July 2018 - anti-abuse-wg - mailman.ripe.net

Re: [anti-abuse-wg] Decision on Proposal 2017-02
by Name 19 Feb '19

19 Feb '19

9 11

Re: [anti-abuse-wg] When email verification behavior is abusive
by Richard Clayton 01 Oct '18

01 Oct '18

In message , ac <ac(a)main.me> writes >ESP and email relay services should verify recipient email addresses >prior to sending bulk emails to any random email address. > >ESPs that simply start dumping bulk emails on victims often end up >listed on RBLs for abusive behavior. > >But, when is verification emails themselves, spamvertising or email abuse? when people don't want them in their mailbox in a world of machine learning and email flows measured in the tens of billions, the only practical way of identifying abuse is to examine user feedback ... ... if you're not in the billions regime then you can try and write down complex rules to guide your users and your abuse teams, but even then flexibility is key because otherwise you end up arguing with an abuser who is skating just on the right side of some arbitrary value >Our own email policy defines verification abuse as "more than 3 verify >your email account" emails in the same 24 hour period and verify your >email account emails lasting longer than five 24 hour periods. > >Do you think this is reasonable? Too reasonable? More? Less? it depends on the size of the company/mailing list ... 3 new signups in a day may be a red letter day, or it may merely indicate that something broke at thirteen minutes past midnight >If you receive say 4 "verify your email account" emails in 5 minutes, >is this abuse? this question suggests that you might be seeing an outer ripple of an incident which is the modern form of mail bombing this is where users receive tens of thousands of verification emails in a hour or so ... sometimes this is just because the user is disliked, but it can be an attempt to hide other transactional email (associated with fraud or domain name theft) amongst all the noise few mail systems provide suitable tools to end users to deal with this regrettably few sign-up systems have (even weak) CAPTCHA systems to prevent automated attacks.... (something which an ISP providing hosting might usefully start requiring of its customers : rather more practical than trying to set some arbitrary number on emails sent) there is a proposal for assisting with automated filtering https://tools.ietf.org/html/draft-levine-mailbomb-header-01 but it's not currently getting all that much traction. -- richard Richard Clayton Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety. Benjamin Franklin 11 Nov 1755

4 5

New on RIPE Labs: Honeypot-based Monitoring of Amplification DDoS Attacks
by Mirjam Kuehne 03 Aug '18

03 Aug '18

Dear colleagues, Amplification DDoS attacks are one of the most prevalent forms of denial-of-service attacks. The SISSDEN project operates a network of honeypots designed to detect these attacks, observing 10,000 per day. Please find some interesting observations in this RIPE Labs article by Johannes Krupp: https://labs.ripe.net/Members/johannes_krupp/honeypot-based-monitoring-of-a… Kind regards, Mirjam Kühne RIPE NCC

2 1

Re: [anti-abuse-wg] When email verification behavior is abusive
by Michele Neylon - Blacknight 18 Jul '18

18 Jul '18

If you framed your issues or questions more clearly and succinctly it would be helpful. In relation to your specific "ask" I don't think it's the right one. You could, potentially, come up with a best practice eg. That providers should verify that account holders / users have access to an email address before letting them add it to a service. But I've no idea how you'd decided on rate limiting the verification emails. Based on my own experiences with mail servers, spam filters, grey listing etc., you can easily end up spamming yourself when those emails don't come through quickly enough. -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ https://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 On 18/07/2018, 12:30, "anti-abuse-wg on behalf of ac" <anti-abuse-wg-bounces(a)ripe.net on behalf of ac(a)main.me> wrote: Thank you for asking that very valid question! Whether something is Abuse or not abuse and when Internet behavior is abuse or not has everything to do with this WG. And, discussing what constitutes abuse (or not), how (or even if) it affects RIR etc is very relevant as it leads to a clearer understanding of many things. One very basic thing would be resource abuse reporting. How can anyone report abuse if it is not even considered to be abuse? I can go on and on, but that would be counter productive. Why do you not help and tell me what arbitrary number of verify your email address, emails would you consider to be abuse - and in/over which period? That would be super helpful to everyone, as I do not think any of us actually knows what we all consider the arbitrary number to be? Or are you saying it is not abuse at all? Actually, sorry I may not understand why you are asking about relevance? Regards Andre On Wed, 18 Jul 2018 11:03:47 +0000 Michele Neylon - Blacknight <michele(a)blacknight.com> wrote: > What's any of this got to do with RIPE and this WG? > Is there a policy proposal or something else forthcoming? > > Regards > > Michele > > -- > Mr Michele Neylon > Blacknight Solutions > Hosting, Colocation & Domains > https://www.blacknight.com/ > https://blacknight.blog/ > Intl. +353 (0) 59 9183072 > Personal blog: https://michele.blog/ > Some thoughts: https://ceo.hosting/ > ------------------------------- > Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business > Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: > 370845 >

2 1

Re: [anti-abuse-wg] When email verification behavior is abusive
by Michele Neylon - Blacknight 18 Jul '18

