October 2018 - anti-abuse-wg - mailman.ripe.net

Re: [anti-abuse-wg] Decision on Proposal 2017-02
by Name 19 Feb '19

19 Feb '19

9 11

What to do when "abuse" email address does not work?
by Badguys Killer 04 Jan '19

04 Jan '19

I have found that many "abuse" email addresses indicated in WHOIS databases actually are fake e-addresses. One of them is gestionip(a)TELEFONICA.NET.PE (because my company has received many many spams originated from its network so I wrote a spam complaint to this e-address but the mail was rejected for non-existent mailbox!) What can we do in this case? Thanks

6 6

New on RIPE Labs: How We Will Be Validating abuse-c
by Mirjam Kuehne 03 Dec '18

03 Dec '18

Dear colleagues, At the RIPE NCC we’re busy working out a process so we can start validating approximately 70,000 abuse contact email addresses in the RIPE Database. Read on RIPE Labs how we will approach this: https://labs.ripe.net/Members/angela_dallara/how-we-will-be-validating-abus… Kind regards, Mirjam Kühne RIPE NCC

10 13

Agenda Update AA-WG RIPE 77
by Brian Nisbet 17 Nov '18

17 Nov '18

Colleagues, A further update to our agenda for the meeting next week. The session will take place at 11:00 CEST on Thursday 18th October. A. Administrative Matters * Welcome * Scribe, Jabber, Stenography * Microphone Etiquette * Approve Minutes from RIPE 76 * Finalise agenda B. Update * B1. Working Group Chair Selection * B1. Recent List Discussion C. Policies - *C.1. RIPE NCC Update on 2017-02, Angela Dall'Ara - RIPE NCC D. Interactions - E. Presentation - * E1. LIRs from outside the RIPE NCC Service Region - Carlos Friacas * E2. Criminal Abuse in RIPE IP Space - Dhia Mahjoub X. A.O.B. Z. Agenda for RIPE 78 Brian Nisbet Network Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

3 2

Re: [anti-abuse-wg] Mailman
by Andreas Schulze 24 Oct '18

24 Oct '18

Am 22.10.2018 um 07:50 schrieb ac: > > Hi All, > > I will be repeating this post on four Mailman mailing lists.... > > I received one of these: "I hacked your account, here is your password > and pay me bitcoin" scam emails - to andre(a)ox.co.za with the password I > used on anti-abuse-wg(a)ripe.net (and three other Mailman lists only...) > > As I use different passwords, change my passwords (up to now, except > for mailing lists), every 7 to 30 days, I am usually able to know > exactly where, when so that I can go look for the how, etc. As > unfortunately I used the same email and same password on four lists, I > do not know which list data has been compromised. there are two places a list password is stored. - @mailman itself - @your-mua by regular "this is your subsription overview" messages sent out by mailman. if you find a password that (you think) is current, what is the more likely place it was stolen? -- A. Schulze DATEV eG

3 2

Re: [anti-abuse-wg] Mailman
by peter h 23 Oct '18

23 Oct '18

Yes, we have. This is a Ccommon hoax send as SPAM and the intention is to scare folks to pay. SPAM is the problem here! On Monday 22 October 2018 07.50, ac wrote: > > Hi All, > > I will be repeating this post on four Mailman mailing lists.... > > I received one of these: "I hacked your account, here is your password > and pay me bitcoin" scam emails - to andre(a)ox.co.za with the password I > used on anti-abuse-wg(a)ripe.net (and three other Mailman lists only...) > > As I use different passwords, change my passwords (up to now, except > for mailing lists), every 7 to 30 days, I am usually able to know > exactly where, when so that I can go look for the how, etc. As > unfortunately I used the same email and same password on four lists, I > do not know which list data has been compromised. > > If anyone else receives similar email with a password used on > anti-abuse, please let us know... > > For abuse discussion purposes: With which frequency should one change > mailing list passwords? And, is it even that important? Compromising a > mailing list password allows whomever to change my digest options and > nothing much else, so, does it really matter? > > One should have one password for each mailing list (and not one for > four...) but, is it important enough, in terms of abuse itself, to > even change these monthly? or maybe yearly? or maybe not at all? > > Andre > > -- Peter Håkanson There's never money to do it right, but always money to do it again ... and again ... and again ... and again. ( Det är billigare att göra rätt. Det är dyrt att laga fel. )

2 1

Mailman
by ac 22 Oct '18

22 Oct '18

Hi All, I will be repeating this post on four Mailman mailing lists.... I received one of these: "I hacked your account, here is your password and pay me bitcoin" scam emails - to andre(a)ox.co.za with the password I used on anti-abuse-wg(a)ripe.net (and three other Mailman lists only...) As I use different passwords, change my passwords (up to now, except for mailing lists), every 7 to 30 days, I am usually able to know exactly where, when so that I can go look for the how, etc. As unfortunately I used the same email and same password on four lists, I do not know which list data has been compromised. If anyone else receives similar email with a password used on anti-abuse, please let us know... For abuse discussion purposes: With which frequency should one change mailing list passwords? And, is it even that important? Compromising a mailing list password allows whomever to change my digest options and nothing much else, so, does it really matter? One should have one password for each mailing list (and not one for four...) but, is it important enough, in terms of abuse itself, to even change these monthly? or maybe yearly? or maybe not at all? Andre

