June 2013 - anti-abuse-wg - mailman.ripe.net

Automatic IP -> abuse email address mapping
by Olaf van der Spek 15 Dec '13

15 Dec '13

Hi, I hope this is the right list for such a question. How does one map an IP address to an abuse email address in an automated way? I assume scripts exist, but I haven't found any. Does everyone roll their own? -- Olaf

13 38

Re: [anti-abuse-wg] New Abuse Information on RIPE NCC Website
by Michele Neylon :: Blacknight 01 Jul '13

01 Jul '13

Furio If you're going to make statements about 3rd parties you should try to restrict yourself to facts and not make broad sweeping statements. On 27 Jun 2013, at 14:13, furio ercolessi <furio+as(a)spin.it> wrote: > > > Therefore the responsibility for terminating C&C domains lies on the > registries, not on the DNS providers (that may not even exist). Not necessarily. If registries are going round the place pulling domains it causes headaches for registrars - and the registries don't have a contract / agreement with the registrant While this may be different with ccTLDs you haven't specified that you're only referring to cctlds .. And I don't see how a domain can resolve without a DNS provider - that makes zero sense. > > The .AT and .LV cases have been two rather dramatic cases where the > registries were sitting there doing nothing for a very long time, while > the word spread among criminals that they were a 'safe haven'. That's highly defamatory. I don't think the managers of either ccTLD would appreciate anyone referring to them using that tone. > Similar problems have then occurred in .PL and .RU as well. Again - broad sweeping statements. I'd take you more seriously if you referred to the current state of play and not some past issues that have been addressed > > Luckily, the times have changed and country CERTs are nowadays > much more aware of the C&C problem and of the need to take down those > domains swiftly. Irrelevant statement CERTs have little impact on registry operations when they're run by private entities > As it often happens with large organizations, > 'learning' may be very slow and may need to be stimulated by external > forces - not because of lack of capacity of the individuals working > in the organizations to understand the issue, but because of the fear > of those individuals to break a complex set of rules, and the possible > need to have those rules changed to avoid breaking them. > > I believe that all the external forces working on this problem - > Spamhaus, Cymru, Shadowserver, SURBL, GTSC, ISC, Trend Micro and > others - have played and are playing a very important role in > interacting with registries and CERTs regarding cybercrime domains, > even more so when those interactions have to be a little 'rough' > to get some traction. Nobody likes friction i think, but sometimes > it is needed to shake things and see some action. > > furio ercolessi Mr Michele Neylon Blacknight Solutions ♞ Hosting & Domains ICANN Accredited Registrar http://www.blacknight.co http://blog.blacknight.com/ Intl. +353 (0) 59 9183072 US: 213-233-1612 Locall: 1850 929 929 Direct Dial: +353 (0)59 9183090 Facebook: http://fb.me/blacknight Twitter: http://twitter.com/mneylon ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,Ireland Company No.: 370845

10 21

Re: [anti-abuse-wg] New Abuse Information on RIPE NCC Website
by Ronald F. Guilmette 01 Jul '13

01 Jul '13

Sascha Luck <lists-ripe(a)c4inet.net> wrote: >Attempts to establish the RIR as a censorship authority do >damage to the RIR and its community. You have an interestingly pervasive definition of "censorship". By your definition, anyone attempting to even disipline, after the fact, a person who had shouted "fire" in a crowded theater, in par- tcular one that had not in fact been on fire, would be guilt of unwarranted "censorship". >I do not think a RIR can survive any other way than by being a >"disinterested party" that engages in registry duties, and none other. Assuming, for the sake of argument, that I and every other member of RIPE agreed with that exact assertion, then I would be forced to ask the obvious question: What then are the goals, missions, and responsibilities of the RIPE Anti-Abuse working group?

16 67

The Rules
by Ronald F. Guilmette 30 Jun '13

30 Jun '13

I am going to try to work with Brian, off-list, to try to wordsmith and do whatever else is necessary in order to convert the informal proposals that I posted here recently into formal ones. While I am working on that however, I would very much like to ask a very simple question... What exactly are The Rules with respect to IPv4 address block allocations? What does one need to show, exactly, in order to either get or, more importantly, to keep, say, a /21 ? Assume for the sake of argument that I received a /21 from some RIPE LiR one year ago. Assume that I never put _anything_ in it. Assume that RIPE NCC "audits" me. What happens, exactly? Regards, rfg

9 24

2013-01 Discussion Period extended until 26 June 2013 (Openness about Policy Violations)
by Sascha Luck 27 Jun '13

