March 2019 - anti-abuse-wg - mailman.ripe.net

2019-03 New Policy Proposal
by joao.silva＠anacom.pt 29 Mar '19

29 Mar '19

Hi all, I support the 2019-03 proposal. K.R. [cid:image001.gif@01D4E634.4FD739E0] João Feijó Silva Senior Consultant [https://www.anacom.pt/images/logotipos/Anacom_30anosEN.png] Lisboa (Headquarter) Av. José Malhoa, 12 1099 - 017 Lisboa - Portugal Tel: (+351) 217212211 www.anacom.pt [cid:image002.jpg@01D4E634.4FD739E0]<https://www.anacom.pt/> Pense no ambiente. Imprima o conteúdo desta mensagem apenas se for absolutamente necessário. Este email e ficheiros em anexo são confidenciais e destinados somente ao conhecimento e utilização da(s) pessoa(s) ou entidade(s) a quem foram endereçados. Se recebeu este email ou anexos por erro, ou a eles teve acesso não sendo o destinatário, por favor elimine-os contactando o remetente. Please consider the environment before printing this mail note. This email and files transmitted with it are confidential and intended for the sole use of the individual or organization to whom they are addressed. If you have received this email in error, please notify the sender immediately and delete it without using, copying, storing, forwarding or disclosing its contents to any other party. Autoridade Nacional de Comunicações https://www.anacom.pt/

1 0

Re: [anti-abuse-wg] 2019-03 and over-reach
by José Legatheaux Martins 29 Mar '19

29 Mar '19

On Mon, 25 Mar 2019 at 10:45, ac <ac(a)main.me> wrote: > On Mon, 25 Mar 2019 09:29:47 +0000 > > I frequently read someone saying "RIPE is not the Internet > Police" (even I have said that a few times myself) but the hard > truth is that any RIR has a duty to exercise administrative authority. > Finding the balance where this duty is an over-reach, as per the subject > line of this hijacked thread, is an important discussion that I believe > this wg should have sometime as this relates directly to abuse also... > > I fully support the 2019-03 proposal. Even if the final decision is in the sense that "RIPE is not the Internet Police", nothing should prevent RIPE of being a reliable source of verified information on fully confirmed proofs about entities incurring in BGP hijacking practices. Also, nothing prevents RIPE of recommending the consultation of certified and justified reputation information whenever people engage in business relationships with new "unknown entities". In my opinion, RIPE could be the support organisation of that repository. Just my two cents ... All the best, José L.M. --------------------------------------------------------- Jose Legatheaux Martins President of ISOC Portugal https://legatheaux.eu

1 0

2019-03 New Policy Proposal
by João Farinha 29 Mar '19

29 Mar '19

I support the 2019-03 proposal.

1 0

2019-03 New Policy Proposal (BGP Hijacking is a RIPE Policy Violation)
by Daniel Marques 29 Mar '19

29 Mar '19

Hi all, I support the 2019-03 proposal. Kind Regards, * * banner*DANIEL MARQUES* *Founding Brother * Email:*dan.m@xcudo.pt <mailto:dan.m@xcudo.pt>* Tel.:*+351 927 484 445* Web.:*https://xcudo.pt <https://xcudo.pt>*

1 0

I support 2019-03 BGP Hijacking is a RIPE Policy Violation
by André Melancia 28 Mar '19

28 Mar '19

I support 2019-03 BGP Hijacking is a RIPE Policy Violation! André Melancia Developer / DBA / Microsoft Certified Trainer (MCT) <https://www.youracclaim.com/user/andypt> Lunar Cat, Unip.Lda. Owner / Principal Consultant → +351-919443776<tel:+351-919443776> → Mail<mailto:Andy@Andy.COM.PT>; Site<http://andy.pt/>; Facebook<https://facebook.com/ANDY.COM.PT>; Twitter<https://twitter.com/AndyPT>; LinkedIn<https://linkedin.com/in/AndreMelancia>; Skype<skype:AndyCOMPT> Join our Portuguese technical communities (our natives also speak English!): → Data Community Portugal: FB Page<https://facebook.com/DataCommunityPT>; FB Group<https://facebook.com/groups/DataCommunityPT> → IT Pro Portugal: FB Page<https://facebook.com/ITProPortugal>; FB Group<https://facebook.com/groups/ITProPortugal>; Twitter<https://twitter.com/ITProPT>; Site<http://itproportugal.pt/> → PowerShell Portugal: FB Page<https://facebook.com/PowerShellPortugal>; FB Group<https://facebook.com/groups/PowerShellPortugal>; Twitter<https://twitter.com/PowerShellPT> → Community Evenings: Eventbrite<https://communityevenings.eventbrite.com/> → Windows Development Portugal: FB Group<https://facebook.com/groups/WindowsDevPT> → Revista Programar: Revista Programar<https://revista-programar.info/>

