August 2016 - anti-abuse-wg - mailman.ripe.net

Re: [anti-abuse-wg] Definition of Abuse
by Ronald F. Guilmette 17 Aug '16

17 Aug '16

ox <andre(a)ox.co.za> you wrote: >Are fake whois records abuse? I think this is an excellent question and >requires discussion. > >Personally I think filing fake information to a resource is actually a >crime called fraud. I am sure that this is also a crime under Dutch law >and that the Dutch Law enforcement should investigate this? Why yes! (Now why didn't *I* think of that?) Yes, by all means, let's take a violation of contractual terms between two private parties and turn it into a law enforcement matter. And while we're at it, let's have Interpol come out to your house and cuff you for those rental DVDs you returned 2 days late. Yes, that's obviously the best choice, and the best possible use of limited law enforcement resources. And look at how well it worked out in the Aaron Swartz case! So I'm sure your're right. But you shouldn't rely on just _my_ humble opinion. Why not ask the RIPE NCC legal team how many of those 7 cases of non-financial contract breaches in 2015 and 2016 they called in law enforcement on. I'm sure they'll tell you they did so in all 7 cases... ... or maybe not. >But, imho, fake whois records and/or incorrect whois records, is not >abuse. Yes. What the hell! Let's just turn off the RIPE WHOIS server and then everything will be so much simpler and straightforward. At least then we won't have to wonder anymore. Instead we will be SURE that none of us has the least clue who is actually using which IP ranges, or who takes responsibility for any of them. A rational choice, if ever there was one. Regards, rfg

2 1

82.221.130.64/26
by Ronald F. Guilmette 17 Aug '16

17 Aug '16

Additional information about security issues relating to the 82.221.130.64/26 IP address block: https://forum.eset.com/topic/2121-what-is-this-exactly/

1 0

Re: [anti-abuse-wg] Definition of Abuse
by ox 16 Aug '16

16 Aug '16

On Tue, 16 Aug 2016 14:23:21 +0000 David Hilario <fransossen(a)hotmail.com> wrote: > Hi Andre, > Thank you so much David That is a very complete, informed and direct answer I also do not foresee anything changing anytime soon, or that there is even a need for anything to change, for that matter. We do really need a definition of "abuse" though, as some actions may, or may not be abuse and/or crimes - and when there are general discussions about "abuse" it would be good to know the definition and/or parameters. It would be within the scope of an operational abuse list, to define what abuse is. So, we are still at this last definition: "The non sanctioned use of a resource to infringe upon the usage rights of another resource" Current discussions about what needs to be added still? (add if I am missing anyone or anything please) (1) Gert Doering suggested that "there are legal reason why someone could infringe on someon else's use rights" - added the 'non sanctioned' - seems fine now, Gert? (2) unauthorized access / hacking / and/or breaking in ( Dave Crocker - abuse concerns unauthorized access ) (Andre - breaking in is crime, abuse is use something for bad purpose ) (3) causing damage to others ( Dave Crocker - "and to actions that inflict damage on others" ) ( Michele Neylon - I like the idea of “damage” or “harm” on others The “infringe on usage .. “ thing didn’t seem very clear to me and I don’t see how that would apply to spam etc) (Andre - damage is a result of an action or result of abuse? crime?) > > >Maybe you can help, David? > > > >When RIPE investigates "abuse" what are they investigating? Crimes? > >Criminal activity? Fraud? or actual abuse? > > Short version: > RIPE NCC can only investigate and take actions against resource > holders based on RIPE policy violations and contractual agreement > violations. (With the exception of legal requirements such as court > orders enforceable under dutch law, embargo that apply to Dutch based > organisation, RIPE NCC functions under Dutch law and has to comply at > that level...but those things are outside of the scope of the RIPE > policies) > > Long version: > This is the document you are looking for: > https://www.ripe.net/publications/docs/ripe-640 > > It lists the reasons for being under violations and the eventual > consequences (de-registration of resources, closure of LIR). > > Anything else is actually sort of irrelevant, unless a RIPE policy is > to be put in place against something that would be defined as > "abuse". This would be decided here within the WG and not by the RIPE > NCC. > > The RIPE NCC will then be able to enforce the policy that has been > decided here. > > I don't really foresee any of that changing anytime soon though. > But actions are taken, where actions can be taken by the RIPE NCC, > based on the current set of policies. > > Cheers, > David

