October 2016 - anti-abuse-wg - mailman.ripe.net

Educating ISPs to properly process Abuse/Spam
by Reza Farzan 09 Nov '16

09 Nov '16

2 1

Mirai Threat Summary - the IoT attacks last week - Arbor
by Nash, Steve 28 Oct '16

28 Oct '16

Arbor Networks ASERT Threat Summary Date/Time: 28102016 2100UTC Title/Number: Mirai IoT Botnet Description and DDoS Attack Mitigation Recommendations - October 2016 - v1.1. Severity: Warning Distribution: TLP WHITE (see <https://www.us-cert.gov/tlp>) Categories: Availability Authors: Roland Dobbins & Steinthor Bjarnason ---- Description: Since its inception in August of 2016, the Mirai ‘Internet-of-Things’ (IoT) botnet, comprised largely of Internet-enabled digital video recorders (DVRs), surveillance cameras, and other Internet-enabled embedded devices, has been utilized by attackers to launch multiple high-profile, high-impact DDoS attacks against various Internet properties and services. Mirai serves as the basis of an ongoing DDoS-for-hire ‘booter’/‘stresser’ service which allows attackers to launch DDoS attacks against the target(s) of their choice in exchange for monetary compensation, generally in the form of Bitcoin payments. While the original Mirai botnet is still in active use as of this writing, multiple threat actors have been observed customizing and improving the attack capabilities of the original botnet code, and additional Mirai-based DDoS botnets have been observed in the wild. The original Mirai botnet (henceforth referred to as ‘the Mirai botnet’, or ‘Mirai’, unless otherwise indicated) currently consists of a floating population of approximately 500,000 compromised IoT devices worldwide; relatively high concentrations of Mirai nodes have been observed in China, Hong Kong, Macau, Vietnam, Taiwan, South Korea, Thailand, Indonesia, Brazil, and Spain. Additional Mirai concentrations have been also been observed in multiple countries located in North America, Europe, and Oceania. Mirai is capable of launching multiple types of DDoS attacks, including SYN-flooding, UDP flooding, Valve Source Engine (VSE) query-flooding, GRE-flooding, ACK-flooding (including a variant intended to defeat intelligent DDoS mitigation systems, or IDMSes), pseudo-random DNS label-prepending attacks (also known as DNS ‘Water Torture’ attacks), HTTP GET attacks, HTTP POST attacks, and HTTP HEAD attacks. While none of the DDoS attack capabilities of Mirai observed to date are new or unique, it is a flexible DDoS attack generation system and can launch high-volume, non-trivial DDoS attacks when wielded by a capable attacker. Mirai features segmented command-and-control, which allows the botnet to launch simultaneous DDoS attacks against multiple, unrelated targets. Vulnerable IoT devices are subsumed into the Mirai botnet by continuous, automated scanning for and exploitation of well-known, hardcoded administrative credentials present in the relevant IoT devices. These vulnerable embedded systems are typically listening for inbound telnet access on TCP/23 and TCP/2323. Given the prevalence of continuous scanning for vulnerable nodes across the entire IPv4 Internet address space, mean time to compromise of a vulnerable IoT device is 10 minutes or less, which means that compromised devices which are switched off or simply rebooted will almost certainly be re-compromised in short order, unless proactive steps are taken to shield TCP/23 and TCP/2323 access to the devices. Once an IoT device has been subsumed into the Mirai botnet, it immediately begins scanning for other vulnerable devices to compromise. This scanning takes place against destination ports TCP/23 and TCP/2323. As noted above, multiple threat actor groups are actively working to expand and improve the DDoS attack capabilities of Mirai-variant botnets. Some alterations in the DDoS attack capabilities of at least one Mirai-derived