June 2015 - anti-abuse-wg - mailman.ripe.net

Fwd: Hijack factory: AS201640 -- MEGA - SPRED LTD / Michael A. Persaud
by Suresh Ramasubramanian 20 Jun '16

20 Jun '16

I knew the time was, well, ripe for something like this to pop up directly after rfg started asking those questions yesterday. ---------- Forwarded message --------- From: Ronald F. Guilmette <rfg(a)tristatelogic.com> Date: Thu, 6 Nov 2014 at 03:31 Subject: Hijack factory: AS201640 -- MEGA - SPRED LTD / Michael A. Persaud To: <nanog(a)nanog.org> I already posted about this rogue AS days ago, but nothing has really changed much, since then, with respect to its hijacking of IP space. Well, at least Brian Krebs was kind anough to write about it: http://krebsonsecurity.com/2014/11/still-spamming-after-all-these-years/ (Please note that that is a convicted felon spamming from the hijacked IP space. He's not allowed to own firearms, but he _can_ apparently own a keyboard.) As of today, AS201640 is still hijacking a total of eleven routes to IP space scattered all over the world... none of which appears to belong to anybody in or near Bulgaria. In fact, it would appear that the organization that is the registrant of AS201640 currently has exactly -zero- IP addresses to call its own. Nobody in a postion to _do_ anything about this gives a darn? As of today: 36.0.56.0/21 41.92.206.0/23 41.198.80.0/20 41.198.224.0/20 61.242.128.0/19 119.227.224.0/19 123.29.96.0/19 177.22.117.0/24 177.46.48.0/22 187.189.158.0/23 202.39.112.0/20

6 8

Fwd: [aa-wg-chair] AAWG - Draft RIPE 70 minutes
by Brian Nisbet 30 Jun '15

30 Jun '15

Afternoon, Please find below the draft minutes from the AA-WG session at RIPE71. Please let me know if any corrections are required. Thanks, Brian ---- Draft Minutes: Anti-Abuse WG – RIPE 70 Date: Wednesday, 13 May 14:00 - 15:30 Location: Okura Hotel, Amsterdam WG Chairs: Brian Nisbet, Tobias Knecht Scribe: Matt Parker Chat Monitor: Mirjam Kühne A. Administrative Matters Brian opened the session and welcomed the attendees. He introduced the WG co-chair, Tobias Knecht, and thanked the support staff including the scribe, chat monitor and stenographer. Brian mentioned that the minutes of RIPE 69 were circulated and did not receive any comments so they are now deemed official. B. Update B1. AA-WG Chair Matters Tobias Knecht, WG co-chair, explained that Brian Nisbet would be stepping down as WG co-chair and that there was one new candidate for the role - Brian Nisbet. Tobias explained that there had been no feedback on the mailing list and unless there were any objections in the room Brian would be confirmed as the WG co-chair for a further three years. There were no objections and Tobias congratulated Brian on his appointment. Brian thanked the WG for it’s support and for putting in place a process for electing new co-chairs and giving other people the opportunity to get involved in the Working Group. Brian stressed that this new process only applies to the Anti-Abuse Working Group (and not all Working Groups as originally mentioned in the agreement sent to the mailing list. B2. Recent Mailing List Discussions The most recent discussion on the AA mailing list concerned abuse-c contact methods. People were asking about other solutions, for example web forms, rather than solely using email for abuse reports. Brian believed that this was sufficiently discussed on the mailing list but asked for comments from the audience. Piotr Strzyzewski, Database WG co-chair, approached the microphone and noted that he had posted an email to the Euro-IX mailing list to bring the abuse-c discussion to their attention. He also mentioned the proposed 'cleanup' of abuse contacts that is currently being discussed in BoF groups in both the anti-abuse and database working groups. Brian explained that he believed the proper place for the discussion was the Database WG and the associated mailing list but he will keep a close eye on it in relation to the activities of the Anti-Abuse WG. C. Policies Brian announced that the only policy currently involving the Anti-Abuse WG is the abuse-c cleanup that was discussed in the previous agenda item. In addition Brian spoke about a discussion earlier in the day during the Address Policy WG where the RIPE NCC has been asked about performing regular verification checks on AS Number usage. The Anti-Abuse WG had previously discussed regular verification of information and, with this in mind, Brian will keep an eye on the discussion in Address Policy. Brian’s only comment at this stage was that the proposal could potentially open the door to adding extra information to the verification email. He stressed that his comment was neither negative nor positive – simply something to be aware of. D. Interactions D1. Working Groups Brian commented that the regular interaction with the Database WG was good and should continue. D2. RIPE NCC Government/LEA Interactions Update – Marco Hogewoning, RIPE NCC The presentation is available at:  https://ripe70.ripe.net/presentations/58-MH-RIPE70-AA-LEA-update-draft-AG.p… Alexander Isavin, private person, mentioned that he had read the report on LEA requests and asked whether the presentations from the meeting with the UK national crime agency would be published. Marco replied that the RIPE NCC would publish their presentation but the UK National Crime Agency would need to give permission to also share their presentation. Alexander also raised the question of whether the training and education that the RIPE NCC is providing to LEAs could be abused. He asked how the public could control the activities of the LEAs. Brian noted that the education and training provided by the RIPE NCC only shows LEAs how to use the relevant tools to access publicly available information. Requests for private information would require the usual court orders etc. D3. AA-WG at MAAWG Brian announced that he and his co-chair, Tobias, would be attending at the Mobile Anti-Abuse Working Group in Dublin this year. Brian will be presenting about the RIPE community, the AA-WG and the RIPE NCC. E. Presentations E1. Mapping out Cyber Crime Infrastructure - A Law Enforcement Approach - Jon Flaherty, UK National Crime Agency National Cyber Crime Unit  The presentation is available at:  https://ripe70.ripe.net/presentations/56-Mapping-An-LE-Approach-RIPE-70-Fin… Jim Reid, RTFM, thanked Jon for coming and speaking to the working group and commented that it was useful for the Internet community to get an understanding of the challenges that are facing law enforcement. He also commented that the focus of the presentation was public data sources and asked what law enforcement were able to do about criminals who were anonymising their IP addresses. Jon replied that this is a challenge for law enforcement and that although they have some tools available to them there is still some work to do. Jim Reid commented that it must be problematic dealing with multiple jurisdictions when trying to tackle cyber crime. Marco Hogewoning asked if they were able to share intelligence cross-border or if they were limited to sharing only with UK ISPs. Jon replied that this was something that was still under legal consideration and is certainly of interest. Alexander Isavin, private person, asked if Jon could share the results of the research in terms of crimes prevented, criminals jailed etc. Jon replied that they would be happy to share their findings but that currently these are ongoing investigations and they are not at a stage where findings can be shared yet. Brian added that over the years the community interaction with law enforcement has gotten better and better and that he hopes this will not be the last presentation of this kind that we have at RIPE meetings. E2. DNS-Based DDoS: Fast Changing Threat - Bruce Van Nice, Nominum The presentation is available at:  https://ripe70.ripe.net/presentations/103-DNSBasedDDoSEvolvingThreatRIPEMAY… There were no questions. X. A.O.B. Piotr Strzyzewski, Database WG co-chair, raised attention to the ongoing discussion in the Database Working Group about UTF8 implementation in the RIPE Database. Brian encouraged the attendees to take a look. Rüdiger Volk, Deutsche Telekom Technik, asked whether other attendees had been spammed by one of the meeting sponsors and commented that we should not endorse this type of activity. Brian replied that he was not aware of this but would be happy to formally take it up with the relevant parties at the RIPE NCC. Blake Willis, L33 Networks, spoke about the ‘traceability’ of users and discussed challenge of dealing with differing ‘requirements’ for collecting, storing and requesting data across Europe. He would like to encourage more discussion about technologies such as IPv6 and Carrier Grade NAT as well as standardisation of logging requirements. He believes that the Anti-Abuse Working Group is a good place for this discussion. Z. Agenda for RIPE 71 Brian reminded everybody that agenda items can be submitted at any time, they do not have to wait for the final two months.

