August 2016 - anti-abuse-wg - mailman.ripe.net

Re: [anti-abuse-wg] Definition of Abuse - preamble
by Marilson 27 Aug '16

27 Aug '16

On Aug 27, 2016 09:42 AM Andre wrote: > Just stealing a pc - Is called theft... > I hope this helps you understand? > If not, maybe you can provide a lot more specifics of how stealing a pc is Internet Abuse? Of course I do. In my explanatory statement I explained how stealing a pc is Internet Abuse. I wrote: >> If someone had their home PC infected or abused, it's because someone... If a computer was infected for sending spam or malicious files, it was stolen. After all we are talking about Internet, right? Are you talking about what? Home invasion? Theft of objects? I hope this help you understand. And Gunther was also right when he cited the problem of non-native language. If you want punch knife tip, be my guest. Marilson From: ox Sent: Saturday, August 27, 2016 9:42 AM To: Marilson Cc: gnitzsche(a)netcologne.de ; anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] Definition of Abuse - preamble On Sat, 27 Aug 2016 09:20:21 -0300 "Marilson" <marilson.mapa(a)gmail.com> wrote: > Hi Andre, > I have a real world example of Internet abuse: > When people whose pc's has been stolen or abused in their homes. > Not Internet Abuse. Someone still has to "use" that PC and do something with it - to something else... Just stealing a pc - Is called theft... I hope this helps you understand? If not, maybe you can provide a lot more specifics of how stealing a pc is Internet Abuse? Thank you so much! Andre

2 2

Re: [anti-abuse-wg] Brian Krebs posts stophaus chat logs of Spamhaus ddos coordination
by Suresh Ramasubramanian 27 Aug '16

27 Aug '16

You might find "I know it when I see it" as reasonable a definition as this group is ever going to arrive at --srs > On 27-Aug-2016, at 6:17 PM, ox <andre(a)ox.co.za> wrote: > > On Sat, 27 Aug 2016 18:04:53 +0530 > Suresh Ramasubramanian <ops.lists(a)gmail.com> wrote: > >> The one takeaway i get from this seems to be that the bad guys are >> perfectly aware of just where they can find loose or poorly >> implemented security and abuse policies - who is incompetent, who is >> malicious, who to abuse, who not to abuse >> >> And action if any gets taken only after significant pressure is >> applied. >> > true... as per the convo - easy to find a .ru upstream, etc. > > But, it is becoming more obvious that before we can deal with anything > properly anyway, we need to be able to properly define what it is. > > How can anyone expect anyone to implement proper abuse policies if > open society cannot even agree, openly, about what internet abuse even is? > > Andre >

2 1

Re: [anti-abuse-wg] Brian Krebs posts stophaus chat logs of Spamhaus ddos coordination
by Suresh Ramasubramanian 27 Aug '16

27 Aug '16

The one takeaway i get from this seems to be that the bad guys are perfectly aware of just where they can find loose or poorly implemented security and abuse policies - who is incompetent, who is malicious, who to abuse, who not to abuse And action if any gets taken only after significant pressure is applied. --srs > On 27-Aug-2016, at 2:39 PM, ox <andre(a)ox.co.za> wrote: > > On Sat, 27 Aug 2016 14:05:38 +0530 > Suresh Ramasubramanian <ops.lists(a)gmail.com> wrote: > >> Curious - what factors would these be that you identified? >> > But, at least two or more of the five factors are so very clear? > > imho the most obvious is: > Effectively managing abuse depends on the interaction and relationship > between two main and different techs of the Internet > > Those engineers that route and those that are system engineers > > The second most obvious thing, in my opinion, may be that if you ask > ten of either of these what constitutes Internet abuse, you will > receive at least two and as much as five (or more), different answers. > > and then there are so many other factors, what do you think the factors > are? > > > Andre > >> >>> On 27-Aug-2016, at 2:00 PM, ox <andre(a)ox.co.za> wrote: >>> >>> On Sat, 27 Aug 2016 13:41:28 +0530 >>> Suresh Ramasubramanian <ops.lists(a)gmail.com> wrote: >>>> Worth a read >>>> http://krebsonsecurity.com/2016/08/inside-the-attack-that-almost-broke-the-… >>>> >>> Yes, the actual logs that Brian Krebs publishes, of the >>> conversations, underlines and serves as clear proof of those >>> factors which serves to obtuse anti abuse efforts. >>> >>> Until this is resolved, Internet abuse will continue to be >>> difficult to manage. This makes it difficult for anyone one the >>> Internet, including the Cyber Criminals themselves, to deal with >>> Internet abuse effectively anyway. >>> >>> 2c >>> >>> Andre >>> >>> > >