botnet have been observed in the wild. ---- Collateral Impact: The potential collateral impact of DDoS attacks launched by the Mirai botnet can be highly significant, depending upon the target selection and efficacy of a given attack. Outbound/crossbound DDoS attacks launched by Mirai bots can cause significant network performance issues or outages for broadband access network operators. Threat actors may significantly increase the rate of scanning for vulnerable systems, which could lead to an inadvertent DDoS attack on scanned/scanning systems and networks. ---- Mitigating Factors: The DDoS attack capabilities of Mirai which have been observed to date are well-known and can be successfully mitigated by implementing industry-standard Best Current Practices (BCPs) and by utilizing intelligent DDoS mitigation systems (IDMSes) such as Arbor SP/TMS and APS to defend the targets of these attacks. It is possible (and recommended) for network operators to actively scan for both vulnerable and compromised IoT devices on their networks and the networks of their customers, and then take steps to isolate those devices, notify their legitimate owners of the problem, and urge them to take corrective action. It is possible (and recommended) for network operators to identify likely compromised IoT devices by detecting and classifying outbound/crossbound TCP/23 and/or TCP/2323 activity originating from these devices, and then take steps to isolate those devices, notify their legitimate owners of the problem, and urge them to take corrective action. In order to inhibit scanning for vulnerable IoT devices, it is possible for broadband access network operators to implement access-control lists (ACLs) at a situationally-appropriate point in the network topology to prohibit high-port TCP traffic destined for TCP/23 and TCP/2323 on their customer access networks. Such policies wold typically be implemented as ingress ACLs on the coreward interfaces of broadband customer aggregation gateways. Operators should gauge the benefits of enforcing a network access policy of this nature vs. potential negative effects, if any, and should thoroughly test any proposed anti-scanning ACLs prior to deployment. ---- Recommended Actions: All relevant network infrastructure, host/application/service, and DNS Best Current Practices (BCPs) should be implemented by network operators with public-facing network infrastructure and/or Internet properties. Network operators should export flow telemetry (e.g., NetFlow, IPFIX, s/Flow, cflowd/jflow, Netstream, et. al.) from their peering/transit/customer aggregation edges and Internet data center (IDC) distribution edges to anomaly-detection/traffic visibility systems Arbor SP, which provide the ability to detect, classify, and traceback DDoS attack traffic. Network operators should make use of DDoS mitigation mechanisms such as source-based remotely-triggered blackholes (S/RTBH), flowspec, and/or intelligent DDoS mitigation systems (IDMSes) such as Arbor TMS and APS in order to mitigate DDoS traffic sourced from Mirai-based botnets. ---- Applicable Arbor Solutions: Arbor APS, Arbor SP, Arbor TMS. ---- References: <http://dyn.com/blog/dyn-analysis-summary-of-friday-october-21-attack/> <https://www.arbornetworks.com/blog/asert/rio-olympics-take-gold-540gbsec-su…> <https://krebsonsecurity.com/2016/09/the-democratization-of-censorship/> <https://www.arbornetworks.com/network-visibility-product/arbor-networks-sp> <https://www.arbornetworks.com/ddos-protection-products/arbor-tms> <https://www.arbornetworks.com/ddos-protection-products/arbor-aps> <https://tools.ietf.org/html/rfc5635> <https://tools.ietf.org/html/rfc5575> ---- Steve Nash CEng MIET Consultant Engineer EMEA Arbor Networks: The security division of NETSCOUT +44 (0) 772 029 1359 (m) Follow Arbor on Twitter: @arbornetworks | www.arbornetworks.com