1 0

Re: [anti-abuse-wg] 2019-03 and over-reach
by Sascha Luck [ml] 25 Mar '19

25 Mar '19

On Mon, Mar 25, 2019 at 12:44:47PM +0200, ac wrote: >I frequently read someone saying "RIPE is not the Internet >Police" (even I have said that a few times myself) but the hard >truth is that any RIR has a duty to exercise administrative authority. Only as far as it pertains to the registration of allocated/assigned resources. All membership of the RIPE NCC since its foundation was entered into with the understanding that the NCC is a *registry* not an *enforcer* and does not regulate the operation or behaviour of member networks. 2019-03 attempts to change this by plugging into an ill-defined concept of "policy". This is perhaps a fundamental issue, as there has been "mission creep" from "address-policy" (the better term is "resource policy") into all sorts of other aspects of network operations. Unfortunately, RIPE and the NCC were founded in much more cooperative days and so it was omitted to clearly define the "limits of authority", perhaps because it was not seen as necessary back then. I therefore argue that it is maybe time to have a discussion on what exactly RIPE and the NCC should be and what, if any, limits on their administrative power there should be. I hope, though, that everyone can at least agree that *this* is *not* the forum for that discussion. rgds, SL >Finding the balance where this duty is an over-reach, as per the subject >line of this hijacked thread, is an important discussion that I believe >this wg should have sometime as this relates directly to abuse also... > >and, similarly, arguing that because Afrinic etc does not do this or >does not do that, is hardly any great argument either, many interesting >things, angles and points in these 2019-03 discussions and threads :) > >Andre > > >

4 4

Re: [anti-abuse-wg] 2019-03 and over-reach
by Brian Nisbet 25 Mar '19

25 Mar '19

Colleagues, I want to comment on something below... > -----Original Message----- > From: anti-abuse-wg <anti-abuse-wg-bounces(a)ripe.net> On Behalf Of ac > Sent: Saturday 23 March 2019 08:54 > > So, anyway, as 2019-03 deals with hijacking, this entire over reach argument > is factually not relevant at all > > and, more so: 2019-03 not proceeding would be counter to the ethical > administration of resources, a dereliction of responsibility and a breach of > trust implied in any such administration (as well as administrative authority) A core part of the policy process in the RIPE Community is that nothing is set in stone. A policy which is rejected one day may be accepted another, or something which is put in place may be changed or altered when new information comes to light. This is all part of the PDP. *If* 2019-03 does not reach consensus it in no way implies the RIPE Community does not care about BGP hijacking (community pushes like MANRS and general work on RPKI says otherwise), all it says is that this proposal was not deemed to be the right way to go about it. Thanks, Brian Co-Chair, RIPE AAWG Brian Nisbet Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

2 1

Re: [anti-abuse-wg] 2019-03 New Policy Proposal (BGP Hijacking is a RIPE Policy Violation)
by Töma Gavrichenkov 25 Mar '19