1 0

Updated Agenda - RIPE 77 Anti-Abuse WG Session
by Brian Nisbet 16 Oct '18

16 Oct '18

Colleagues, One more change to the agenda for Thursday, with the addition of ' abuse-c validation proposal: Status in other RIRs and way forward - Jordi Palet Martinez' It is grouped on the agenda with the other policy related piece, but it will actually take place in the second half of the session as Jordi needs to be in the v6 WG for a while. A. Administrative Matters * Welcome * Scribe, Jabber, Stenography * Microphone Etiquette * Approve Minutes from RIPE 76 * Finalise agenda B. Update * B1. Working Group Chair Selection * B1. Recent List Discussion C. Policies - *C.1. RIPE NCC Update on 2017-02, Angela Dall'Ara - RIPE NCC *C.2. abuse-c validation proposal: Status in other RIRs and way forward - Jordi Palet Martinez D. Interactions - E. Presentation - * E1. LIRs from outside the RIPE NCC Service Region - Carlos Friacas * E2. Criminal Abuse in RIPE IP Space - Dhia Mahjoub X. A.O.B. Z. Agenda for RIPE 78 Brian Nisbet Network Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

1 0

WG Chair Selection Candidates
by Brian Nisbet 15 Oct '18

15 Oct '18

Colleagues, We have two people who have put themselves forward as potential Chairs of the WG: Tobias Knecht Alireza Vaziri I have attached relevant documents. Alireza (CV attached) says: " On 2003 I stepped in the internet industry as a technical support of an ISP. It was around 2006 that I found my interest in networking and system engineering, so I went after a couple of vendor-specific certifications. I have worked with different ISPs and organizations as System/Network Administrator till 2016 that I went after information security. Back in those days, I found many ISPs in the middle east region are facing internet abuses, so botnets and DDoS caught my attention. I have talked on several conferences including RIPE and MENOG regarding the reduction of abuses in their network and currently helping LIRs to reduce their network abuses and protect themselves. Unfortunately, ISPs in my region are not aware of the problems that are making for others. I believe with the help of the community we could dramatically decrease the number of abuses by helping small LIRs to protect themselves." Tobias says: "Tobias Knecht is known globally within network abuse circles as an expert in developing rational and effective processes and tools designed to reduce with the goal to eliminate network abuse. In 2003, Tobias joined Schlund+Partner to establish United Internet's, also known as 1&1, first worldwide, multi-brand Abuse Department. From this experience, including building the team, processes, policy and technology Tobias got his start. Later at Habeas, Tobias continued to develop his understanding of eMail Policy and Abuse Handling from the different perspectives of each company he worked with. In 2008, with a passion to help others solve their network abuse issues, Tobias co-founded the Global Reporting Project, an effort to directly share abuse data between industry stakeholders. His work within this Project led to the founding of Abusix in 2009. Toby's excitement about how the world can become safer, and how to eliminate network abuse is contagious. He shares his enthusiasm about "clean networks" both in his role as the Founder & CEO of Abusix and Co-Chair of the maawg AbuseDesk Working Group. As a Co-Chair of the RIPE Anti-Abuse Working Group Tobias worked on connecting different industry groups and exchanging ideas. I'm happy to keep being this important connection and help facilitating ideas between different communities if the RIPE community wishes me to." Please have a think about how you, as a WG, would like to proceed and we will discuss this at our session on Thursday (which is open to remote participation). If the WG cannot reach consensus at that point, then we will proceed to a vote. Thanks, Brian Brian Nisbet Network Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

