June 2018 - anti-abuse-wg - mailman.ripe.net

Re: [anti-abuse-wg] Decision on Proposal 2017-02
by Name 19 Feb '19

19 Feb '19

9 11

New on RIPE Labs: Honeypot-based Monitoring of Amplification DDoS Attacks
by Mirjam Kuehne 03 Aug '18

03 Aug '18

Dear colleagues, Amplification DDoS attacks are one of the most prevalent forms of denial-of-service attacks. The SISSDEN project operates a network of honeypots designed to detect these attacks, observing 10,000 per day. Please find some interesting observations in this RIPE Labs article by Johannes Krupp: https://labs.ripe.net/Members/johannes_krupp/honeypot-based-monitoring-of-a… Kind regards, Mirjam Kühne RIPE NCC

2 1

New on RIPE Labs: Mini series on network security (by Kathleen Moriarty)
by Mirjam Kuehne 14 Jun '18

14 Jun '18

Dear colleagues, We published a mini series on network security on RIPE Labs, contributed by Kathleen Moriarty: 1. Network Monitoring is Dead… What Now? TLS, QUIC and Beyond https://labs.ripe.net/Members/kathleen_moriarty/network-monitoring-is-dead-… 2. They Are Looking At WHAT? Service Provider Monitoring https://labs.ripe.net/Members/kathleen_moriarty/they-are-looking-at-what-se… 3. What Are My Options? Session Encryption Protocols Looking Forward https://labs.ripe.net/Members/kathleen_moriarty/what-are-my-options-session… You can find the full series here: https://labs.ripe.net/Members/kathleen_moriarty Kind regards, Mirjam Kühne RIPE NCC

1 0

Draft Minutes - AA-WG Session at RIPE76
by Brian Nisbet 05 Jun '18

05 Jun '18

Colleagues, Thanks again for a great session at our recent meeting in Marseille. Here are the draft minutes as prepared by the NCC. Could you please read them and comment with any corrections that are required? Anti-Abuse Working Group RIPE 76 17 May 2018, 11:00-12:30 WG co-Chairs: Brian Nisbet, Tobias Knecht Scribe: Emile Aben Status: Draft A. Administrative Matters The video archive is online at: https://ripe76.ripe.net/archives/video/109 The chairs welcomed the room, and addressed the administrative matters. B. Update B1. Working Group Chair Selection Brian Nisbet was selected for another term as co-chair for this working group. The video archive is online at: https://ripe76.ripe.net/archives/video/111 B1. Recent List Discussion The video archive is online at: https://ripe76.ripe.net/archives/video/112 C. Policies Brian summarised the discussions on the mailing list. C1. 2017-02 Regular abuse-c Validation - Herve Clement (Orange), Sara Marcolla (Europol) The video archive is available at: https://ripe76.ripe.net/archives/video/113 There were no questions C1. 2017-02 Regular abuse-c Validation, Marco Schmidt (RIPE NCC) The video archive is available at: https://ripe76.ripe.net/archives/video/113 Alexander Isavnin (Internet Protection Society) asked for exact numbers and lacking these suggested to postpone decision. Brian rejected this suggestion. Julien Escario (Altinea) asked for more serious validations checks. Brian said this was discussed already. Jordi Palet Martinez (The IPv6 Company) considered starting a new policy proposal discussion, after this proposal reaching consensus, based on the proposal he submitted to other RIRs. Piotr Strzyżewsk (Silesian University of Technology, Computer Centre) asked about legacy resource holders. Marco said legacy address space will not be part of this. Piotr said email checking is tricky and used the example of putting abuse(a)ripe.net on arbitrary resources. Brian said this was discussed on the mailing list. Piotr said they will not know how much money this will cost. Marco said that if 25% is incorrect, it will cause frustration to a lot of people. Peter Koch (DENIC) asked for guarantees of the RIPE NCC's interpretation of the text and it not changing its mind. Marco said the guarantee is in that things must be within the policy framework. Peter Koch said the text allows for much harsher interpretation, and was not convinced this is good policy making. Brian said that the RIPE NCC's interpretation at this point is as set as it can be. Ruediger Volk (Deutsche Telekom) unravelled the discussion in three parts: 1) A technical question on how to validate email addresses, and he saw no obstacle on validating all contacts that are relevant 2) Consequences for incorrect email addresses 3) Fixing incorrect email addresses Ruediger said fixing and checking emails could be considered a Database WG task, and was afraid that this work created the illusion of achievement. Tobias Knecht (Abuseix) said 10-25% sounds a correct number for invalid mailboxes and he would be happy to write a proposal with Ruediger. Tobias added that the RIPE NCC is charged with running a clean and valid registry and legacy checking would also be no problem. Brian summarised that no new information was brought to the discussion, and the proposal was still open for a few more days. D. Interactions D1. Global Abuse Community Updates Tobias Knecht - Abuseix The video archive is available at: https://ripe76.ripe.net/archives/video/117 Ruediger asked about the schema language, and answered that JSON doesn't have a schema language. Ruediger suggested creating a list of tools for creating data in this format. Tobias said that keeping the JSON as simple as possible as abuse handling is in essence simple. Ruediger said was interested in the results of this effort that could be easily tracked and expressed doubt about the need for a MIME type for this. Tobias said the MIME type discussion took place in other fora. Tobias said he will connect the community doing this to the anti-abuse working group community. Ruediger said it's essential to provide pointers to tools that use this. E. Presentation E1. Internet Abuse by Russian LEAs Alexander Isavnin (Internet Protection Society) The video archive is available at: https://ripe76.ripe.net/archives/video/119 There were no questions. X. A.O.B. There were no AOBs. Brian closed the session. Thanks, Brian Co-Chair, RIPE AA-WG Brian Nisbet Network Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

1 0

2017-02 Proposal Accepted (Regular abuse-c Validation)
by Marco Schmidt 01 Jun '18

01 Jun '18

Dear colleagues, Consensus has been reached on 2017-02, "Regular abuse-c Validation". This proposal gives the RIPE NCC a mandate to regularly validate "abuse-mailbox:" information and to follow up in cases where the attribute is deemed to be incorrect. You can find the full proposal at: https://www.ripe.net/participate/policies/proposals/2017-02 The new RIPE Document is ripe-705 and is available at: https://www.ripe.net/publications/docs/ripe-705 The RIPE NCC has already begun preparations to implement this policy change. Details of the implementation status are available at: https://www.ripe.net/manage-ips-and-asns/resource-management/policy-impleme… We will send another announcement once the implementation is complete and the regular validation is in place for all “abuse-mailbox:” attributes. Thank you to everyone who provided input. Kind regards, Marco Schmidt Policy Officer RIPE NCC Sent via RIPE Forum -- https://www.ripe.net/participate/mail/forum

1 0