2 1

Re: [anti-abuse-wg] Definition of Abuse - preamble
by Marilson 27 Aug '16

27 Aug '16

Hi Andre, I wrote that the group was one step closer to doing what Friedrich Nietzsche did in the century XIX discussing On the Genealogy of Morality... my mistake. With my professional and cultural background, I tend to believe that in communities like this, the objectives may be altruistic. But reading this discussion get the impression of not declarable goals. Excuse me if I'm wrong. On 25 Aug 2016 05:40 PM, Gunther wrote to Andre: > My intent is to have a most broad definition of abuse as possible. > You seem to intentionally want to restrict this definition. I just don't know why. I do not know why too. >> It is the RIPE Anti Abuse WG --- We discuss network abuse.... (Andre) > Well, I do not see very much discussing here - just a very "blocking" attitude. (Gunther) I agree with “just a very blocking attitude”. On 25 Aug 2016 06:14 PM, Andre wrote: > So, if you could please just provide a real world example of Internet abuse where there is a single resource, that would be very helpful. I have a real world example of Internet abuse: When people whose pc's has been stolen or abused in their homes. Exactly the example you used to explain what is not internet abuse. If someone had their home PC infected or abused, it's because someone used the means and tools provided by RIRs, Registrars and ISPs. And the ISP, owner of this domain, has to take the measures stated in the contract and AUP. And for both, identifying who committed the offense must be available on the Whois for the owner of the invaded PC. Otherwise it will not be abuse, will be crime - conspiracy. So, Andre, do not complicate. It's all so obvious... All abuse committed via the Internet is Internet abuse and abuse occurs when you do not respect the rights of someone, company or institution. And no matter in what hole of the world is the victim. Thank you Marilson

2 1

Re: [anti-abuse-wg] Brian Krebs posts stophaus chat logs of Spamhaus ddos coordination
by Suresh Ramasubramanian 27 Aug '16

27 Aug '16

Curious - what factors would these be that you identified? --srs > On 27-Aug-2016, at 2:00 PM, ox <andre(a)ox.co.za> wrote: > > On Sat, 27 Aug 2016 13:41:28 +0530 > Suresh Ramasubramanian <ops.lists(a)gmail.com> wrote: >> Worth a read >> http://krebsonsecurity.com/2016/08/inside-the-attack-that-almost-broke-the-… >> > Yes, the actual logs that Brian Krebs publishes, of the conversations, > underlines and serves as clear proof of those factors which serves to > obtuse anti abuse efforts. > > Until this is resolved, Internet abuse will continue to be difficult to > manage. This makes it difficult for anyone one the Internet, > including the Cyber Criminals themselves, to deal with Internet abuse > effectively anyway. > > 2c > > Andre > >

2 1

Brian Krebs posts stophaus chat logs of Spamhaus ddos coordination
by Suresh Ramasubramanian 27 Aug '16

27 Aug '16

Worth a read http://krebsonsecurity.com/2016/08/inside-the-attack-that-almost-broke-the-… --srs

2 1

Re: [anti-abuse-wg] Definition of Abuse - preamble
by Gunther Nitzsche 25 Aug '16

