RIPE NCC is responsible for implementing RIPE Policies and for making sure that LIRs and End Users with independent resources comply with RIPE Policies. Accordingly, a registration is inconsistent if it is not correct and updated. Regarding audits before 2009: The RIPE NCC reported on audits (including audits before 2009) at RIPE 61: http://ripe61.ripe.net/presentations/331-Update_RIPE_NCC_R61.pdf (see slide 10) Regarding the total amount of IP addresses deregistered as a result of audits: Deregistered allocations: one /21 and one /17 Deregistered PI assignments: one /22, four /23s and four /24s Kind regards, Athina Fragkouli RIPE NCC

2 1

Re: [anti-abuse-wg] Correct info in RIPE-database - YES
by Frank Gadegast 18 Aug '11

18 Aug '11

Webservice wrote: > Now to tackle this problem: > Shouldn't there be a phone-number or a hotline for BGP-issues? > Especially with big problems it's a real problem to get to the right > helpdesk/support. > I know that some endusers who receive a spam email would contact that > hotline also, however: is it possible to show that info only if a person > is logged in into the LIR-portal? Just what Im asking for years now for. More easier would be an anonymous abuse contact wich could only by emailed to from registered email addresses from other RIPE members. So: every member would simply enter too email addresses and one (or more) IPs into their basic data at the portal. - one abuse contact - one sender email address - one or more IP address of the own sending mailservers And the Mailserver at RIPE will e.g. redirected a general as1234(a)members.ripe.net to the right abuse contact of that member. And: RIPE could even monitor outbreaks to one or the other member address to get an indication if there is an eval or non-responsive member (e.g. with not working mail addresses, full mailboxes aso). RIPE NCC could also monitor if a member becomes a bit to active or tries to flood other members. Telephone numbers seem to spread, so they will not be hidden after a while, but email is cool, because the receiver could handle these emails much quicker, because they could be more sure, that its coming from qualified other members, hopefully resulting in a much quicker action. Just an example: we filed a report at the usual abuse address of a bigger server housing provider in Germany arround 3 weeks ago , that one of their servers seemed to be captured and started to guess passwords on some of our POP3 servers. Now: after 3 weeks, be received a note, that our report will now be analysed. Whats about all those spam, all those DDoS attacks, pishing sites, whatever abuse, this server was causing the last 3 weeks to others ? And: just fiddled with our firewalls and can see, that this server is still trying to attack us ! Kind regards, Frank > > > Best regards, > Pascal Nobus > -- > www.webservice.be > Amelsdorp 72, 3740 Bilzen, Belgium > Tel: +32.89257404, Fax: +32.70423475 > > > -- PHADE Software - PowerWeb http://www.powerweb.de Inh. Dipl.-Inform. Frank Gadegast mailto:frank@powerweb.de Schinkelstrasse 17 fon: +49 33200 52920 14558 Nuthetal OT Rehbruecke, Germany fax: +49 33200 52921 ====================================================================== Public PGP Key available for frank(a)powerweb.de

10 24

Correct info in RIPE-database
by Webservice 13 Aug '11

13 Aug '11

Dear members. Last weekend I stumbled on a problem: We had problems in on of our BGP-prefixes. As the RIS Dashboard showed there was an overlapping Network in the same range as our prefix. We then wanted to contact the ISP, so the route could be redrawn (or sort this issue out), however: on the RIPE database we found: - no adress - no telephone-number - a wrong emailadress There was a link to a website, but after 4 phone-calls (where 1 has moved to another location, all the others where voice-mails), we gave up! The ISP that I couldn't reach was telefonica, see it yourself at: http://www.db.ripe.net/whois?form_type=simple&full_query_string=&searchtext… Now to tackle this problem: Shouldn't there be a phone-number or a hotline for BGP-issues? Especially with big problems it's a real problem to get to the right helpdesk/support. I know that some endusers who receive a spam email would contact that hotline also, however: is it possible to show that info only if a person is logged in into the LIR-portal? Best regards, Pascal Nobus -- www.webservice.be Amelsdorp 72, 3740 Bilzen, Belgium Tel: +32.89257404, Fax: +32.70423475

10 17

Recent Discussion & RIPE NCC Issues
by Brian Nisbet 11 Aug '11

11 Aug '11

Morning, There's been some very interesting discussion on the list recently, raising all sorts of point, with the odd diversion here and there. There are a few main points I'd like to address, with updates from the RIPE NCC, with whom I had a very useful conversation this morning. RIPE NCC Audits & Reporting Currently the NCC reports on audits to the NCC Services working group and they prepare a report for the community. While this overall reporting method won't change, they have agreed to send the latest copy of the report to the AA-WG and to send a copy of future reports to the list. Education/BCP As previously mentioned, this is an action on the AA-WG Chairs and we will be reporting back to you on this in the run up to and during RIPE 63. RIPE NCC Abuse Complain Procedure Along with more information on the Audits the NCC will be mailing the list, likely before the middle of next week, on their plans for the abuse complaint procedure. They will be outlining improvements to how abuse can be reported, what those reporting incidents should expect and what will be accepted. While information will, of course, be sent to the list, there will also be a presentation on this matter at RIPE 63. All of this is part of an ongoing plan to deal with issues with inconsistencies (deliberate or accidental) in the Database. The work of the ACM-TF also touches on this. This email is not meant as a full description of the NCC and WG activities, as I said, more information will be made available next week, so I would ask you to hold any questions until then. If it is felt that there is a requirement for further changes or expansion of activities, then we get into the territory of proposals and the NCC budget and both the AA-WG chairs and the NCC will render any assistance they can to anyone who would like to examine the possibilities there. One additional point, this mailing list, and the WG as a whole, will remain open to anyone in the RIPE community. As has been mentioned, we cannot work in isolation, nor should we. As regards the bounces, I'll pass them on to the relevant folk. Thanks again for your robust participation over the last two weeks and hopefully both this email and the NCC's response next week will go a long way to answering your points. Regards, Brian.

1 0

Re: [anti-abuse-wg] Correct info in RIPE-database
by Wilfried Woeber, UniVie/ACOnet 09 Aug '11

09 Aug '11

JXXrgen Hovland wrote: > You have to send to Mr World.Antispam.Report(a)inbox.com > <mailto:World.Antispam.Report@inbox.com> Really? ;-) Sorry, too much complexity and lack of credibility - if reply destination as offered in the mail headers doesn't work, I consider the data provided, and the identity used, as fake/fraudulent and draw my local conclusions ;-) Respectfully yours, for a moment wearing my CERT Team's Membership hat, Wilfried. > At 19:11 09/08/2011 (UTC), Wilfried Woeber, UniVie/ACOnet wrote: > > I'm a tad puzzled... > > abuse(a)localhost.com wrote: > [...] > > Trying to help with geography, and due to this being OT, > trying to do an individual reply to the sender, I get: > > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > > Subject: Mail delivery failed: returning message to sender > [...] > This message was created automatically by mail delivery software. > > A message that you sent could not be delivered to one or more of its > recipients. This is a permanent error. The following address(es) failed: > > abuse(a)localhost.com > all relevant MX records point to non-existent hosts > > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > > Hm, I think I can draw some conclusions for my end? > Wilfrid. > > >

1 0