March 2012 - anti-abuse-wg - mailman.ripe.net

Enabling community self-help?
by Shane Kerr 08 Apr '12

08 Apr '12

All, warning: crazy idea time Does it seem like a good idea to provide a way to attach "user comments" to network information? Background... Some people want someone to force ISP's to take responsibility for fixing abuse originating in their networks. The natural place for this enforcement appears to them to be the RIPE NCC (*). Contrariwise, the RIPE NCC is unable to unwilling to change its role from a fundamentally administrative to one that involves setting network usage policies. This involves risks in terms of anti-trust regulators, need to carefully define the limits of control, and setting up what amounts to a industry legal system (with both judges and police). Plus it is hard to get the RIPE NCC membership to support mechanisms which cost them money and limit their freedoms. On the 3rd hand, some people in the RIPE community (including me) also feel that it is very, very difficult to define what the required actions would be in the case of reported abuse. This reporting mechanism itself might indeed be a source of abuse (rivalries between companies could be fought by each accusing the other of hosting criminal activity). Crazy Idea... Lets crowd-source it. Maybe it makes sense to make something like a web forum for each allocated resource, or perhaps for the organization responsible for each. It could be something like a blog article with the contact and other information about each resource, and then a way to post comments about it. So, you might see that ISP ShaNet has working e-mail for abuse, but nobody ever sees any action beyond automated response. Such reports could be useful for people who *can* investigate and do something, such as law enforcement or regulators. A few decades of Internet forums have given us best practices in terms of policing forums for spam and abuse, for evaluating user trustworthiness and helpfulness, and for evaluating the value of individual comments or replies (+1). I think something like this would be within the realm of things that the RIPE NCC could provide. We could link to these pages from the WHOIS results (or go straight there for web queries perhaps). There are lots of web sites which publish consumer evaluations of various companies and products, so this really is not so different. -- Shane (*) Well, normally confused with RIPE (or Ripe). But the RIPE NCC is what they mean.

10 30

Re: [anti-abuse-wg] 2011-06 New Policy Proposal (Abuse Contact Management in the RIPE NCC Database)
by Gilles Massen 29 Mar '12

29 Mar '12

Hello, This policy proposal seems a bit incomplete to, as it fails to address the problem statement from the summary. >From the summary: "...it is not clear whether to use the "abuse-mailbox:" attribute, the "remark:" attribute or an irt object.". What is supposed to happen to IRT objects, or data from them? For existing records: at the very least it should be explicit which tags should no longer be used or would be deprecated / removed in order to give clear guidance. Another point: if the general idea of the policy is acceptable, wouldn't it be nice to have 2 abuse mailboxes: one for humans, one for bots? Best, Gilles -- Fondation RESTENA - DNS-LU 6, rue Coudenhove-Kalergi L-1359 Luxembourg tel: (+352) 424409 fax: (+352) 422473

25 73

List Behaviour & Tone
by Brian Nisbet 29 Mar '12

29 Mar '12

Folks, Can I please remind you that there is no place on this list for ad hominem attacks. There has been a veering today towards very impolite behaviour and it hasn't been all that long since I'd last sent a mail about this. If you have a disagreement with someone, please express it in a polite and reasoned manner, as the vast majority of people here do. Brian.

1 0

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 7, Issue 18
by Karl-Josef Ziegler 29 Mar '12

29 Mar '12

> You seem to require something else. Maybe, some sort of 'Criminal Records Bureau check'? Best regards, - Karl-Josef Ziegler

1 0

Contact for 91.211.88.29
by Everett, Alex D 29 Mar '12

29 Mar '12

All: I joined this group as some percentage of the time (30% or so) I am unable to contact an organization to report abuse. I feel that if we see a problem, it behooves us to reach out and let others know. I know that when my organization is hosting malicious content, we want to know. What prompted me to join was this issue occurring multiple times, sending emails to abuse(a)ripe.net, and no resolution. The latest example was from March 15th, for a web server serving malware at 91.211.88.29. Does anyone have any way to contact this organization other than the email addresses below (which fail)? To: "noc(a)bigus-net.com" <noc(a)bigus-net.com> Cc: "constructelectro(a)mail.ru" <constructelectro(a)mail.ru> Subject: Abuse from 91.211.88.29 Sincerely, Alex Everett, CISSP, CCNA University of North Carolina Chapel Hill, NC, USA