25 Aug '16

On 08/25/2016 04:38 PM, ox wrote: > ... > I did not reply to this, as it will involve me being somewhat direct but, > > I have a serious problem with people when they disagree just to argue > or for no real reason. Hmm.. I still do not see any arguments against my abuse definitions except: no, I want mine. You are getting somewhat emotional here - no good. > > This means that they have a different intent - or agenda - or something > and it serves only to disrupt > My intent is to have a most broad definition of abuse as possible. You seem to intentionally want to restrict this definition. I just don't know why. But if other members of this list tend more to your definition, it will be fine for me. >>>> I even doubt that the anti-abuse-working-group is limited to >>>> network based abuse. Entering wrong registration data (let's say by >>>> FAX) could also be covered by this group though it is not a network >>>> based abuse. >>>> > This is not an abuse group for battered men or battered women or abused > animals. What are you talking about? Yes, this group is not about animals, I agree .. but what the heck..? > > It is a network abuse group. > > No, it is not an abuse group for people whose pc's has been stolen or > abused in their homes. > > No, it is not an abuse group for old fax machines or faxing of fake > documents to anyone or even for that matter faxing of documents to > commit fraud. Says who? You are, as I do, a member of this mailing list and therefore a standard member of the anti-abuse-working-group. As far as I know you are no chair nor co-chair of this group and you are not in the position to define what to discuss in this group or not. (neither am I) I don't care if abuse is commited by old or new fax machines; if it somehow involves our/any abuse-department I do care. And if I (or i.e. legal authorities) cannot identify a fraudster because of a fake registration (DNS, IP-Allocation, whatsoever..) than I do see a direct relation to this group, regardless of the used technique. So yes, it *might* be the case that a fax triggers an abuse case. I don't want to talk about fax machines all the time - I just want a definition of abuse and of the goals of this group which *allows* me and others to discuss abuse incidents regardless of the terms "internet abuse" or "a second resource". I don't think, that this wish is that abstruse.. >It is the RIPE Anti Abuse WG --- We discuss network abuse.... Well, I do not see very much discussing here - just a very "blocking" attitude. tl;dr: I prefer a very broad definition of abuse not restricted to "internet abuse" best greetings, Gunther NetCologne Systemadministration -- NetCologne Gesellschaft für Telekommunikation mbH Am Coloneum 9 ; 50829 Köln Geschäftsführer: Timo von Lepel, Mario Wilhelm Vorsitzender des Aufsichtsrates: Dr. Andreas Cerbe HRB 25580, AG Köln

2 1

Re: [anti-abuse-wg] Definition of Abuse - preamble
by Gunther Nitzsche 25 Aug '16

25 Aug '16

On 08/25/2016 03:36 PM, ox wrote: > On Thu, 25 Aug 2016 15:28:58 +0200 > Gunther Nitzsche <gnitzsche(a)netcologne.de> wrote: >> On 08/25/2016 02:38 PM, ox wrote: >>> Get it yet? >>> >> No. Sorry. :-( > okay, I will try to explain it better :) > > > Normal bitcoin mining abuse = You --> CPU > > Anyway, Internet abuse same principle One resource --> another resource > > Get it now? I know what you mean, but I don't follow you here. I do not want this restriction and cannot see one reason why you insist on this. >> "If you use my server to do something. " Stop. >> I do not need "another resource". I wonder what arguments >> you have against my suggestion of wording. >> >> I even doubt that the anti-abuse-working-group is limited to >> network based abuse. Entering wrong registration data (let's say by >> FAX) could also be covered by this group though it is not a network >> based abuse. >> > wrong registration data by fax - is not Internet abuse (doubtful if it > even normal or just abuse...) First: I do not know why you also insist on "internet abuse" - I did not see any mention of this restriction in the existing charter of this group Second: It might very well turn into "Internet abuse" i.e. when it comes to find out sources of (other) abuse related actions. If the whois-record is wrong, one could identify this registration fake as abuse. (the severity might vary) So it might be a good idea to have this issue on topic right from the beginning. In your definition a registration fake is no abuse because only one resource is involved *and* because it did not happen via the internet; in my definition it is and it belongs to the topics of this group. We can setup a doodle for this :) As long as we don't hear other opinions on this I step back again .. best greetings, Gunther >> No artificial restrictions please; they might hurt us later on. >> >> NetCologne Systemadministration -- NetCologne Gesellschaft für Telekommunikation mbH Am Coloneum 9 ; 50829 Köln Geschäftsführer: Timo von Lepel, Mario Wilhelm Vorsitzender des Aufsichtsrates: Dr. Andreas Cerbe HRB 25580, AG Köln

2 1

Re: [anti-abuse-wg] Definition of Abuse - preamble
by Gunther Nitzsche 25 Aug '16

25 Aug '16

On 08/25/2016 02:38 PM, ox wrote: > Hello Gunther, > > Okay, I have read through your reply and it seems you do not understand > that a single resource is not a network. > > Internet Abuse - Needs two resources - otherwise it is not a network > and by default - not Internet Abuse. > > If you are on my server: > unauthorized - is abuse > authorized - is not abuse > > If you use my server to do something to another resource... > > Get it yet? > No. Sorry. :-( "If you use my server to do something. " Stop. I do not need "another resource". I wonder what arguments you have against my suggestion of wording. I even doubt that the anti-abuse-working-group is limited to network based abuse. Entering wrong registration data (let's say by FAX) could also be covered by this group though it is not a network based abuse. No artificial restrictions please; they might hurt us later on. best greetings, Gunther NetCologne Systemadministration -- NetCologne Gesellschaft für Telekommunikation mbH Am Coloneum 9 ; 50829 Köln Geschäftsführer: Timo von Lepel, Mario Wilhelm Vorsitzender des Aufsichtsrates: Dr. Andreas Cerbe HRB 25580, AG Köln