27 Jun '13

All, please find below comments on 2013-01 v2.0. I refer to: https://www.ripe.net/ripe/policies/proposals/2013-01 > 1. Transparency on reported policy violations >The RIPE NCC accepts reports about Internet number resource >registrations such as violation of RIPE Policies and RIPE NCC >Procedures, provision of untruthful information to the RIPE NCC, >bankruptcy, liquidation or insolvency of resource holders and incorrect >contact information in the RIPE Database. >The RIPE NCC will handle all such reports and publish statistics about >such reports publicly. >The RIPE NCC will publish regularly statistics of the reports that have >been received but not yet closed. These statistics will show the number >of reports in each of the following categories: > 'new': Submitted but not being investigated yet > 'under-investigation': The RIPE NCC is investigating the report >In addition to these running totals the RIPE NCC publishes statistics >about how these reports have been closed. These statistics are divided >into the following categories: > 'closed, out-of-scope': The report is out of scope for the RIPE NCC >reporting system > 'closed, resolved-by-holder': The resource holder has resolved any >problems > 'closed, resources-returned': The report has led to resources being >returned to the RIPE NCC > 'closed, no-violation': After investigation the RIPE NCC could not >find any violation of policy The text needs to state explicitly that this reporting is anonymised, ie does not contain any information that can be used to identify either the resource or the holder. >2. Progress >The RIPE NCC will provide a way to follow the progress of the >investigation for both the person submitting a report and the >organization(s) mentioned in the report. >This information will not be published publicly. This is better than v1.0 but still leaves room for abuse, viz. there is no mechanism to ensure the information provided by the NCC is not published by the submitter. A possible solution would be to restrict submission of complaints to the LIRportal , thereby ensuring that the submitter is contractually obliged to the NCC and disclosure of this information can be appropriately sanctioned. Such sanctions would need to be enough to discourage abuse. >3. Transparency on reclaimed resources >As the 'delegated' files show the resources that the RIPE NCC has >delegated to others, so will the 'returned' files show the resources >delegated or returned to the RIPE NCC. The format of the 'returned' >files will be publicly published to facilitate automatic processing. >The reason for resources being returned can be: > 'returned': Returned by the holder > 'contact-lost': The RIPE NCC could not contact the holder > 'policy-violation': Reclaimed because of a policy violation I'd like to know more about the use-case for this, particularly under the aspect of "automated processing" On balance, this is better than the first attempt, however I still think that the rights of members are insufficiently safeguarded. Thus I remain opposed to this version too. Kind Regards, Sascha Luck

4 4

2013-01 Discussion Period extended until 26 June 2013 (Openness about Policy Violations)
by Emilio Madaio 26 Jun '13

26 Jun '13

Dear Colleagues, The text of the policy proposal 2013-01, "Openness about Policy Violations", has been revised based on the community feedback received on the mailing list. We have published the new version (version 2.0) today. As a result a new Discussion Phase is set for the proposal. The main changes in the new version are: -rewording of the second part of the Abstract -rewording of the section 1.0 -new section 2.0 and consequent renumbering of the other sections -rewording of the "Arguments opposing the proposal" in the Rationale You can find the full proposal at: https://www.ripe.net/ripe/policies/proposals/2013-01 We encourage you to review this policy proposal and send your comments to <anti-abuse-wg(a)ripe.net>. Regards, Emilio Madaio Policy Development Officer RIPE NCC