4 6

Re: [anti-abuse-wg] National PSDN "UZPAK"
by Joe St Sauver 29 Mar '12

29 Mar '12

Fearghas commented: #You miss the point - there are many different kinds of commercial organisation #structures that are not Limited/PLC/Limited by Guarantee companies that can #hold LIR assets and be members. Why should I be a Limited/PLC/Limited by #Guarantee company just to hold LIR membership or an ASN/PA/PI/etc space ? There is precedent for the legal organization of an entity to be scrutinized as part of the process of trusting that entity. One example that comes to mind is the vetting that takes place for Extended Validation SSL certificates under norms established by the Certificate and Browser Forum, see: http://www.cabforum.org/vetting.html Or consider requests for proposal that may require prequalification of potential bidders as responsible bidders able to actually undertake and complete the work that's being bid -- again, that sort of vetting is often far easier for a corporation than for a sole proprietorship or a partnership, etc. Public corporations have important properties that typically include transparency, verifiability, and accountability, although obviously we can all find counter examples from recent practice in any given economy :-; Regards, Joe

2 1

Re: [anti-abuse-wg] Enabling community self-help?
by Joe St Sauver 29 Mar '12

29 Mar '12

Suresh commented: #Eh. The term itself originated because capone set up a chain of laundries #which earned him lots of profits, to account for all the money he was #raking in from bootleg booze If folks want to understand the topic of modern money laundering, by far the best publicly available treatment of this topic that I've seen is the 2005 US Money Laundering Threat Assessment, 81 pages, available online at http://www.treasury.gov/resource-center/terrorist-illicit-finance/Documents… Regards, Joe

1 0

Enough is enoug
by info＠dhn.li 29 Mar '12

29 Mar '12

Dear sirs, i need help on people that every day try to hack our server for example this is just for to days log from fail2ban i made maximum try count 4 and 600 sec. than thay try later 600 sec again non stop please take control who they are and why they try endles, least 6 months our server IP 85.10.198.87 2012-03-08 11:40:24,591 fail2ban.actions: WARNING [ssh] Ban 61.188.179.27 2012-03-08 11:50:25,251 fail2ban.actions: WARNING [ssh] Unban 61.188.179.27 2012-03-08 12:24:17,438 fail2ban.actions: WARNING [ssh] Ban 175.45.42.26 2012-03-08 12:34:18,155 fail2ban.actions: WARNING [ssh] Unban 175.45.42.26 2012-03-08 16:05:56,897 fail2ban.actions: WARNING [ssh] Ban 80.13.90.126 2012-03-08 16:15:56,881 fail2ban.actions: WARNING [ssh] Unban 80.13.90.126 2012-03-08 16:18:51,182 fail2ban.actions: WARNING [ssh] Ban 80.13.90.126 2012-03-08 16:28:51,845 fail2ban.actions: WARNING [ssh] Unban 80.13.90.126 2012-03-08 16:31:53,052 fail2ban.actions: WARNING [ssh] Ban 80.13.90.126 2012-03-08 16:41:53,736 fail2ban.actions: WARNING [ssh] Unban 80.13.90.126 2012-03-08 16:44:58,987 fail2ban.actions: WARNING [ssh] Ban 80.13.90.126 2012-03-08 16:48:46,242 fail2ban.actions: WARNING [ssh] Ban 123.200.5.67 2012-03-08 16:54:59,662 fail2ban.actions: WARNING [ssh] Unban 80.13.90.126 2012-03-08 16:58:46,919 fail2ban.actions: WARNING [ssh] Unban 123.200.5.67 2012-03-08 17:07:23,488 fail2ban.actions: WARNING [ssh] Ban 80.13.90.126 2012-03-08 17:17:24,140 fail2ban.actions: WARNING [ssh] Unban 80.13.90.126 2012-03-08 17:19:59,319 fail2ban.actions: WARNING [ssh] Ban 80.13.90.126 2012-03-08 17:29:59,976 fail2ban.actions: WARNING [ssh] Unban 80.13.90.126 2012-03-08 17:36:36,416 fail2ban.actions: WARNING [ssh] Ban 80.13.90.126 2012-03-08 17:44:06,913 fail2ban.actions: WARNING [ssh] Ban 108.15.99.40 2012-03-08 17:46:37,111 fail2ban.actions: WARNING [ssh] Unban 80.13.90.126 2012-03-08 17:54:07,614 fail2ban.actions: WARNING [ssh] Unban 108.15.99.40 2012-03-08 18:14:54,932 fail2ban.actions: WARNING [ssh] Ban 80.13.90.126 2012-03-08 18:24:55,634 fail2ban.actions: WARNING [ssh] Unban 80.13.90.126 2012-03-08 18:32:08,092 fail2ban.actions: WARNING [ssh] Ban 175.45.42.26 2012-03-08 18:41:24,809 fail2ban.actions: WARNING [ssh] Ban 80.13.90.126 2012-03-08 18:42:08,870 fail2ban.actions: WARNING [ssh] Unban 175.45.42.26 2012-03-08 18:51:25,466 fail2ban.actions: WARNING [ssh] Unban 80.13.90.126 2012-03-08 22:45:58,511 fail2ban.actions: WARNING [ssh] Ban 113.108.103.11 2012-03-08 22:55:59,386 fail2ban.actions: WARNING [ssh] Unban 113.108.103.11 2012-03-09 01:03:14,565 fail2ban.actions: WARNING [ssh] Ban 175.45.42.26 2012-03-09 01:13:15,311 fail2ban.actions: WARNING [ssh] Unban 175.45.42.26

