September 2012 - anti-abuse-wg

DNS DoS attacks by 91.235.143.158 and 69.162.110.100
by U.Mutlu 29 Sep '12

29 Sep '12

For several weeks now our DNS server gets attacked by the following 2 systems. It's a DoS attack. We have DNS recursion disabled, but these systems countlessly send recursion queries. We now are blocking them at the firewall level: pkts bytes target prot opt in out source destination 1845K 118M DROP all -- * * 91.235.143.158 0.0.0.0/0 1518K 100M DROP all -- * * 69.162.110.100 0.0.0.0/0 We have sent the first one 4 Abuse Reports, and the seconds one 10 (!) ARs, and also had email contact to both their admins/abuse team. But nothing changes. Their cheap excuse is by saying that our DNS server is allegedly an open resolver (this is total BS! it's untrue), and the attack would be a so called "reflected UDP DNS attack" carried out by someone else using forged IP headers (IMO again cheap BS excuse as nowadays every ISP uses egress/ingress filtering to block such SenderIP-forgeries). My suspicion is that these companies are maybe specialized (and get paid for) to carry out such DNS attacks to bring down the network infrastructure of target systems. It seems they try to poison our DNS cache. This of course would affect our whole infrastructure. The IPs belong to these domains/companies: 91.235.143.158 (Ukraine --> RIPE): belongs to the operators of www.irishindependentescorts.com , a porno site operated/administered by a David Walsh <david(a)irishindependentescorts.com> and davidwalsheire(a)gmail.com, AbuseAdress: support(a)v-sys.org 69.162.110.100 (US --> ARIN): www.limestonenetworks.com, an ISP, AbuseAdress: abuseteam(a)limestonenetworks.com and abuse(a)lstn.net This ISP seems to be well known for doing nothing against such attacks either carried out by its own staff or by its clients as can be seen in the postings of admins of other attacked systems: http://www.webhostingstuff.com/review/LimestoneNetworks.html http://www.webhostingtalk.com/showthread.php?t=1159070 http://www.webhostingtalk.com/showthread.php?t=1183580 Anybody else get attacked by the above systems? What else can be done in such a case? Is this a case for CERT's ? Anybody have experience with CERT's and can give tips? The attacks look like the following excerpts from the DNS log (before blocking them in the firewall): # Log evidence: # # AR BC=BC48b Logfile=/var/log/named/named_misc.log GenTime=20120925-095445 ToAbuseEMA: support(a)v-sys.org # AttackerIP=91.235.143.158 Hostname(rDNS)= IPfromHN(DNS)= # cAT=14869 cAS=7 cAR=4 CC=UA RIR=RIPE ASN=AS6849 JSC UKRTELECOM, # AttackedServerIP(s)=82.211.8.197 84.200.248.120 84.201.4.43 84.200.248.111 84.200.20.194 84.200.43.148 # LogExcerpt (timezone: UTC+02 = GMT+02, syncd via NTP): 2012-09-22 16:06:52.905 security: info: client 91.235.143.158#80: query (cache) 'isc.org/ANY/IN' denied 2012-09-22 16:06:52.934 security: info: client 91.235.143.158#80: query (cache) 'isc.org/ANY/IN' denied 2012-09-22 16:06:52.956 security: info: client 91.235.143.158#80: query (cache) 'isc.org/ANY/IN' denied 2012-09-25 09:46:08.661 security: info: client 91.235.143.158#8775: query (cache) 'google.com/A/IN' denied 2012-09-25 09:46:08.663 security: info: client 91.235.143.158#52882: query (cache) 'google.com/A/IN' denied 2012-09-25 09:46:08.754 security: info: client 91.235.143.158#31714: query (cache) 'google.com/A/IN' denied 2012-09-25 09:46:08.794 security: info: client 91.235.143.158#7089: query (cache) 'google.com/A/IN' denied 2012-09-25 09:46:08.827 security: info: client 91.235.143.158#7064: query (cache) 'google.com/A/IN' denied 2012-09-25 09:46:08.833 security: info: client 91.235.143.158#16716: query (cache) 'google.com/A/IN' denied 2012-09-25 09:46:08.868 security: info: client 91.235.143.158#80: query (cache) 'isc.org/ANY/IN' denied # Log evidence: # # AR BC=BC48b Logfile=/var/log/named/named_misc.log GenTime=20120923-022150 ToAbuseEMA: abuse(a)limestonenetworks.com # AttackerIP=69.162.110.100 Hostname(rDNS)=100-110-162-69.static.reverse.lstn.net # cAT=2324432 cAS=300 cAR=10 CC=US RIR=ARIN ASN=AS46475 Limestone Networks, Inc. # AttackedServerIP(s)=82.211.8.197 84.200.248.120 84.201.4.43 84.200.248.111 84.200.20.194 84.200.43.148 # LogExcerpt (timezone: UTC+02 = GMT+02, syncd via NTP): 2012-09-22 16:25:36.969 security: info: client 69.162.110.100#53: query (cache) 'ripe.net/ANY/IN' denied 2012-09-22 16:25:36.969 security: info: client 69.162.110.100#53: query (cache) 'ripe.net/ANY/IN' denied 2012-09-22 16:25:37.144 security: info: client 69.162.110.100#53: query (cache) 'ripe.net/ANY/IN' denied 2012-09-22 16:25:37.144 security: info: client 69.162.110.100#53: query (cache) 'ripe.net/ANY/IN' denied 2012-09-22 16:25:37.144 security: info: client 69.162.110.100#53: query (cache) 'ripe.net/ANY/IN' denied 2012-09-22 16:25:37.144 security: info: client 69.162.110.100#53: query (cache) 'ripe.net/ANY/IN' denied 2012-09-22 16:25:37.144 security: info: client 69.162.110.100#53: query (cache) 'ripe.net/ANY/IN' denied 2012-09-22 16:25:37.322 security: info: client 69.162.110.100#53: query (cache) 'ripe.net/ANY/IN' denied 2012-09-22 16:25:37.322 security: info: client 69.162.110.100#53: query (cache) 'ripe.net/ANY/IN' denied 2012-09-22 16:25:37.322 security: info: client 69.162.110.100#53: query (cache) 'ripe.net/ANY/IN' denied 2012-09-22 16:25:37.322 security: info: client 69.162.110.100#53: query (cache) 'ripe.net/ANY/IN' denied 2012-09-22 16:25:37.322 security: info: client 69.162.110.100#53: query (cache) 'ripe.net/ANY/IN' denied