2 1

Re: [anti-abuse-wg] Definition of Abuse - preamble
by Gunther Nitzsche 25 Aug '16

25 Aug '16

On 08/24/2016 12:21 PM, ox wrote: > yes at least 2 different resources always has to be involved for it to > be Internet Abuse Thanks for pointing this out, but I don't get it .. why do you want ro restrict the definition in this way? There might be the case that next year someone brings up a topic of abuse not covered by this restriction and people involved start to argue. I prefer to be as general as possible when defining such a word. ... > if you use the same resource it is not Internet Abuse - as in your own > example using someone's CPU to mine bitcoin and doing so on the CPU > directly, is not Internet Abuse (it is very abusive, though!) Of course it is - I remotely (via the internet) control your server, doing abusive things. If someone would complain at abuse@ about such an incident I would expect the source provider to act accordingly. The remote control can be a security breach, but that is not the point. > if you have broken in/compromised security etc - it is Internet abuse, > in terms of the current definition In the example of directly using my > email server to send spam it falls within the definition of Internet > abuse as defined above :) I do not see the second resource involved in this case. So therefore I would like to change the sentence to: "The infringement of usage rights by the non sanctioned use of resources" along with your additional definitions.. (This includes >=1 resources..) (Someone might correct my english) (instead of: "The non sanctioned use of a resource to infringe upon the usage rights of another resource" ") and btw .. I would also like to see Ronald's valid questions answered. If there are no actions, sanctions whatsoever following the definition of abuse and the ongoing discussions here than this Group has officially turned into a Debate Club of old nerds (including me:), beeing probably kind of ... how do I say...inefficient? (at least as a RIPE working group) ...But.. On the other hand: https://www.ripe.net/support/abuse : "The RIPE community has an Anti-Abuse Working Group <https://www.ripe.net/ripe/groups/wg/anti-abuse> that discusses topics relating to Internet abuse and ways to prevent it. If you are interested in abuse topics, you may want to join the Anti-Abuse Working Group Mailing List <http://www.ripe.net/mailman/listinfo/anti-abuse-wg/>." and: https://www.ripe.net/participate/ripe/wg/anti-abuse : (as Brian said in 2013: "The main text of that page is the WG Charter. It may be useful to be more explicit on this, but that is the charter. " "...The working group considers both technical and non-technical aspects of abuse, with the following goals: * Produce and continue to update a BCP (Best Common Practice) document for ISPs similar in nature to RIPE-409 <https://www.ripe.net/publications/docs/ripe-409> but covering a wider range of possible abusive behaviours. * Provide advice (beyond that of the BCP) to relevant parties within the RIPE region such as ISPs, governments and law enforcement agencies on strategic and operational matters. * Discuss and disseminate information on technical and non-technical methods of preventing or reducing network abuse." That could mean we should just focus on the configuration of spamassassin and force the use of dmarc and x-arf and talk about "to block or not to block a failed DKIM E-Mail" like other anti-abuse groups do instead of e.g. trying to force RIPE NCC to terminate LIR contracts based on abusive behaviour. (no irony) So instead of searching a definition of abuse (which will be really helpful I believe) we also could start to (re-)define the goals of this group. If there would be consensus that it is not the task of this group to discuss also anti-abuse behaviour of RIPE/RIPE NCC or how to treat LIRs, then we can happily focus on other things. (In that case: sorry Ronald..) But that would not be my opinion.. >Andre (searching for cover:) best greetings, Gunther NetCologne Systemadministration -- (The opinions expressed here represent my own and not those of my employer.) NetCologne Gesellschaft für Telekommunikation mbH Am Coloneum 9 ; 50829 Köln Geschäftsführer: Timo von Lepel, Mario Wilhelm Vorsitzender des Aufsichtsrates: Dr. Andreas Cerbe HRB 25580, AG Köln

3 3