August 2012 - anti-abuse-wg - mailman.ripe.net

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 12, Issue 16
by Wout de Natris 20 Aug '12

20 Aug '12

Brian, >From my side a full support for the proposal. Without any obligations the proposal may never work as foreseen. And I would like to stress that Jerry Upton wrote on behalf of M3AAWG and in function as director, so representing the M3AAWG members. Looking at who those members are, I venture to see this as a very large support on behalf of the proposal. Best, Wout > From: anti-abuse-wg-request(a)ripe.net > Subject: anti-abuse-wg Digest, Vol 12, Issue 16 > To: anti-abuse-wg(a)ripe.net > Date: Mon, 20 Aug 2012 12:00:02 +0200 > > Send anti-abuse-wg mailing list submissions to > anti-abuse-wg(a)ripe.net > > To subscribe or unsubscribe via the World Wide Web, visit > https://www.ripe.net/mailman/listinfo/anti-abuse-wg > or, via email, send a message with subject or body 'help' to > anti-abuse-wg-request(a)ripe.net > > You can reach the person managing the list at > anti-abuse-wg-owner(a)ripe.net > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of anti-abuse-wg digest..." > > > Today's Topics: > > 1. 2011-06 Move to Last Call (Abuse Contact Management in the > RIPE NCC Database) (Brian Nisbet) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 20 Aug 2012 08:55:07 +0100 > From: Brian Nisbet <brian.nisbet(a)heanet.ie> > Subject: [anti-abuse-wg] 2011-06 Move to Last Call (Abuse Contact > Management in the RIPE NCC Database) > To: anti-abuse-wg(a)ripe.net > Message-ID: <5031ED5B.6090905(a)heanet.ie> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > Colleagues, > > RIPE Proposal 2011-06 (Abuse Contact Management in the RIPE NCC > Database) has reached the end of its extended Review Phase and a > decision must now be made regarding the next steps. I (Tobias, as the > main proposer, has, as agreed & discussed stepped back from his co-chair > duties on this one) have gone through the various mails and discussions > from the the review phase, a short summary of which is below. > > I feel that the main thrust of the discussion on 2011-06 gave support to > the proposal. > > The initial discussion phase lead to a redrafting of the proposal and > some questions over the mandatory nature of the attribute and the future > of the IRTs. It was also clarified that while there may be further > output from the ACM-TF and/or further proposals in this space, 2011-06 > was considered to be standalone. > > The second version was published on 16th April 2012, addressing, I > believe, a number of points raised during the initial discussion phase. > Some objections remained, such as opinions on the mandatory nature of > the object and the lack of a wider plan. > > In May 2012 it was decided to go ahead and move the proposal to Review > Phase, during which the RIPE NCC presented their impact analysis. This > gave rise to discussion regarding the future of the IRT object. I > believe that it has been clarified that while the NCC will put plans in > place to deal with the decommissioning of the IRT object, they will, of > course, only do so if the community proposes this. They have > acknowledged that 2011-06 does not contain this proposal and so no > action regarding the IRT object will be taken on foot of this proposal. > I believe that the wider IRT community are happy with this. > > There was relatively little discussion during Review Phase, so it was > extended for a further four weeks. During this time a number of > objections were restated (mandatory nature and data protection issues) > and discussed and a few new expressions of support were made. > > Overall it appears that there are three sustained objections to the > proposal and twelve clear expressions of support. The opinion of some > members of the list (who have commented) is unclear, however I feel > there is sufficient consensus to move this proposal to Last Call. > > Emilio will made the formal announcement from the RIPE NCC PDO. > > If you disagree with this interpretation, please let me know. > > Brian > Co-Chair, Anti-Abuse WG > > > > End of anti-abuse-wg Digest, Vol 12, Issue 16 > *********************************************

4 3

2011-06 Last Call for Comments (Abuse Contact Management in the RIPE NCC Database)
by Emilio Madaio 20 Aug '12

20 Aug '12

Dear Colleagues, The proposal described in 2011-06, "Abuse Contact Management in the RIPE NCC Database", is now at its Concluding Phase. You can find the full proposal at: https://www.ripe.net/ripe/policies/proposals/2011-06 Please e-mail any final comments about this proposal to anti-abuse-wg(a)ripe.net before 17 September 2012. Regards Emilio Madaio Policy Development Officer RIPE NCC

1 0

2011-06 Move to Last Call (Abuse Contact Management in the RIPE NCC Database)
by Brian Nisbet 20 Aug '12