1 0

Draft Minutes - AAWG at RIPE72
by Brian Nisbet 26 Oct '16

26 Oct '16

Colleagues, I must apologise, I believed that I had sent out the minutes from the working group session at RIPE72, but (prompted by Kurtis in the NCC Services WG) I've just realised that I never did. The draft minutes are online here: https://www.ripe.net/participate/ripe/wg/anti-abuse/minutes/ripe-72-anti-ab… Please send any feedback to me about these over the next two weeks and we'll go from there. Obviously we will not be declaring these as accepted at the working group session at 12:00 CEST tomorrow. Thanks, Brian Co-Chair, RIPE AAWG -- Brian Nisbet, Network Operations Manager HEAnet Limited, Ireland's Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin 1 Registered in Ireland, no 275301 tel: +35316609040 web: http://www.heanet.ie/

1 0

Host Europe GmbH AS8972 - seems to be fully rogue
by Sergey 17 Oct '16

17 Oct '16

Hello, First of all, I'm pretty sure nobody cares. However, I believe it's my obligation (at the very least) to report on massive abuse operation which I notice. I receive tons of spam e-mails from Russian or Ukrainian spammers sent from this allegedly "one of Europe's leading hosting providers". Below are just unique spam sources for last 24 hours, but I'm receiving tens of e-mails from each of them and it lasts for a long time already: Received: from elefanters.eu (mail.elefanters.eu [85.25.155.41]) Received: from embarione.ru (mail.embarione.ru [62.75.236.150]) Received: from hebraica.eu (mail.hebraica.eu [62.75.236.204]) Received: from informazion.eu (mail.informazion.eu [188.138.127.156]) Received: from intermagic.eu (mail.intermagic.eu [62.75.236.205]) Received: from bookigemse.ru (mail.bookigemse.ru [85.25.226.162]) Received: from cooperhant.ru (mail.cooperhant.ru [62.75.236.138]) Received: from airpotes.ru (mail.airpotes.ru [62.75.236.136]) Received: from footingers.ru (mail.footingers.ru [85.25.208.94]) Received: from minderse.eu (mail.minderse.eu [85.25.226.216]) Received: from excluzivem.eu (mail.excluzivem.eu [85.25.226.204]) (Notice also that the .EU TLD seems to be another spammers' heaven.) All abuse complaints sent at abuse(a)plusserver.de are defiantly dismissed. By making this public I'd like to hear something from them. However, I have almost no doubt that this autonomous system advertising hundreds of IPv4 prefixes is 100% rogue.

3 2

Multinationals & Market Strategy for world dominance
by ox 11 Oct '16

11 Oct '16

If I look at what is coming from yahoo.com these days more than a third of what they transmit to us, is scams & phish. Another third is spam and the last third is valid (or semi valid) email. One cannot help but wonder why Yahoo is unable to stem the abuse from their servers, why Yahoo email services are constantly under attack, constantly being abused. yahoo has good filters, good software but somehow the tech used against Yahoo is powerful. In fact, after looking at the ways that Yahoo is abused, one could say that a lot of money/resources is being spent to destroy Yahoo.com email service. I wonder why? and I wonder who would pay or spend so much money to destroy an email service? Andre

1 0

AS47860 - 93.175.240.0/20 (redux)
by Ronald F. Guilmette 10 Oct '16

10 Oct '16

Online records seem to suggest that the bogus unregistered AS47860 is and always was just a property of the one and only entity that is providing it with route distribution, i.e. AS43659, D2 International Investment Ukraine, Ltd. http://1whois.ru/world/UA/%D0%9A%D0%B8%D0%B5%D0%B2/LLC%20%22Albino%22 (Note the abuse email address.) Note that AS43659, D2 International Investment Ukraine, Ltd. is itself an authorized RIPE NCC LIR: https://www.ripe.net/membership/indices/data/ua.d2investukraine.html I have already written to that organization via the following two email addresses and I have received no reply: support(a)etthua.net, d2invest(a)meta.ua Could someone who actually speaks Ukranian please email these crooks and ask them nicely to stop passing routes for unregistered IPv4 space? Regards, rfg P.S. Looking over this document: https://www.ripe.net/publications/docs/ripe-640 It appears to me to be the case that it is possible to become a full fledged dues-paying RIPE NCC LIR member while having never made any sort of pledge whatsoever to refrain from announcing routes to IP space for which the member has no clear rights, either directly, from the relevant RIR, or indirectly from that actual registrant. Is that correct? Forgive me. Even after all this time, I'm still trying to wrap my head around this charade, this farce. RIPE NCC makes, creates, and provides allocations, but then never formally asks any of its members to respect or obey any of those. Is that about the size of it?

2 1

Re: [anti-abuse-wg] AS47860 - 93.175.240.0/20 - Wiskey Tango
by Marilson 06 Oct '16

