November 2015 - anti-abuse-wg

Fwd: Hijack factory: AS201640 -- MEGA - SPRED LTD / Michael A. Persaud
by Suresh Ramasubramanian 20 Jun '16

20 Jun '16

I knew the time was, well, ripe for something like this to pop up directly after rfg started asking those questions yesterday. ---------- Forwarded message --------- From: Ronald F. Guilmette <rfg(a)tristatelogic.com> Date: Thu, 6 Nov 2014 at 03:31 Subject: Hijack factory: AS201640 -- MEGA - SPRED LTD / Michael A. Persaud To: <nanog(a)nanog.org> I already posted about this rogue AS days ago, but nothing has really changed much, since then, with respect to its hijacking of IP space. Well, at least Brian Krebs was kind anough to write about it: http://krebsonsecurity.com/2014/11/still-spamming-after-all-these-years/ (Please note that that is a convicted felon spamming from the hijacked IP space. He's not allowed to own firearms, but he _can_ apparently own a keyboard.) As of today, AS201640 is still hijacking a total of eleven routes to IP space scattered all over the world... none of which appears to belong to anybody in or near Bulgaria. In fact, it would appear that the organization that is the registrant of AS201640 currently has exactly -zero- IP addresses to call its own. Nobody in a postion to _do_ anything about this gives a darn? As of today: 36.0.56.0/21 41.92.206.0/23 41.198.80.0/20 41.198.224.0/20 61.242.128.0/19 119.227.224.0/19 123.29.96.0/19 177.22.117.0/24 177.46.48.0/22 187.189.158.0/23 202.39.112.0/20

6 8

Working Group Chair Matters
by Brian Nisbet 26 Nov '15

26 Nov '15

Colleagues, Apologies for not sending this email last week. During the working group session at RIPE71 Tobias was re-appointed as co-chair of the working group. Thanks, Brian Co-Chair, RIPE AA-WG

1 0

Sources of Abuse Contact Info For Abuse Handlers
by Brian Nisbet 26 Nov '15

26 Nov '15

Colleagues, Mirjam Kuehne, L. Aaron Kaplan and Christian Teuschel have been doing a lot of work on a document on "Sources of Abuse Contact Info For Abuse Handlers". Versions of this document have been sent to the WG over the past year. There has been a lot of input from a lot of people and organisations and we'd like to thank them all. At this point it is our intend to publish this as a BCP RIPE Document from the AA-WG. At this point we would like to invite any final comments from the WG (a last call of sorts) before it is published. Ideally these comments would be great before the WG Session at 11:00 EET on Thursday 19th November, but definitely before the end of this week. Thanks again to all involved. Brian Co-Chair, RIPE Anti-Abuse WG -- Brian Nisbet, Network Operations Manager HEAnet Limited, Ireland's Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin 1 Registered in Ireland, no 275301 tel: +35316609040 web: http://www.heanet.ie/

11 15

Spam from a C class
by turgut kalfaoğlu 22 Nov '15

22 Nov '15

Hello everyone; I just joined this group. My name is Turgut Kalfaoglu, those old enough to have seen me in EARN (now TERENA) perhaps remember me; if so, hello to you all. I have a problem on a server that I'm managing, it's getting a substantial amount of spam over many months from various IP's in the 185.111.244.0/24 range. The "abuse" email address is destek(a)oyunmerkezi.com.tr , which translates as "support(a)gamecenter.com.tr". Having a such "light" abuse email, I suspect that reporting to this "game center" will not solve the spam problem; I believe they are doing this knowingly. I emailed them to stop, and blocked the IP range on my server, but I also want these people reported as they are spamming millions, and hopefully have their IP range revoked. Is there a procedure within RIPE to apply for a such abuse? Many thanks, Turgut Kalfaoglu

2 1

New on RIPE Labs: Implementing DANE for RIPE NCC Websites
by Mirjam Kuehne 19 Nov '15