25 Mar '19

Hi all, > A new RIPE Policy proposal, 2019-03, "BGP Hijacking is > a RIPE Policy Violation", is now available for discussion. Sorry if the issues I'm raising were already addressed somewhere around the thread. As of now, I believe it's the size of an average fiction book, and I don't quite have enough time to read that. I also apologize now in advance for abstaining from the discussion at some point in future, because in quite the same fashion I won't be able to read unnecessarily (and sometimes I believe deliberately) long responses. Whoever is planning to win a consensus through exhaustion is going to win that anyway. With that in mind, 1. As of now, the draft looks like a nice example of "document designed by a committee". It's too strict where there's no real need to be strict, and at the same time too weak where you don't expect it to be weak. E.g. 4 weeks to report + 4 weeks to investigate + 2 weeks for an appeal give us solid 10 weeks for an attack to stay there, which is, to put it gently, a substantial amount of time. 2. OTOH the ultimate result (membership cancellation) may be seen as a very heavy punishment. In fact in theory this policy could make things worse. Most of the ISPs are very slow in applying security updates to their equipment, including border routers. (Also, vendors themselves are not quite keeping up as well) Now, say, I'm an ISP who really wants to push my competitor out of business. With this policy here's a sequence of steps that will win you the market: - hire a script kiddie who will break into that company's Mikrotik; - announce roughly half of IPv4 address space through that breach just for it to be surely on the news; - relax and enjoy watching your competition disappearing in no later than 2,5 months. While I would, in my perfect dream, personally support the idea of cancelling an LIR membership for not updating one's devices at least on a weekly basis, I don't really think this is what the authors of the draft were going to propose, and I know quite a few people, Randy Bush for starters, whom the authors, to put it mildly, won't probably be able to convince. The example by Warren also deserves attention, and I personally don't really anticipate that "won't be too hard to figure out", because frankly we're in fact yet to see the hijacking attempts where an attacker would be deliberately trying hard to hide their identity. 3. If I were to design that process, I'd put it in a different way, e.g.: - 2 business days to find experts. Really, four weeks for that?! Yes, we know that NCC isn't the most dynamic organization out there, but with a pre-populated pool of experts at the current rate of hijacking incidents reported to public that shouldn't really be an issue. - 3 business days to investigate and prepare a preliminary report. Another 5 business days to continue investigation if necessary, with another report at the end. Maybe a third iteration if necessary. Immediate membership suspension at the end if the experts decide it's necessary to do so now. - A grace period of 8 weeks for the suspected hijacker to collect further evidence and provide additional arguments to justify their position. - An appeal phase of another 8 weeks with ultimate decision and, where necessary, membership termination in the end. All the numbers above are rough estimations, they are only there to showcase the idea: - the reaction to *mitigate* should be immediate; - the reaction to *penalize* should allow for a large enterprise — or a large ISP! — to keep up. -- Töma

7 16

Re: [anti-abuse-wg] 2019-03 and over-reach
by Gert Doering 23 Mar '19

23 Mar '19

Hi, On Sat, Mar 23, 2019 at 12:27:32PM +0200, ac wrote: > On Sat, 23 Mar 2019 18:04:22 +0800 > Lu Heng <h.lu(a)anytimechinese.com> wrote: > > > > It???s very much like electricity company tell you if you do something > > bad we will cut you off and stop supply electricity.and yes, they > > will cut you if you stop paying them, but that doesn???t mean they can > > they also cut if you cheat by stealing electricity. But they will not cut you off if you use the electricity in ways that your neighbours do not like. And this is where things start getting complicated. A and B have a contract. B does something C does not like (but which is legal). Why should that affect A? Gert Doering -- NetMaster -- have you enabled IPv6 on something today...? SpaceNet AG Vorstand: Sebastian v. Bomhard, Michael Emmer Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279

4 6

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 88, Issue 72
by Durga Prasad Malyala 23 Mar '19