1 0

Re: [anti-abuse-wg] Definition of Abuse
by David Hilario 16 Aug '16

16 Aug '16

Hi Andre, >Maybe you can help, David? > >When RIPE investigates "abuse" what are they investigating? Crimes? >Criminal activity? Fraud? or actual abuse? Short version: RIPE NCC can only investigate and take actions against resource holders based on RIPE policy violations and contractual agreement violations. (With the exception of legal requirements such as court orders enforceable under dutch law, embargo that apply to Dutch based organisation, RIPE NCC functions under Dutch law and has to comply at that level...but those things are outside of the scope of the RIPE policies) Long version: This is the document you are looking for: https://www.ripe.net/publications/docs/ripe-640 It lists the reasons for being under violations and the eventual consequences (de-registration of resources, closure of LIR). Anything else is actually sort of irrelevant, unless a RIPE policy is to be put in place against something that would be defined as "abuse". This would be decided here within the WG and not by the RIPE NCC. The RIPE NCC will then be able to enforce the policy that has been decided here. I don't really foresee any of that changing anytime soon though. But actions are taken, where actions can be taken by the RIPE NCC, based on the current set of policies. Cheers, David

1 0

Re: [anti-abuse-wg] Definition of Abuse
by Suresh Ramasubramanian 16 Aug '16

16 Aug '16

Easier to ask – why do other RIRs not have nearly the same high quantum of such issues? What do they do to prevent these, and reclaim resources allocated to bogus entities? --srs On 15/08/16, 8:56 PM, "anti-abuse-wg on behalf of ox" <anti-abuse-wg-bounces(a)ripe.net on behalf of andre(a)ox.co.za> wrote: Unauthorized access is NOT ABUSE, in terms of the current definition: "The non sanctioned use of a resource to infringe upon the usage rights of another resource" And, this is the crux of it all, this defining of "abuse" is exactly why we require a definition.

4 6

Re: [anti-abuse-wg] Definition of Abuse
by Gert Doering 16 Aug '16

16 Aug '16

Hi, On Sun, Aug 14, 2016 at 07:55:01AM +0200, andre(a)ox.co.za wrote: > Definition of Abuse as it should be defined by RIPE > --------------------------------------------------------------------- > > The use of a resource to infringe upon the usage rights of another resource I like this. I'm not sure if there are "false positives", but the general idea feels good, and thinking about it a bit, it seems to match what I consider "abuse" and does not match "non-abuse" - of course, this is now tied to what someone would consider as "infringe upon usage rights". Gert Doering -- NetMaster -- have you enabled IPv6 on something today...? SpaceNet AG Vorstand: Sebastian v. Bomhard Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279