2 1

CleanIT: Unanswered question from chat
by Tobias Knecht 28 Sep '12

28 Sep '12

Hi there, since we have been a bit short in time yesterday, we were not able to bring up all the questions asked in the chat. So I thought let's send them over to But Klaasen and ask for response. Questions was: (and sorry can't remember the username who asked it) "Given that some of the proposal have a clear impact on the fundamental rights of internet users and given the fact that several government institutions are involved in delivering objectives, shouldn't these proposed restrictions based on formal law? Such rules must be created in full transparency and the parliament must be able to reject proposals w/ restrictions on freedom of communications and privacy when it sees fit." Answer from But Klaasen: In the first place the clean IT project does not create formal rules. But we might come up with a call for better regulation. In that case governments will follow formal procedures and parliament is always involved. No misunderstanding about that. With regard to the best practices: any action taken to reduce the terrorist use of the internet, will respect fundamental rights and freedoms, including access to the Internet, freedoms of assembly and expression, privacy and data protection. This is clearly stated in general principle nr. 11 in our draft document (version august 14). But I am not sure that this is the real issue here. It seems like there are two questions at stake: 1. Will the best practices in the final document comply with this general principle #11? 2. Is the Clean IT group powered to judge on that? Is this the right interpretation of the question? If not, could you ask to specify the question? Anyway we will be happy to take this question into the group. Maybe we can invite the one(s) that have posed this question to participate in the discussion about this? Hope this answers is helpful. Thanks, Tobias -- AA-WG Co-Chair

1 0

2011-06 Proposal Accepted (Abuse Contact Management in the RIPE NCC Database)
by Emilio Madaio 27 Sep '12