20 Aug '12

Colleagues, RIPE Proposal 2011-06 (Abuse Contact Management in the RIPE NCC Database) has reached the end of its extended Review Phase and a decision must now be made regarding the next steps. I (Tobias, as the main proposer, has, as agreed & discussed stepped back from his co-chair duties on this one) have gone through the various mails and discussions from the the review phase, a short summary of which is below. I feel that the main thrust of the discussion on 2011-06 gave support to the proposal. The initial discussion phase lead to a redrafting of the proposal and some questions over the mandatory nature of the attribute and the future of the IRTs. It was also clarified that while there may be further output from the ACM-TF and/or further proposals in this space, 2011-06 was considered to be standalone. The second version was published on 16th April 2012, addressing, I believe, a number of points raised during the initial discussion phase. Some objections remained, such as opinions on the mandatory nature of the object and the lack of a wider plan. In May 2012 it was decided to go ahead and move the proposal to Review Phase, during which the RIPE NCC presented their impact analysis. This gave rise to discussion regarding the future of the IRT object. I believe that it has been clarified that while the NCC will put plans in place to deal with the decommissioning of the IRT object, they will, of course, only do so if the community proposes this. They have acknowledged that 2011-06 does not contain this proposal and so no action regarding the IRT object will be taken on foot of this proposal. I believe that the wider IRT community are happy with this. There was relatively little discussion during Review Phase, so it was extended for a further four weeks. During this time a number of objections were restated (mandatory nature and data protection issues) and discussed and a few new expressions of support were made. Overall it appears that there are three sustained objections to the proposal and twelve clear expressions of support. The opinion of some members of the list (who have commented) is unclear, however I feel there is sufficient consensus to move this proposal to Last Call. Emilio will made the formal announcement from the RIPE NCC PDO. If you disagree with this interpretation, please let me know. Brian Co-Chair, Anti-Abuse WG

1 0

Re: [anti-abuse-wg] Hold time for abused address space - DNSChanger IP's reallocated
by "Michele Neylon :: Blacknight" 18 Aug '12

18 Aug '12

We've ended up with IP space that had a "reputation" in the past It's quite annoying to discover that you IP block, or a part of it, is blacklisted before you even get a chance to use it .. Though I wonder is the overall scarcity of IPv4 space going to mean that IP blocks will end up being reassigned more quickly as there's fewer and fewer .. Mr Michele Neylon Blacknight Solutions ♞ Hosting & Colocation, Brand Protection ICANN Accredited Registrar http://www.blacknight.co http://blog.blacknight.com/ http://blacknight.cat http://mneylon.tel Intl. +353 (0) 59 9183072 US: 213-233-1612 Locall: 1850 929 929 Direct Dial: +353 (0)59 9183090 Facebook: http://fb.me/blacknight Twitter: http://twitter.com/mneylon ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,Ireland Company No.: 370845

11 34

Re: [anti-abuse-wg] Hold time for abused address space - DNSChanger IP's reallocated
by Joe St Sauver 16 Aug '12

16 Aug '12

Thor commented: #Email spam is universally defined as unsolicited bulk email. It must be #extremely rare for someone to join an anti-abuse *working* group without #knowing basic concepts such as this one. Actually, the question of "what's spam?" can be surprisingly tricky when things like national and local legislation gets factored in, to the point that some organizations prefer to refer to "unwanted email" or "abusive email" instead of "spam" instead. See, for example, reports from the MAAWG Email Metrics Program, e.g., www.maawg.org/sites/maawg/files/news/MAAWG_2011_Q1Q2Q3_Metrics_Report_15.pdf which reports industry percentages for "abusive email" Regards, Joe

2 1

Hold time for abused address space - DNSChanger IP's reallocated
by Heather Schiller 15 Aug '12

15 Aug '12

Last Friday, RIPE reallocated 2 address blocks involved in DNSChanger malware - one of them is already routed. Infected users are still sending DNS queries to this address space. The new holders of this space are getting a lot of DNS queries - they are in the position to see who is infected, what they are querying for and provide any DNS response they wish to those queries. News article: http://www.cso.com.au/article/433502/new_hijack_threat_emerges_dns_changer_… RIPE's response: https://www.ripe.net/internet-coordination/news/clarification-on-reallocate… I think reallocation of this address space so quickly, is irresponsible and puts users at risk. The RIR's debogonize other address ranges and check their status before allocation. The court appointed honest DNS service was only turned down a month ago, with thousands of users still infected. While users have had plenty of opportunity to clean up their computers, many are still infected. In some cases, providers have intentionally chosen not to notify their customers. I asked on the address-policy list, how long RIPE holds back netblocks before allocation. From RIPE's response above, they hold address blocks for 6 weeks and it sounds as though they would have reallocated it while the court appointed honest DNS service was running had that 6 weeks expired before the court ordered honest service ended. Court order or not, should there be a policy/process to give guidance to RIR's on how to handle abused address space? Should address space that has been "poisoned" where it continues to get traffic from infected hosts long after the servers/malware/domains are removed be reallocated to new unsuspecting organizations? Should the space be held for some specified amount of time? Or until it drops below some threshold of traffic? Should a research or security organization be contracted to work on cleaning up the space? should the RIR do that? --Heather