7 8

Re: [anti-abuse-wg] Definition of Abuse
by Marilson 15 Aug '16

15 Aug '16

“Define abuse” Are you kidding? In this WG? “Complicated” Only for those who feed with the practice of abuse. “meaningless political expression” Are you with nefarious intent? (using Andre words) “it should be defined by RIPE” This just keeps getting better than stand-up comic. Until... Marilson From: anti-abuse-wg-request(a)ripe.net Sent: Monday, August 15, 2016 5:37 AM To: anti-abuse-wg(a)ripe.net Subject: anti-abuse-wg Digest, Vol 58, Issue 21 Send anti-abuse-wg mailing list submissions to anti-abuse-wg(a)ripe.net To subscribe or unsubscribe via the World Wide Web, visit https://lists.ripe.net/mailman/listinfo/anti-abuse-wg or, via email, send a message with subject or body 'help' to anti-abuse-wg-request(a)ripe.net You can reach the person managing the list at anti-abuse-wg-owner(a)ripe.net When replying, please edit your Subject line so it is more specific than "Re: Contents of anti-abuse-wg digest..." Today's Topics: 1. Re: Definition of Abuse (Gert Doering) 2. Re: Definition of Abuse (Gert Doering) 3. Re: Definition of Abuse (Sascha Luck [ml]) 4. Re: Definition of Abuse (andre(a)ox.co.za) 5. Re: Definition of Abuse (andre(a)ox.co.za) 6. Unsubscribe (Eoin C. Bair?ad) ---------------------------------------------------------------------- Message: 1 Date: Sun, 14 Aug 2016 21:15:19 +0200 From: Gert Doering <gert(a)space.net> To: andre(a)ox.co.za Cc: anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] Definition of Abuse Message-ID: <20160814191519.GM79185(a)Space.Net> Content-Type: text/plain; charset="us-ascii" Hi, On Sun, Aug 14, 2016 at 07:55:01AM +0200, andre(a)ox.co.za wrote: > Definition of Abuse as it should be defined by RIPE > --------------------------------------------------------------------- > > The use of a resource to infringe upon the usage rights of another resource I like this. I'm not sure if there are "false positives", but the general idea feels good, and thinking about it a bit, it seems to match what I consider "abuse" and does not match "non-abuse" - of course, this is now tied to what someone would consider as "infringe upon usage rights". Gert Doering -- NetMaster -- have you enabled IPv6 on something today...? SpaceNet AG Vorstand: Sebastian v. Bomhard Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279