4 4

Re: [anti-abuse-wg] Who owns 24.205.98.101?
by Reza Farzan 25 Jun '13

25 Jun '13

Hello Peter, The Whois information clearly shows this IP to be part of Charter Communications network: NetRange: 24.205.76.0 - 24.205.99.255 CIDR: 24.205.96.0/22, 24.205.80.0/20, 24.205.76.0/22 OriginAS: NetName: CHAR-PAS-205-76-99 NetHandle: NET-24-205-76-0-1 Parent: NET-24-205-0-0-1 NetType: Reallocated RegDate: 2001-09-30 Updated: 2003-08-27 Ref: http://whois.arin.net/rest/net/NET-24-205-76-0-1 OrgName: Charter Communications OrgId: CC04 Address: 12405 Powerscourt Dr. City: St. Louis StateProv: MO PostalCode: 63131 Country: US RegDate: Updated: 2012-07-03 Ref: http://whois.arin.net/rest/org/CC04 OrgTechHandle: IPADD1-ARIN OrgTechName: IPAddressing OrgTechPhone: +1-314-288-3889 OrgTechEmail: ipaddressing(a)chartercom.com OrgTechRef: http://whois.arin.net/rest/poc/IPADD1-ARIN OrgAbuseHandle: ABUSE19-ARIN OrgAbuseName: Abuse OrgAbusePhone: +1-314-288-3111 OrgAbuseEmail: abuse(a)charter.net OrgAbuseRef: http://whois.arin.net/rest/poc/ABUSE19-ARIN OrgNOCHandle: NNOC16-ARIN OrgNOCName: National Network Operations Center OrgNOCPhone: +1-314-288-3111 OrgNOCEmail: dlnocip(a)chartercom.com OrgNOCRef: http://whois.arin.net/rest/poc/NNOC16-ARIN ++++ So, I do not understand why they are telling you otherwise. I have copied the responsible parties at Charter Communication so that they could investigate this matter further. Thank you, Reza Farzan ****************** -----Original Message----- >From: peter h <peter(a)hk.ipsec.se> >Sent: Jun 25, 2013 9:37 AM >To: anti-abuse-wg(a)ripe.net >Subject: Re: [anti-abuse-wg] Who owns 24.205.98.101? > >On Tuesday 25 June 2013 09.18, Olaf van der Spek wrote: >> Hi, >> >> Whois seems to say it's Charter Communications, abuse(a)charter.net. >> But if I mail them, they say: >> >> This email address is for reporting incidents of abuse coming from IP >> addresses registered to Charter Communications. Abuse from IP addresses >> not registered to Charter Communications should be directed to the >> registered owners of the IP address in question. > >If the abuse "function" don't work i suggest that blocking this range will work. > >If and when charter decides that their customers should have full access they >should start with a working abuse staff ( and some more ) >Until then, we can manage without them. > > ><snip> > # # # >> >> From: Olaf van der Spek <olafvdspek(a)gmail.com> >> To: abuse(a)charter.net >> Date: Tue, 25 Jun 2013 09:11:38 +0200 >> Subject: DDoS Attack from 24.205.98.101 >> > >-- > Peter Håkanson > > There's never money to do it right, but always money to do it > again ... and again ... and again ... and again. > ( Det är billigare att göra rätt. Det är dyrt att laga fel. ) >

1 0

Who owns 24.205.98.101?
by Olaf van der Spek 25 Jun '13

25 Jun '13

Hi, Whois seems to say it's Charter Communications, abuse(a)charter.net. But if I mail them, they say: This email address is for reporting incidents of abuse coming from IP addresses registered to Charter Communications. Abuse from IP addresses not registered to Charter Communications should be directed to the registered owners of the IP address in question. The following link should be of assistance in locating the organization responsible for the IP address: http://www.arin.net/whois Thank you, Charter High-Speed Internet Security Team # # # From: Olaf van der Spek <olafvdspek(a)gmail.com> To: abuse(a)charter.net Date: Tue, 25 Jun 2013 09:11:38 +0200 Subject: DDoS Attack from 24.205.98.101 -- Olaf

6 7

Authorities, or lack thereof
by Ronald F. Guilmette 25 Jun '13

25 Jun '13

Suresh Ramasubramanian <ops.lists(a)gmail.com> wrote: >What remains is policy proposals that are effective in getting such >allocation requests denied and/or revoked. Which seems to be more of a can >of worms here than in any other RIR. I thank my friend Suresh for bringing to my attention a really more important issue, and one that I should have really considered before I made any of my recent posts imploring all within the Working Group to work on solidifying a firmer and more complete defintion of "abuse". As the Chair has courteously pointed out to me, the charter of this Working Group, such as it is, already is fairly clear that "spam" and "spamming" are most definitely issues within the remit of this Working Group. But that begs the larger question: Assuming for the moment that there existed a case in which all or a majority of this Working Group were convinced that a given particular allocation of number resources was registered for, and was being used exclusively and com- pletely for the production and distribution of spam, then at that point would either the Working Group, or its Chair, have either the authority or the responsibility to (a) direct or (b) request or (c) suggest that RIPE NCC withdraw/cancel/retract said allocation? If neither (a) nor (b) nor even (c) applies, then regardless of the formal or working definition of "abuse", it would seem to me... in- tending no offense to any person here present... that the Working Group could not reasonably be viewed as anything other than a paper tiger, utterly devoid of teeth and/or authority, and thus of no particular value or use or significance to anyone or any thing... but I am more than willing to be convinced otherwise. Regards, rfg

4 6

Not entirely Off-Topic
by Ronald F. Guilmette 21 Jun '13

21 Jun '13

By the way, would any of you happen to know where I might be able to purchase one of these t-shirts? http://www.flickr.com/photos/philwolff/96987427/

4 3