23 Mar '19

Sorry off topic. How Come I subscribed to digest yet getting multiple mails per day? Cheers/DP On Sat, Mar 23, 2019, 22:53 <anti-abuse-wg-request(a)ripe.net> wrote: > Send anti-abuse-wg mailing list submissions to > anti-abuse-wg(a)ripe.net > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.ripe.net/mailman/listinfo/anti-abuse-wg > or, via email, send a message with subject or body 'help' to > anti-abuse-wg-request(a)ripe.net > > You can reach the person managing the list at > anti-abuse-wg-owner(a)ripe.net > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of anti-abuse-wg digest..." > > > Today's Topics: > > 1. Re: 2019-03 New Policy Proposal (BGP Hijacking is a RIPE > Policy Violation) (Carlos Fria?as) > 2. Re: 2019-03 New Policy Proposal (BGP Hijacking is a RIPE > Policy Violation) (Sascha Luck [ml]) > 3. Re: 2019-03 New Policy Proposal (BGP Hijacking is a RIPE > Policy Violation) (Lu Heng) > 4. Re: 2019-03 and over-reach (Nick Hilliard) > 5. Re: 2019-03 and over-reach (Hank Nussbacher) > 6. Re: 2019-03 and over-reach (Hank Nussbacher) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Sat, 23 Mar 2019 13:39:04 +0000 (WET) > From: Carlos Fria?as <cfriacas(a)fccn.pt> > To: T?ma Gavrichenkov <ximaera(a)gmail.com> > Cc: anti-abuse-wg(a)ripe.net > Subject: Re: [anti-abuse-wg] 2019-03 New Policy Proposal (BGP > Hijacking is a RIPE Policy Violation) > Message-ID: <alpine.LRH.2.21.1903231315330.9599(a)gauntlet.corp.fccn.pt> > Content-Type: text/plain; charset="iso-8859-15"; Format="flowed" > > > On Sat, 23 Mar 2019, T?ma Gavrichenkov wrote: > > > Hi all, > > Hi, > (will try to keep it short) > > > (...) > > 1. As of now, the draft looks like a nice example of "document > > designed by a committee". > > > > It's too strict where there's no real need to be strict, and at the > > same time too weak where you don't expect it to be weak. E.g. 4 weeks > > to report + 4 weeks to investigate + 2 weeks for an appeal give us > > solid 10 weeks for an attack to stay there, which is, to put it > > gently, a substantial amount of time. > > Just two co-authors. The set will grow for proposals in other RIRs. And > we'll gladly accept help, as Jordi is doing the most of heavy lifting. > > If your issue is timescales they can be adapted in subsequent versions. > What we tried to design here was "due process" with enough "checks & > balances" embedded. > > > (...) > > 2. OTOH the ultimate result (membership cancellation) may be seen as a > > very heavy punishment. > > > > In fact in theory this policy could make things worse. > > The scenarios you and others mentioned should be run through the process > and what you call "the ultimate result" should only happen if there is > absolutely no doubt about the intent and about the 'who'. If company A > takes control of company B's router (or hires someone to do it) is already > doing something which in most jurisdictions could fall onto "crime". If > company A could be identified, then they could/should be the 'who', and > not company B. > > I won't expect this proposal will stop *all* intentional hijackers. > Firstly it will depend on a complaint/report, then it must be crystal > clear (with all the checks & balances in place) that is was intentional, > and the hijack was made by person/org X. So if you see bogus routes from > <big company name here>'s ASN coming from somewhere in the world where > they have no business, that's because someone else is (ab)using their > ASN... > > (I would also like to hear Randy's take on 2019-03, even now before > version 2) > > > (...) > > 3. If I were to design that process, I'd put it in a different way, e.g.: > > It's not explicitely written down, but yes, the idea was to have a > (pre-existing) worldwide pool of experts. The timescales were mostly > designed expecting it would be possible to build that pool on a voluntary > basis. So 4 weeks was for a set of experts to agree on the report, > possibly on their own free time... :-) > > > Best Regards, > Carlos > > ------------------------------ > > Message: 2 > Date: Sat, 23 Mar 2019 13:54:06 +0000 > From: "Sascha Luck [ml]" <aawg(a)c4inet.net> > To: JORDI PALET MARTINEZ <jordi.palet(a)consulintel.es> > Cc: anti-abuse-wg(a)ripe.net > Subject: Re: [anti-abuse-wg] 2019-03 New Policy Proposal (BGP > Hijacking is a RIPE Policy Violation) > Message-ID: <20190323135406.GO99066(a)cilantro.c4inet.net> > Content-Type: text/plain; charset=us-ascii; format=flowed > > > All, > > can I ask every participant in this discussion to PLEASE, PLEASE > quote properly. It's becoming absolutely impossible to ascertain > who wrote what and who made a statement and who answered it. > > > To brass tacks: > > On Sat, Mar 23, 2019 at 01:44:21PM +0100, JORDI PALET MARTINEZ via > anti-abuse-wg wrote: > > Immediate membership suspension at the end if the experts