06 Oct '16

On Thu, 6 Oct 2016 Vlad wrote: > Maybe, it is necessary to ask owners AS29632 and AS43659. > Both owners have LIR'a status, and have experience with the RIPE :) Maybe, it is necessary to ask RIPE: 1- Why and how a criminal (Samuel Joel Nirushan aka J. Samuel aka Nirushan Samuel aka Irosha T. Perera aka Nirushan Samuel) ISP owner (etthua.net), where he hosts their companies (D2 International Investments or D2 Investments), although chased by police around the world, continues to use registers and domains with which practices swindle? AS47860 > AS43659 - D2 International Investment Ukraine Ltd. – wanted criminal organization – IP 94.131.14.100 – abuse(at)etthua.net Domain etthua.net without IP address 94.131.14.100 - Don't have a domain name for which to get a record – status allocated unspecified – source RIPE Abuse contact for '94.130.0.0 - 94.131.255.255' is abuse(at)etthua.net http://whois.domaintools.com/etthua.net 2- How much the Registrar would lose if it breaks up the complicity? Marilson ------------------------------------------------------------------------------- From: anti-abuse-wg-request(a)ripe.net Sent: Wednesday, October 05, 2016 10:04 PM To: anti-abuse-wg(a)ripe.net Subject: anti-abuse-wg Digest, Vol 60, Issue 6 Send anti-abuse-wg mailing list submissions to anti-abuse-wg(a)ripe.net To subscribe or unsubscribe via the World Wide Web, visit https://lists.ripe.net/mailman/listinfo/anti-abuse-wg or, via email, send a message with subject or body 'help' to anti-abuse-wg-request(a)ripe.net You can reach the person managing the list at anti-abuse-wg-owner(a)ripe.net When replying, please edit your Subject line so it is more specific than "Re: Contents of anti-abuse-wg digest..." Today's Topics: 1. AS47860 - 93.175.240.0/20 - Wiskey Tango Foxtrot (Ronald F. Guilmette) 2. Re: AS47860 - 93.175.240.0/20 - Wiskey Tango Foxtrot (Vladislav V. Prodan) 3. Re: AS47860 - 93.175.240.0/20 - Wiskey Tango Foxtrot (Reza Farzan) ---------------------------------------------------------------------- Message: 1 Date: Wed, 05 Oct 2016 17:06:08 -0700 From: "Ronald F. Guilmette" <rfg(a)tristatelogic.com> To: anti-abuse-wg(a)ripe.net Subject: [anti-abuse-wg] AS47860 - 93.175.240.0/20 - Wiskey Tango Foxtrot Message-ID: <11223.1475712368(a)segfault.tristatelogic.com> Maybe somebody here knows a guy who knows a guy who actually knows somebody who actually -is- The Internet Police. If not, then I've just wasted a bunch of electrons for nothing. ------------------------------ Message: 2 Date: Thu, 6 Oct 2016 03:32:15 +0300 From: "Vladislav V. Prodan" <admin(a)support.od.ua> To: anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] AS47860 - 93.175.240.0/20 - Wiskey Tango Foxtrot Message-ID: <CAH4R=3ksPJNYT78fD8OFDtKMNiMGp3Yxgg=UCNa7sAScA9a8BA(a)mail.gmail.com> Content-Type: text/plain; charset="utf-8" Maybe, it is necessary to ask owners AS29632 and AS43659. Both owners have LIR'a status, and have experience with the RIPE :) 2016-10-06 3:06 GMT+03:00 Ronald F. Guilmette <rfg(a)tristatelogic.com>: > > Maybe somebody here knows a guy who knows a guy who actually knows > somebody who actually -is- The Internet Police. > > If not, then I've just wasted a bunch of electrons for nothing. > > -- Vladislav V. Prodan System & Network Administrator support.od.ua

1 0

Re: [anti-abuse-wg] AS47860 - 93.175.240.0/20 - Wiskey Tango Foxtrot
by Reza Farzan 06 Oct '16

06 Oct '16

2 1

AS47860 - 93.175.240.0/20 - Wiskey Tango Foxtrot
by Ronald F. Guilmette 06 Oct '16

06 Oct '16

Maybe somebody here knows a guy who knows a guy who actually knows somebody who actually -is- The Internet Police. If not, then I've just wasted a bunch of electrons for nothing.

2 1

Re: [anti-abuse-wg] Draft Agenda - AA-WG RIPE73
by Suresh Ramasubramanian 04 Oct '16

04 Oct '16

On 04/10/16, 9:25 PM, "anti-abuse-wg on behalf of ox" <anti-abuse-wg-bounces(a)ripe.net on behalf of andre(a)ox.co.za> wrote: > Doing what you are doing. And pointing out that the AUP's you are referring > to are written by, at the least, non ethical people and at the most, dishonest > people. Ah, the legal departments of most every ISP and email provider then? In other words, colleagues of most everybody that attends a RIPE meeting, and official policy set by their employers? Interesting set of perceptions there – but not a terms of reference based on which I intend to carry on this discussion any further. --srs

2 1