19 Nov '15

Dear colleagues, In September of this year, we activated DNS-based Authentication of Named Entities (DANE) for our main web services, including www.ripe.net, the LIR Portal and RIPE Labs. Please find more details on RIPE Labs: https://labs.ripe.net/Members/mgrigore/implementing-dane-for-ripe-ncc-websi… Kind regards, Mirjam Kuehne RIPE NCC

1 0

Reminder: Anti-Abuse WG at RIPE71 Today
by Brian Nisbet 19 Nov '15

19 Nov '15

Colleagues, A brief reminder that the Anti-Abuse WG session at RIPE 71 kicks off at 11:00 EET (GMT +2) today. If you aren't in Bucharest you can follow along live here: https://ripe71.ripe.net/live/side/ You can also join the Chat Room either via that page or via irc.ripe.net #anti-abuse Brian -- Brian Nisbet, Network Operations Manager HEAnet Limited, Ireland's Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin 1 Registered in Ireland, no 275301 tel: +35316609040 web: http://www.heanet.ie/

1 0

Solving the issue of rogue ROUTE objects in the RIPE Database
by denis 14 Nov '15

14 Nov '15

Hi All I raised an idea before the last RIPE Meeting but it did not generate a lot of interest at that time. I brought it up again yesterday on the Anti Abuse WG list and it seemed to get quite a bit of support. So I will bring it back to the DB WG as it is a DB issue. I have CC'ed both AA WG and Routing WG for information. But it may be useful to keep the discussion now on the DB WG list. I don't claim this will solve all the problems of the universe, but it does satisfy an immediate goal to have all ROUTE objects in the RIPE Database created with the knowledge and approval of the related resource holders. And I believe it could be implemented in a relatively short space of time giving immediate benefits. cheers denis STEP 1 Any ROUTE object submitted for creation in the RIPE Database involving an out of region resource (address space and/or ASN) where that out of region resource does not exist in the authoritative RIR database (has not been allocated or assigned), reject the creation. The RIPE NCC mirrors the operational data from all the other 4 RIRs. These mirrors are updated daily as well as the RIRs daily stats. It is easy to determine if a resource is registered in the authoritative database. STEP 2 For those ROUTE objects from STEP 1 where the out of region resource does exist, hold the object creation as pending. The mechanism for doing this already exists in the RIPE Database software as it is used for multiple authentications. Lookup the out of region resource(s) in the authoritative database(s) and find the contacts for that resource. Send a notification to those contacts informing them of the pending ROUTE object creation in the RIPE Database. The notification mechanism already exists in the RIPE Database software. If they don't approve, do nothing and the creation request will time out after a week and the object will not be created. If they do approve, respond in some way (many technical options for doing this that the RIPE NCC can choose from). If appropriate approval(s) are received within a week, create the ROUTE object. STEP 3 On a daily basis, for each ROUTE object in the RIPE Database that relates to an out of region resource, check for the continued existence of that resource in the appropriate RIR database. If it no longer exists, delete the ROUTE object from the RIPE Database. STEP 4 This is a one off cleanup of existing ROUTE objects. For all ROUTE objects currently in the RIPE Database that relate to an out of region, existing resource, send the appropriate notifications. For any that no response is received, delete the ROUTE object from the RIPE Database. We can be a bit more generous on the timing for this step and even send multiple reminder notifications to be sure. (Possible) STEP 5 If a delete request is sent to the RIPE Database for a ROUTE object related to out of region address space without the proper authorisation, send a notification to the contacts for the authoritative address space holder. If an appropriate response is received back, delete the ROUTE object. This would simulate the reclaim functionality for RIPE address space holders. AUT-NUM copies Another byproduct of implementing this is that we no longer need to hold copies of AUT-NUM objects in the RIPE Database. The out of region ASN auth requirement is satisfied by the appropriate response to the notification. So all 'foreign' AUT-NUM objects could be immediately deleted. (Or after allowing time for these ASN holders to make sure their routing policy is actually up to date in the authoritative AUT-NUM object.)