1 0

Re: [anti-abuse-wg] Definition of Abuse
by Erik Bais 15 Aug '16

15 Aug '16

Hi Andre, > Definition of Abuse as it should be defined by RIPE > --------------------------------------------------------------------- > The use of a resource to infringe upon the usage rights of another resource The core of the problem of a good definition of abuse, is the intend of the action ... And intend is in the eye of the beholder ... I'll give an example : BGP Hijacking ... BGP Leaks ... If someone is doing a BGP Hijacks in order to knowingly divert traffic to harm others, while either the AS or the prefix is not rightfully under their control, it could be considered a Hijack. ( similar as carjacking. ) If those prefixes are used in order to : deny service to the original legitimate owner of the prefix, or an un-used prefix is abused for spewing out spam .. or to regain control of a Command and Control server/infrastructure ( Hacking Team action after Santrex was closing and they stopped announcing their prefixes ... ) there is clear intent to take something that wasn't yours in order to benefit from the outcome. However .. when some Bulgarian dude hijacked a prefix from the Ministry of Foreign Affairs 1.5 years ago, with the intent to spam on it ( Domains were pointed to it and other space they hijacked was also quickly spammed on and abused before released..) it was interesting to learn that hijacking as an Act, isn’t a crime .. (the law doesn't mention it.. it isn't illegal.. hence .. it is legal..) There could be made a case that the wrongful intent is and if they would actually spammed on the space, it is directly a crime.. But they didn't (yet) and they stopped the hijack before spamming on it.. So nothing happened, as if your neighbor borrowed your bike and returned it to your doorstep before you knew it was missing. In the same pristine condition .. It could have been said, this is a denial of service, but as the particular ministry wasn't using the space, nothing was denied ... they didn't even noticed it for a complete week. ((!! ) But that is another topic..) Now let's do a similar thing .. but with Cyber Crime fighting or Anti-Abuse in mind .. here comes the DMCA lobby or TRA (Telecom Regulator Agency in some Middle East country..) or some similar organization that is fond of protecting digital content rights.. And they are going to inject routes in a network, fiddle with BGP routing, in order to take down : Dreambox Key Servers on the internet (useful for free satellite decoding without subscriptions.. ) or phishing sites or command and control servers in $country .. or hell, why not take down the complete /21 of North Korea in the process while we talk about it ... Just because we can.. Who defines the greater good ... who is defining the wrongful intent of party X or party Y. Is the DMCA lobby correct if they want to shutdown some hosters torrent site customer.. or if the hoster correct that they don't take action on it and are not disclosing any information unless they are forced by a court order. There have been BGP injections in the past, to see if that could help in TRA compliance .. just in a subset of AS's. If those actions would have had a larger effect ... ( so large that it would have been noticed outside the region and into (this?) community perhaps.. or in the media.. ) ... who are we going to investigate .. The TRA that would like to enforce their local / regional laws and compliance .. or the violators that are facilitating the dreambox key servers that are sharing satellite subscriptions cards over the internet ... or the actual users of the dreambox in various countries ... In either of these scenario's .. the actual hoster or ISP that is hosting the 'service' on their IP space, is most likely outside the local jurisdiction and might not even be aware ... ( they are naughty/ignorant, that is different from being bad. ) In the near future, we will see a lot of grey actions, done by people that in their own mind and under their local laws, stand in their right to fiddle with your routing, if that means they can enforce local censorship or re-gain access to certain infrastructure or deny $party to their infrastructure when they will have a tactical benefit in this.. ( think Turkey during a coup.. or Syria being completely removed from the internet during attacks in Aleppo.. ) Our community covers a huge set of countries and there are quite a lot of political issues ( there are several countries that are real warzones today in our region.) .. and some of those political issues are corruption ( people getting paid to look the other way .. ) and some are just not dealing with the Spam Source because $investigator is blown out of his mind in the US or France Riviera ... RIPE isn't the internet police and this working group isn't either .. I think we should educate each other on what is going on, keep reporting on the issues we see, specifically around certain rotten area's .. We should refrain from forcing the RIPE NCC in becoming an internet police .. as they are an impartial party (like the Red Cross). They provide resources to those that need/request it.. and register who are using it. The same as the Red Cross, they hand out food to all people. Some of them might pick up a rifle 15 minutes later and shoot someone or sell that food .. but you can't blame the Red Cross for handing out food in certain areas or tell them to change their mission. Disciplinary actions (like de-registration due to abuse for instance) should not be up to the NCC, unless the information provided for registration isn´t correct. Everything else is not within the scope of the NCC imho. It should be taken up to the local law enforcement if things are not in compliance with the law ... And that could be different in each country of this huge service region... Moving into any other direction might be a very slippery slope we are getting ourselves into ... Ambition is good, but we shouldn't outreach our place in this delicate environment ... Regards, Erik Bais

2 3

Unsubscribe
by Eoin C. Bairéad 15 Aug '16

15 Aug '16

Unsubscribe me please Eoin C. Bairéad IT Mazars Block 3 The Harcourt Centre Charlotte Street Dublin 2 phone: +353 (1) 4494490 fax: +353 (1) 4750089 mobile: +353 (87) 2311357 ##################################################################################### Internet communications are not secure and the firm does not accept legal responsibility for the contents of this message. Any views or opinions presented are solely those of the author and do not necessarily represent those of the firm. This message is for the named person's use only. It may contain confidential, proprietary or legally privileged information. You must not, directly or indirectly, use, disclose, distribute, print, or copy any part of this message if you are not the intended recipient. ##################################################################################### ##################################################################################### This e-mail message has been scanned for Viruses and Content and cleared by NetIQ MailMarshal #####################################################################################

1 0

Definition of Abuse
by andre＠ox.co.za 14 Aug '16

14 Aug '16

Definition of Abuse as it should be defined by RIPE --------------------------------------------------------------------- The use of a resource to infringe upon the usage rights of another resource Reasoning: ---------------- The above covers all abuse scenarios and it does not tell anyone what to do or what not to do. It is fair and reasonable and includes everything

1 0