1 0

Comments on Abuse Contact Management in the RIPE Database
by Jerry Upton 15 Aug '12

15 Aug '12

The Messaging, Malware and Mobile Anti-Abuse Working Group(M3AAWG) is a global nonprofit organization founded to develop effective modelsand solutions to combat online abuse such as phishing, botnets, fraud, spam,viruses and denial-of-service attacks that can cause great harm to bothindividual and national economies. M3AAWG includes technical experts,researchers and policy specialists from a broad base of Internet serviceproviders and network operators representing over one billion email accounts,and from key technology providers, academia and volume messaging senderorganizations M3AAWG supports RIPE’s proposal to introduce a new contactattribute named "abuse-c:", which can be included in inetnum,inet6num and aut-num objects(https://www.ripe.net/ripe/policies/proposals/2011-06). The investigation and prosecution of criminal activity andabuse on the Internet would be greatly facilitated by the availability of suchdata being included in WHOIS. Theproliferation of spam and the transmission of malware of all types, which arethe fundamental target of the work undertaken by M3AAWG and its members, arethe most common and serious types of privacy intrusions, occurring billions oftimes a day, worldwide. ARIN Draft Policy “Abuse Contact Management in the RIPE NCCDatabase” states “abuse-c … provides a more efficient way for maintainers toorganize their provided information and helps to increase accuracy andefficiency in routing abuse reports to the correct network contact. Inaddition, it helps all kinds of institutions to find the correct abuse contactinformation more easily.” For anti-abuse researchers, investigators and systemsoperators, WHOIS and a publicly available point of intercept identifying anabuse contact is essential and fundamental information. People who manage abuseof their networks need to easily, readily and accurately identify all entitieson a given network. Therefore,M3AAWG firmly supports the adoption of the RIPE Draft Policy “Abuse ContactManagement in the RIPE NCC Database.” Sincerely, Jerry Upton, Executive Director Messaging, Malware and Mobile Anti-Abuse Working Group(M3AAWG) jerry.upton(a)m3aawg.org http://www.m3aawg.org

1 0

Agenda Items - RIPE 65 - First Call
by Brian Nisbet 08 Aug '12

08 Aug '12

Colleagues, I do hope you're all enjoying your summer holidays, but I wanted to mention that RIPE 65 is around six weeks away (give or take) and the Anti-Abuse Working Group session has space on the agenda for any items you may will to raise at the meeting. Please contact me on or off list if you think you might like to present on (or just talk about) any items of interest to the community. Regards, Brian.

1 0

the mandatory abuse field
by Frank Gadegast 04 Aug '12

04 Aug '12

Hi all, I really have the feeling, that some in the community fear a mandatory abuse field, and try find any strange argument against it, but I really cannot see why. If somebody does not want to receive abuse reports or does not want to do something against abuse originating from his own resources or likes to receive them not via email or has whatever else reason, well, name it this-email-address-is-not-being-read(a)yourdomain.com or no-reply(a)example.com or send it to devnull ... Lots of resource holders are already doing the same, we keep a list of there email addresses, so we do not have to send them reports that will only fill our mail queue to bounce back. I can understand them and respect that others like to work things different and we do not send them reports anymore. On the other end, a mandatory abuse field will clean up everything in RIPEs database, remove the unparseble remarks, will help the abuse teams to receive reports only to ONE address, because sender can be educated, abuse tools can be simplified and integrated in webpages easily aso ... A mandatory abuse field has that much advantages for everybody who likes to work against abuse, that I cannot understand, why people, that do not want the same for there own reasons are against it. Let us optimize our procedures and if you do not want to participate, well set the email address to whatever or ignore every incoming mail ... Well, there is one reasons I can think of: Those people are not concerned, that they have to do something against abuse coming from there OWN resources, it must be the people that are causing the abuse problem in the first place, its there business, and so they are worried, that others find easier and better methods in preventing abuse. So, my personal summary is: --- Anybody, who is against a mandatory abuse field, is a professional spammer, abuser, maintains a bot net or sells open proxies or other services used for abusing others. They are criminals to my opinion. But thats only my impression ... --- Kind regards, Frank -- PHADE Software - PowerWeb http://www.powerweb.de Inh. Dipl.-Inform. Frank Gadegast mailto:frank@powerweb.de Schinkelstrasse 17 fon: +49 33200 52920 14558 Nuthetal OT Rehbruecke, Germany fax: +49 33200 52921 ======================================================================

11 41

Re: [anti-abuse-wg] the mandatory abuse field
by None 03 Aug '12

03 Aug '12

1 0