10 19

weird ERX networks ?
by Frank Gadegast 26 Mar '12

26 Mar '12

Hi, we receive Spam from some networks we cannot find any whois record for. An example: 62.61.196.0 (we found about 1000 networks like this) ARINs whois says, its RIPE RIPEs whois says, its AFRINIC LACNIC also says, its AFRINIC but AFRINICs whois says, its "world-wide" ... So, where is this really allocated too and where can we we find a whois record for those networks ? Unallocated, but still in use from somebody ? Anybody an idea ? Here are the whois records: ARIN: NetRange: 62.0.0.0 - 62.255.255.255 CIDR: 62.0.0.0/8 OriginAS: NetName: RIPE-C3 NetHandle: NET-62-0-0-0-1 RIPE: inetnum: 62.61.192.0 - 62.61.255.255 org: ORG-AFNC1-RIPE netname: AFRINIC-NET-TRANSFERRED-20050223 descr: This network has been transferred to AFRINIC remarks: These IP addresses are assigned in the AFRINIC region. AFRINIC: inetnum: 0.0.0.0 - 255.255.255.255 netname: IANA-BLK descr: The whole IPv4 address space country: EU # Country is really world wide org: ORG-IANA1-AFRINIC Kind regards, Frank -- MOTD: "have you enabled SSL on a website or mailbox today ?" -- PHADE Software - PowerWeb http://www.powerweb.de Inh. Dipl.-Inform. Frank Gadegast mailto:frank@powerweb.de Schinkelstrasse 17 fon: +49 33200 52920 14558 Nuthetal OT Rehbruecke, Germany fax: +49 33200 52921 ======================================================================

6 7

Draft Agenda: RIPE 64 AA-WG Meeting
by Brian Nisbet 20 Mar '12

20 Mar '12

Colleagues, This is the first draft agenda for the AA-WG meeting at RIPE 64. The meeting will take place at 11:00 CEST on Thursday 19th April. There is still some room on the agenda if anyone would like to bring any items to the attention of the WG. Please let me know if this is the case - aa-wg-chairs(a)ripe.net A. Administrative Matters * Welcome * Scribe, Jabber, Stenography * Microphone Etiquette * Approve Minutes from RIPE 63 * Finalise agenda B. Update * B1. Recent List Discussion * B2. CleanIT Project C. Policies * RIPE Policy 2011-06 D. Interactions * D1. Working Groups * D3. RIPE NCC Gov/LEA Interactions Update X. A.O.B. Z. Agenda for RIPE 65

2 1