18 Jul '18

What's any of this got to do with RIPE and this WG? Is there a policy proposal or something else forthcoming? Regards Michele -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ https://blacknight.blog/ Intl. +353 (0) 59 9183072 Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845

3 5

When email verification behavior is abusive
by ac 18 Jul '18

18 Jul '18

Hi All, ESP and email relay services should verify recipient email addresses prior to sending bulk emails to any random email address. ESPs that simply start dumping bulk emails on victims often end up listed on RBLs for abusive behavior. But, when is verification emails themselves, spamvertising or email abuse? Our own email policy defines verification abuse as "more than 3 verify your email account" emails in the same 24 hour period and verify your email account emails lasting longer than five 24 hour periods. Do you think this is reasonable? Too reasonable? More? Less? If you receive say 4 "verify your email account" emails in 5 minutes, is this abuse? Andre

1 0

I'm sure this is totally accurate :-)
by Ronald F. Guilmette 13 Jul '18

13 Jul '18

Bummer. www.ripe.net is distributing malware. https://quttera.com/detailed_report/www.ripe.net :-)

3 2

Re: [anti-abuse-wg] Google & Cisco
by ac 10 Jul '18

10 Jul '18

Hi, So, I have received some off list email, about my post. The trouble with off list email is that sometimes things are discussed that is of value to the community. These are my additional comments: Abuse systems can also be abusive, for example: http://multirbl.valli.org - warning all about a 'fake' rbl Abuse systems can be used as weapons - both for war as well as for corporate war. Abuse systems and platforms can be used to the detriment of the EU Where corporations club together and could be used to influence the growth/decline of services of a country or group of countries. Anyway, included is an extract of headers where SpamCop ignores date: Tue, 10 Jul 2018 03:08:27 -0700 (and the Google Relay ipv4 - which for the record was: mail-oi0-f44.google.com(a)209.85.218.44 and on Tue, 10 Jul 2018 03:08:27 -0700) and fails the report on date (older than 48 hours) as SpamCop trusts the Google relay and wants to report about: 2002:a4a:4841:0:0:0:0:0 with HTTP; Sat, 7 Jul 2018 19:37:11 -0700 (PDT) Which usually would have been the TELECOM company IP number (of the telecom user/company) The 'Telecom' company IP number is not an email server and therefore SpamCop reports that many abuse admins on this list receives, are not really worth much any longer as any spamcop report that is not about your email servers, can be safely deleted. Cisco basically says that they do not have any deal with Google and that they are not protecting Twitter, Facebook, Amazon and Microsoft I am wondering what the benefit is to Cisco by devaluing the value of SpamCop for abuse admins? Or is it more a case of protecting the big 5 and keeping everyone else on their toes? Is this bullying? Is it nefarious? It is not good. It is not ethical and it is plainly EVIL. +++++++++++++ Received: by mail-oi0-f44.google.com with SMTP id n84-v6so41513085oib.9 for <victim>; Tue, 10 Jul 2018 03:08:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=jenreviews-email.20150623.gappssmtp.com; s=20150623; h=mime-version:from:date:message-id:subject:to; bh=EFkdASUSCy3UwqSvm2EX4abetipkteFp5j+2Y9kJF0c=; b=SUrZKZxQlMfl7LPwx6nTHoGJ9KnOH7k/7XJq80zGpkGERu4ogQnOIjJvbWC2NN3CK/ QwKh9JcBgnkdOHgnHcLlaoogt7o3+arGGjmNUBB9AP7jif35Hz74gurZ8vprFSO0mvjG sggWkN3rFq/wp+FuNKChWY4lT4PrsVbqo27UEvstouEsuMsH4OfBSAHpc7bb4QsuKvAd 0UglZIUWMxHGYYlFJB14SElmm4ILXXPEEZZky7JQa6OOpzvCV9Ak6cd+L6o1EuK04Npk A8+uM27v6UWsZLvX10+7D5CwL4t8oK97FG46cELHQE58nWlIVDm9PvAF5E970W46Pihy zceA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=EFkdASUSCy3UwqSvm2EX4abetipkteFp5j+2Y9kJF0c=; b=tJ0aM+VgmcMNhkOPlpYnhGNlP0/V0hWzttKZWMQxd9FZDEDbx5YbxGZn3dIrghNZY6 LOKdbKk5NUU61oqV/B0a/1ecm8mqFV4hP/qlDcFuu9HXeYsxgwZ9ieGF7EpBycnzJqLT 3n9ldMJuNL9RiKWJr1L4o4+JySpJ8Dp4zsuRfm4rn4V2cQQP8LT763r2sKXG1jEXG6Yy VQUL8eEdnsWgN4ON4LQA34MqHTejtHnTNTFYrWQUX8VjqIImedNl58Gx8RNW7nHSwt/F eaGw/xl3umn4bkONz8UVkpYVqgTI8nqVehhJlynKTPyTKxLFS9waGPieOOM9hLkeb+eA 2JeQ== X-Gm-Message-State: APt69E3m7PhKks5zjFEwDCJkBQzeDd3nggWlzc1bT0LzBBFYHQMSDN5F toEVWauopOgYRWJ7JSCN637aGLXOvTSpggI1GKu4aw== X-Google-Smtp-Source: AAOMgpdxfMce9VRJy0i9imFEwrYn4NZwGbhBzGfmH1WTfcicyUEVdX7DJIykmii9WZ7wnhUCy93cLp/a7T/At+cVdJE= X-Received: by 2002:aca:430b:: with SMTP id q11-v6mr28734957oia.127.1531217285617; Tue, 10 Jul 2018 03:08:05 -0700 (PDT) Received: from 776393159873 named unknown by gmailapi.google.com with HTTPREST; Tue, 10 Jul 2018 03:08:05 -0700 MIME-Version: 1.0 Received: by 2002:a4a:4841:0:0:0:0:0 with HTTP; Sat, 7 Jul 2018 19:37:11 -0700 (PDT) From: Jenn Miller <jenn(a)jenreviews.email> Date: Tue, 10 Jul 2018 03:08:05 -0700 Message-ID: <CALvVF876A17shGKhFmXEU2hD4Z0CNsY4mHy1=Sj1rASQStYDAQ(a)mail.gmail.com> ++++++++++++++++++++++++ On Thu, 5 Jul 2018 13:23:08 +0200 ac <ac(a)main.me> wrote: > Hello All, > > As we all know, Google and Microsoft dominates email relay in many > places and they are getting even larger with each passing year. > > They are not getting larger because they are offering great email > service but because they are ever more aggressive and sometimes under > handed and do not behave decently or in an ethical way. > > if the present trends continue, there will be almost no email relay > that does not operate through either Microsoft or Google. > > Interesting thing that all of us (and Microsoft) should take careful > note of is that Google has done a deal with Cisco (Talos SpamCop) > whereby reports about abuse (including spear phish, spam, scams, etc) > - are no longer sent to Google (abuse(a)google.com) but directly to the > relay ipv4/ipv6 abuse ISP contact. When there is no ipv4/ipv6 abuse > contact the complaints are discarded and in a minority of cases, > still go to abuse(a)google.com > > Microsoft of course has two attack vectors. One the 'custom' protocols > of their exchange servers and the other is that they mix legit email > and spear phish, payday loan scams from the same servers. Google has > now also started doing the same thing. Before Google used to be > more responsive to abuse complaints and there were fewer actual > criminal activity relayed by Google. So, it is becoming more frequent > and common to find spear phish attack on a client, from Google and > Microsoft and this motivates clients to move services to Microsoft or > Google. > > I do not think that there is much an abuse wg can discuss around this, > as there is not much or anything that any of us can actually do about > the present situation as both Google and Microsoft has simply become > too large and year on year they are getting larger. > > Any comments? > > > > > >