2 1

Chronic Abuse as a successful Internet Business Model
by ac 06 Oct '18

06 Oct '18

Hi Everyone, There are many well skilled and top International technical resources on this mailing list. I would like anyone that disagrees with this post, to simply stand up and say why you disagree. If you agree, please simply remain quiet or maybe expand and add? Gmail.com started out by sending UBE (Unsolicited Bulk Email) to email addresses Google scraped off public emailing lists. (I know this because I was spammed by google, to an email address only used on a Linux mailing list) - The Google spam offered me a "free" gmail account and five invites, where I might "invite" (by adding five email addresses) five other "victims" to receive free @gmail.com email addresses. For Internet techs, open source people and various others, it quickly became a status symbol to be able to have a "google" email address (as @gmail could not yet, at that point, be created by anyone...) - For me, I did not take Google up on their spam, I was to busy figuring out where I can complain about the abuse :) Today, the largest chronic spammers are also Twitter, Facebook, Outlook and other "top" / big/huge dominant Internet companies. It is common knowledge that Twitter and Facebook (supposedly online social media applications) rely heavily on email as a technology, to keep and engage their products. Twitter and Facebook sends a lot of SPAM. And when you start receiving spam from either of these you have to click on many links, and jump through some hoops to eventually get the spammers to stop sending you spam. To block Facebook, or block Twitter, Google or Outlook.com is also impossible and even when you receive phish from Outlook or Google, chances are that it will come through as everyone has to add weight or make special rules, to allow their emails to come through. Yet, a common spammer from wherever else, is quickly blocked and stopped. An easy example (Where you can also see which RBL is ethical, open, fair, honest and truthful) is here: Any Facebook, Twitter, Outlook or Google IP number http://multirbl.valli.org/dnsbl-lookup/69.171.232.139.html and to counter, pick a really tiny spammer, from any small unknown corner of the planet. You will find, technically, that the Big 10 Internet Giants are listed by a handful of decent, honest and ethical RBL - But the tiny small spammer is listed on 60+ So, we have two sets of rules for the dominating Internet giants and for the small startup (who gets hacked by accident) - Similarly, this server that I am sending to on this list, was recently blocked by Microsoft. - I could not send any email to any @microsoft account. Yet, I or my IP co (Hetzner.de) never received even one abuse complaint from @Microsoft in many years. - @Microsoft though, received a few thousand phish. scam, spam and general abuse complaints from myself and my IP number, this past few months alone... So, okay, we all know it is not fair and the playing field is not level and the large companies behave like aggressive animals and best case, like bullies. I started thinking how these large companies are using their dominance, applying it to other technical areas and leveraging growth, money and income from their behavior. And, yes, they are pivoting abuse into cloud, ai, hardware and into domination in other areas. This is at this point an observation, commentary and remarks for myself. Can anyone add any additional substance or comments? Andre

1 0

AA-WG Agenda Update, RIPE 77
by Brian Nisbet 02 Oct '18

02 Oct '18

Colleagues, I've added an NCC update on RIPE 2017-02 to the agenda. As mentioned, there is still a small amount of time available during the session on October 18th and there is still an opportunity to nominate yourself or others for the position of WG Chair A. Administrative Matters * Welcome * Scribe, Jabber, Stenography * Microphone Etiquette * Approve Minutes from RIPE 76 * Finalise agenda B. Update * B1. Working Group Chair Selection * B1. Recent List Discussion C. Policies - *C.1. RIPE NCC Update on 2017-02, Angela Dall'Ara - RIPE NCC D. Interactions - E. Presentation - * E1. Criminal Abuse in RIPE IP Space - Dhia Mahjoub X. A.O.B. Z. Agenda for RIPE 78 Thanks Brian Co-Chair, RIPE AA-WG Brian Nisbet Network Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

1 0

Re: [anti-abuse-wg] When email verification behavior is abusive
by Richard Clayton 01 Oct '18

01 Oct '18

In message , ac <ac(a)main.me> writes >ESP and email relay services should verify recipient email addresses >prior to sending bulk emails to any random email address. > >ESPs that simply start dumping bulk emails on victims often end up >listed on RBLs for abusive behavior. > >But, when is verification emails themselves, spamvertising or email abuse? when people don't want them in their mailbox in a world of machine learning and email flows measured in the tens of billions, the only practical way of identifying abuse is to examine user feedback ... ... if you're not in the billions regime then you can try and write down complex rules to guide your users and your abuse teams, but even then flexibility is key because otherwise you end up arguing with an abuser who is skating just on the right side of some arbitrary value >Our own email policy defines verification abuse as "more than 3 verify >your email account" emails in the same 24 hour period and verify your >email account emails lasting longer than five 24 hour periods. > >Do you think this is reasonable? Too reasonable? More? Less? it depends on the size of the company/mailing list ... 3 new signups in a day may be a red letter day, or it may merely indicate that something broke at thirteen minutes past midnight >If you receive say 4 "verify your email account" emails in 5 minutes, >is this abuse? this question suggests that you might be seeing an outer ripple of an incident which is the modern form of mail bombing this is where users receive tens of thousands of verification emails in a hour or so ... sometimes this is just because the user is disliked, but it can be an attempt to hide other transactional email (associated with fraud or domain name theft) amongst all the noise few mail systems provide suitable tools to end users to deal with this regrettably few sign-up systems have (even weak) CAPTCHA systems to prevent automated attacks.... (something which an ISP providing hosting might usefully start requiring of its customers : rather more practical than trying to set some arbitrary number on emails sent) there is a proposal for assisting with automated filtering https://tools.ietf.org/html/draft-levine-mailbomb-header-01 but it's not currently getting all that much traction. -- richard Richard Clayton Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety. Benjamin Franklin 11 Nov 1755

4 5