decide it's > > necessary to do so now. > > This is not possible under the SSA/ripe-697. Section 1.2.1.1 of > ripe-697 states clearly the grounds for termination of > membership. "BGP hijacking" is not one of them. While it is > presumably possible to add additional reasons, it will be, > TTBOMK, only by membership vote. > > I did at the start decide to give this proposal the benefit of > the doubt but I am now convinced that its intent is the > subversion of the RIPE NCC in order to force it to abuse its > dominant market position to remove from (internet) existence, > members who exhibit behaviour that, while arguably legal, > elements of this community don't like. > > Moreover, the proposal aims at doing this while largely > excluding the RIPE NCC itself from the decision-making process, > instead using some panel of "experts" to decide who should live > and who should die. Whence the authority of these "experts" > comes is not explained. The NCC Board is then, or so I surmise, > tasked with giving this decision an air of legitimacy by > ratifying it. Why the (unpaid) Board would even accept such a > questionable honour, I don't know, especially in light of the > potential liabilities. > > Further, the danger exists that this community is not done yet. > Once a mechanism to terminate unwelcome behaviour is established, > it is relatively easy to plug in any other behaviour that this > community, or elements thereof, would like to see removed from the > internet. > > In conclusio, this proposal has the potential to irredeemably > damage the relationship the NCC has with its members and I would > even argue that it has the potential to threaten the very > existence of the NCC if the powers that be decide that it is > abusing its power as a monopoly provider. > > For the avoidance of doubt, I remain in opposition, > > SL > > > > ------------------------------ > > Message: 3 > Date: Sat, 23 Mar 2019 22:26:46 +0800 > From: Lu Heng <h.lu(a)anytimechinese.com> > To: "Sascha Luck [ml]" <aawg(a)c4inet.net> > Cc: JORDI PALET MARTINEZ <jordi.palet(a)consulintel.es>, > anti-abuse-wg(a)ripe.net > Subject: Re: [anti-abuse-wg] 2019-03 New Policy Proposal (BGP > Hijacking is a RIPE Policy Violation) > Message-ID: > <CAAvCx3jaLVGJxH-KBfwsTt-gWk7v77ceDAmm= > DM0yvsO__ioMA(a)mail.gmail.com> > Content-Type: text/plain; charset="utf-8" > > On Sat, Mar 23, 2019 at 21:54 Sascha Luck [ml] <aawg(a)c4inet.net> wrote: > > > > > All, > > > > can I ask every participant in this discussion to PLEASE, PLEASE > > quote properly. It's becoming absolutely impossible to ascertain > > who wrote what and who made a statement and who answered it. > > > > > > To brass tacks: > > > > On Sat, Mar 23, 2019 at 01:44:21PM +0100, JORDI PALET MARTINEZ via > > anti-abuse-wg wrote: > > > Immediate membership suspension at the end if the experts decide > it's > > > necessary to do so now. > > > > This is not possible under the SSA/ripe-697. Section 1.2.1.1 of > > ripe-697 states clearly the grounds for termination of > > membership. "BGP hijacking" is not one of them. While it is > > presumably possible to add additional reasons, it will be, > > TTBOMK, only by membership vote. > > > > I did at the start decide to give this proposal the benefit of > > the doubt but I am now convinced that its intent is the > > subversion of the RIPE NCC in order to force it to abuse its > > dominant market position to remove from (internet) existence, > > members who exhibit behaviour that, while arguably legal, > > elements of this community don't like. > > > > Moreover, the proposal aims at doing this while largely > > excluding the RIPE NCC itself from the decision-making process, > > instead using some panel of "experts" to decide who should live > > and who should die. Whence the authority of these "experts" > > comes is not explained. The NCC Board is then, or so I surmise, > > tasked with giving this decision an air of legitimacy by > > ratifying it. Why the (unpaid) Board would even accept such a > > questionable honour, I don't know, especially in light of the > > potential liabilities. > > > > Further, the danger exists that this community is not done yet. > > Once a mechanism to terminate unwelcome behaviour is established, > > it is relatively easy to plug in any other behaviour that this > > community, or elements thereof, would like to see removed from the > > internet. > > > > In conclusio, this proposal has the potential to irredeemably > > damage the relationship the NCC has with its members and I would > > even argue that it has the potential to threaten the very > > existence of the NCC if the powers that be decide that it is > > abusing its power as a monopoly provider. > > > Very well said, +1 > > > > > > > For the avoidance of doubt, I remain in opposition, > > > > SL > > > > -- > -- > Kind regards. > Lu >

1 0