9 22

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 48, Issue 24
by Marilson 11 Nov '15

11 Nov '15

Hi Lu, I would like to congratulate you for your concern to meet spamcop. You are the first representative of an ISP that I see, in the last seven months, concerned about complaints that spamcop reports. Look Ronald, all is not lost! As a rule your peers have reacted to allegations of dishonest and sociopathic way. They have refused to stop spammers and scammers and have retaliated by sending spam, phishing and viruses in heaps. When I tell in heaps I am referring to tens per day absolutely equal. The record is of the Lomadee with 167 equal spams in 4 days. Pure rage. Sociopathy and greed. Mr. Neylon, do not you dare disqualify my information because I have evidence in abundance, which you guys are blocking, preventing from being shown. Every time someone denounces the ISPs you try to disqualify the complaint. The problem, my dear, is that you are trying to defend the indefensible. Even being one of the foxes caring the hen house. Lu, there is another problem regarding spamcop that you should consider. Since last month there have been failures in the companies appointed to be reported. I am no longer using companies that spamcop indicates to abuse. I do my own research. The reason is obvious. Besides the spammer be hiding there is a profusion of ISPs behind a single spam that must be confusing the spamcop search system. And that is premeditated. Contrary to Ronaldo, I am not at all concerned with identifying the spammer. The reason is simple, he is the least responsible for this naughtiness that torments the lives of billions of people. Without the complicity of ISPs and Registrars, spammers and scammers would not be noticed. And the growing number of spammers and scammers is fostered by ISPs, and I can prove that. Question by Ronald: >Please correct me if I'm wrong, but you, Mr. Neylon, *are* the head of one of the registrar companies that has a direct financial interest inthis matter, right? Is that >correct is it not? Answer by Mr. Neylon: >Blacknight is a registrar and hosting provider. Well, well, nobody needs help to known what is Blacknight... Mr. Fox if you want to stay hidden, wear feathers. Michele, you are certainly a clever and apparently competent person in your role, but my dear, do not stay trying to disqualify all complaints that are made against ISPs and Registrars because your position is uncomfortable - you are defending the indefensible. I am architect and urban planner. My job is to create the most pleasant environments to the people, where they feel good. It is extremely difficult for me to understand a profession that has made efforts to irritate and defraud people. If your hypothalamus is not producing oxytocin make a hormone replacement because without oxytocin you will be unable to empathize with people. In other words let sociopathy for companies like Volkswagen. If you do not change your attitude the next time I will ask you if you have killed, today, one refugee child or kicked one. Until Marilson

17 110

RIPE 71 Agenda - Third Draft
by Brian Nisbet 09 Nov '15

09 Nov '15

Colleagues, Here is the second draft of the RIPE 71 Anti-Abuse WG session. The session will take place at 11:00 EET (GMT +2) on Thursday 19th November. The session will be live streamed and recorded, along with live stenography. A. Administrative Matters - 5' * Welcome * Scribe, Jabber, Stenography * Microphone Etiquette * Approve Minutes from RIPE 70 * Finalise agenda B. Update - 15' * B1. Recent List Discussion * B2. AA-WG Chair Matters C. Policies - 0' D. Interactions - 20' * D1. Working Groups * D2. Update on RIPE NCC Security Outreach Activities - Mirjam Kuhne E. Presentation - 45' * E1. Open Source Abuse Management for Network Operators - Abuse.io * E2. Helping Network Operators to Bring Down DDos Sources - ANSSI X. A.O.B. Z. Agenda for RIPE 72 There is still a very small amount of room on the agenda if anyone has any subjects they wish to bring to the working group. Brian -- Brian Nisbet, Network Operations Manager HEAnet Limited, Ireland's Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin 1 Registered in Ireland, no 275301 tel: +35316609040 web: http://www.heanet.ie/

1 0

Whois database verification
by Karl-Josef Ziegler 07 Nov '15

07 Nov '15

As an argument I can't take 'it's technically/legally not possible' because it was and is done by other companies. I think the truth behind is 'we don't want it to be implemented because it lowers our profit margins'. Just my 2 cents. - Karl-Josef Ziegler

1 0