1 0

Google & Cisco
by ac 05 Jul '18

05 Jul '18

Hello All, As we all know, Google and Microsoft dominates email relay in many places and they are getting even larger with each passing year. They are not getting larger because they are offering great email service but because they are ever more aggressive and sometimes under handed and do not behave decently or in an ethical way. if the present trends continue, there will be almost no email relay that does not operate through either Microsoft or Google. Interesting thing that all of us (and Microsoft) should take careful note of is that Google has done a deal with Cisco (Talos SpamCop) whereby reports about abuse (including spear phish, spam, scams, etc) - are no longer sent to Google (abuse(a)google.com) but directly to the relay ipv4/ipv6 abuse ISP contact. When there is no ipv4/ipv6 abuse contact the complaints are discarded and in a minority of cases, still go to abuse(a)google.com Microsoft of course has two attack vectors. One the 'custom' protocols of their exchange servers and the other is that they mix legit email and spear phish, payday loan scams from the same servers. Google has now also started doing the same thing. Before Google used to be more responsive to abuse complaints and there were fewer actual criminal activity relayed by Google. So, it is becoming more frequent and common to find spear phish attack on a client, from Google and Microsoft and this motivates clients to move services to Microsoft or Google. I do not think that there is much an abuse wg can discuss around this, as there is not much or anything that any of us can actually do about the present situation as both Google and Microsoft has simply become too large and year on year they are getting larger. Any comments?

1 0

RIPE 77 CfP and AA-WG Agenda
by Brian Nisbet 04 Jul '18

04 Jul '18

Colleagues, As I'm hoping you're all aware the RIPE 77 Call for Presentations is now open: https://ripe77.ripe.net/submit-topic/cfp/ At the same time I would ask you to consider if you may have anything to bring to the Working Group in October, whether that is a new policy, process, point of information or more general presentation. If so, please do email Tobias and I and we can discuss it! Thanks, Brian Co-Chair, RIPE AA-WG Brian Nisbet Network Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

1 0