2 2

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 44, Issue 1
by Wout de Natris 08 Jun '15

08 Jun '15

Interesting. Spam over anti-abuse lsit. Recently malware over internal IGF list. What is this world coming to? Wout - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - De Natris Consult Raaphorst 33 Tel: +31 648388813 2352 KJ Leiderdorp Skype: wout.de.natris denatrisconsult(a)hotmail.nl http://www.denatrisconsult.nl Blog http://woutdenatris.wordpress.com > From: anti-abuse-wg-request(a)ripe.net > Subject: anti-abuse-wg Digest, Vol 44, Issue 1 > To: anti-abuse-wg(a)ripe.net > Date: Mon, 8 Jun 2015 12:00:01 +0200 > > Send anti-abuse-wg mailing list submissions to > anti-abuse-wg(a)ripe.net > > To subscribe or unsubscribe via the World Wide Web, visit > https://www.ripe.net/mailman/listinfo/anti-abuse-wg > or, via email, send a message with subject or body 'help' to > anti-abuse-wg-request(a)ripe.net > > You can reach the person managing the list at > anti-abuse-wg-owner(a)ripe.net > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of anti-abuse-wg digest..." > > > Today's Topics: > > 1. To anti-abuse-wg(a)ripe.net RB EyegIasses Hottest Styles from > 14.36 (jiaoshuo1443(a)163.com) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Sat, 6 Jun 2015 20:46:46 +0800 (CST) > From: jiaoshuo1443(a)163.com > To: anti-abuse-wg <anti-abuse-wg(a)ripe.net> > Subject: [anti-abuse-wg] To anti-abuse-wg(a)ripe.net RB EyegIasses > Hottest Styles from 14.36 > Message-ID: <2183da9e.1198d.14dc8e8c13a.Coremail.jiaoshuo1443(a)163.com> > Content-Type: text/plain; charset="gbk" > > Dear My friend > > R&B Eyeg1asses Hottest Styles from 14.13 > Order Discount Eyeglasses Shop Now. And Save Up to 95%! > Free Shipping On Order 50USD > www.bbbzl.top > > Have a good day > Sean >

3 2

To anti-abuse-wg@ripe.net RB EyegIasses Hottest Styles from 14.36
by jiaoshuo1443＠163.com 06 Jun '15

06 Jun '15

Dear My friend R&B Eyeg1asses Hottest Styles from 14.13 Order Discount Eyeglasses Shop Now. And Save Up to 95%! Free Shipping On Order 50USD www.bbbzl.top Have a good day Sean

1 0