27 Sep '12

Dear Colleagues, Consensus has been reached, and the proposal described in 2011-06 has been accepted by the RIPE community. You can find the full proposal at: https://www.ripe.net/ripe/policies/proposals/2011-06 The new RIPE document is ripe-563 and it is available at: https://www.ripe.net/ripe/docs/current-ripe-documents/ripe-563 Thank you for your input. Regards Emilio Madaio Policy Development Officer RIPE NCC

1 0

IP Block wirh no contact details
by Karl-Josef Ziegler 24 Sep '12

24 Sep '12

Hello! How is such a 'whois' handled by RIPE: inetnum: 84.22.127.40 - 84.22.127.47 address: Customer did not enter their own contact details yet see also: http://www.spamhaus.org/sbl/query/SBL99505 'Spammer & cybercriminal hosting (escalation)' http://www.spamhaus.org/sbl/query/SBL154878 'illegal pharma botnet spammer hosting' So this block seems to be used since October 2011 for cybercriminal activities and has no real contact details yet in whois database? Best regards, - Karl-Josef Ziegler

6 8

Update on the EU Clean-IT project
by Erik Bais 24 Sep '12

24 Sep '12

Hi, The EU Clean-IT project did a presentation on RIPE64. EDRI (European Digital Rights) was informed via a leaked document on the projects wishlist and planned (internal) discussion topics and current recommendations. They posted a summary on their website: http://www.edri.org/cleanIT The document itself can be found here: http://www.edri.org/files/cleanIT_sept2012.pdf If this is where the EU regulation is moving towards, under the umbrella of terrorism .... Oh boy ... Regards, Erik Bais

6 11

RIPE 65 AA-WG Agenda ver 3.0
by Brian Nisbet 17 Sep '12

17 Sep '12

An updated agenda, with one additional talk from the RIPE NCC on "Re-allocation of address blocks". The WG meeting will take place on Thursday 27th September at 14:00 CEST. It looks now like we have a fairly packed agenda with lots to discuss. A. Administrative Matters * Welcome * Scribe, Jabber, Stenography * Microphone Etiquette * Approve Minutes from RIPE 64 * Finalise agenda B. Update * B1. Recent List Discussion * B2. CleanIT Project Update * B3. RIPE NCC Data Protection Legal Advice Update * B4. "Requesting feedback about abuse-finder widget in RIPEstat" * B5. "Re-allocation of address blocks" - RIPE NCC * B6. Operation of "Copy Shops" C. Policies * RIPE Policy 2011-06 D. Interactions * D1. Working Groups * D3. RIPE NCC Gov/LEA Interactions Update X. A.O.B. Z. Agenda for RIPE 66 As always, if you have any comments or anything to add, please don't hesitate to get in contact. Regards, Brian & Tobias

1 0

Updated AA-WG RIPE 65 Agenda
by Brian Nisbet 10 Sep '12

10 Sep '12

Colleagues, An updated agenda, with one additional talk from the RIPE NCC on "Requesting feedback about abuse-finder widget in RIPEstat". The WG meeting will take place on Thursday 27th September at 14:00 CEST. A. Administrative Matters * Welcome * Scribe, Jabber, Stenography * Microphone Etiquette * Approve Minutes from RIPE 64 * Finalise agenda B. Update * B1. Recent List Discussion * B2. CleanIT Project Update * B3. RIPE NCC Data Protection Legal Advice Update * B4. "Requesting feedback about abuse-finder widget in RIPEstat" * B5. Operation of "Copy Shops" C. Policies * RIPE Policy 2011-06 D. Interactions * D1. Working Groups * D3. RIPE NCC Gov/LEA Interactions Update X. A.O.B. Z. Agenda for RIPE 66 As always, if you have any comments or anything to add, please don't hesitate to get in contact. Regards, Brian & Tobias

1 0

Re: [anti-abuse-wg] 2011-06 Last Call for Comments (Abuse Contact Management in the RIPE NCC Database)
by Erik Bais 05 Sep '12

05 Sep '12

I support the proposal. Erik Bais

1 0