July 2020 - anti-abuse-wg - mailman.ripe.net

2019-04 Review Phase (Validation of "abuse-mailbox")
by Petrit Hasani 22 Jul '20

22 Jul '20

Dear colleagues, Policy proposal 2019-04, "Validation of "abuse-mailbox"", is now in the Review Phase. This proposal aims to have the RIPE NCC validate "abuse-c:” information more often and introduces a new validation process. The RIPE NCC has prepared an impact analysis to support the community’s discussion. You can find the proposal and impact analysis at: https://www.ripe.net/participate/policies/proposals/2019-04 https://www.ripe.net/participate/policies/proposals/2019-04#impact-analysis And the draft documents at: https://www.ripe.net/participate/policies/proposals/2019-04/draft As per the RIPE Policy Development Process (PDP), the purpose of this four week Review Phase is to continue discussion of the proposal, taking the impact analysis into consideration, and to review the full draft RIPE Policy Document. At the end of the Review Phase, the working group chairs will determine whether the WG has reached rough consensus. It is therefore important to provide your opinion, even if it is simply a restatement of your input from the previous phase. We encourage you to read the proposal, impact analysis and draft document and send any comments to <anti-abuse-wg(a)ripe.net> before 18 August 2020. Kind regards, -- Petrit Hasani Policy Officer RIPE NCC

5 10

First Call For Agenda Items - AA-WG @ RIPE81
by Brian Nisbet 16 Jul '20

16 Jul '20

Colleagues, RIPE 81 will be taking place somewhere on the Internet from the 27th - 30th October 2020. https://ripe81.ripe.net The Anti-Abuse WG will be meeting and Alireza, Tobias and I would invite people to submit topics for discussion, presentations for general enlightenment and, of course, work items for the working group. The session will likely be short as per RIPE80, but we'll confirm that closer to the time. As always you can reach us at aa-wg-chair(a)ripe.net Thanks, Brian Co-Chair, RIPE AA-WG Brian Nisbet Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

1 0

Re: [anti-abuse-wg] Fwd: Re: botnet controllers
by Serge Droz 11 Jul '20

11 Jul '20

Hello @Moderators Can you please suspend this participant? I take offense at this. We may disagree on issues and opinions. However I feel there is no space for name calling. Best regards Serge On 09.07.20 15:16, Elad Cohen wrote: > Michele how more bigger asshole you can be to be the puppet of spamhaus > so you will be able monetize your connections with them to more $$$ > > You are a loser and you are a disgraceful businessman and you are a > disgrace to the whole internet community > ------------------------------------------------------------------------ > *From:* anti-abuse-wg <anti-abuse-wg-bounces(a)ripe.net> on behalf of > Michele Neylon - Blacknight <michele(a)blacknight.com> > *Sent:* Thursday, July 9, 2020 4:02 PM > *To:* Serge Droz <serge.droz(a)first.org>; anti-abuse-wg(a)ripe.net > <anti-abuse-wg(a)ripe.net> > *Subject:* Re: [anti-abuse-wg] Fwd: Re: botnet controllers > > +1 on all points > > That someone who won't even disclose who they are has the gall to demand > that Spamhaus or anyone else should is hilarious and disturbing. > > > > -- > Mr Michele Neylon > > Blacknight Solutions > > Hosting, Colocation & Domains > > https://www.blacknight.com > https://blacknight.blog / > > http://ceo.hosting/ > > Intl. +353 (0) 59 9183072 > > Direct Dial: +353 (0)59 9183090 > > ------------------------------- > > Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park, > Sleaty Road, Graiguecullen, Carlow, R93 X265,Ireland Company No.: 370845 > > On 09/07/2020, 07:30, "anti-abuse-wg on behalf of Serge Droz via > anti-abuse-wg" <anti-abuse-wg-bounces(a)ripe.net on behalf of > anti-abuse-wg(a)ripe.net> wrote: > > Hi Info > > Maybe one of the reasons some Non-logging VPNs end up on blacklist sis > that the Non-Looging phrase is just an excuse to not go after misuse. > The rights to privacy and free speech do not mean anything goes. > > You can fight abuse without violating privacy. But of course that's not > for free, you need abuse people that investigate and they cost money. > Sadly, many of these VPNs frankly just don't care, using the lame excuse > that they are protecting fundamental rights, when in fact they are just > don't care or take responsibility. > > I don't agree with everything Spamhaus does, but I find them responsible > and and always found a way way to talk to them. > > I was reluctant writing this, because I'm not sure this discussion will > lead anywhere. It's one of these where opinions seem to already have > been formed. > > But you start accusing people of posting anonymously. I totally agree > this is bad, but then, who are you, info(a)fos-vpn.org? > > You don't seem to offer a name yourself. I find this a bit hypocritical. > > Best > Serge > > > On 08.07.20 20:46, info(a)fos-vpn.org wrote: > > All I would like from Spamhaus is to stop publishing fake SBL > records in > > order to discredit us and to use that to put pressure both upon us and > > our upstreams. > > Non-logging VPN services are as legal within the EU as Exit Nodes > of the > > Tor Network (which have massive abuse entries in various data bases, > > especially the larger ones) and public WiFi Hotspots, which can be > used > > for abusive activities, too. > > > > I don't know who "PP" is (probably the same person which posts > under the > > nickname "Petras Simeon" on Twitter and on various boards), but he > > contacted us and our upstream providers without telling his name, just > > using this email address: phishphucker(a)storey.ovh and sending us the > > list of SBL entries which he also posted here. > > Don't know if he's working for Spamhaus or not, but before attacking > > others publicly, people should reveal their true identity, > anything else > > would be sneaky in my opinion. > > > > -- > Dr. Serge Droz > Chair of the FIRST Board of Directors > https://www.first.org > > -- Dr. Serge Droz Chair of the FIRST Board of Directors https://www.first.org

11 18

New on RIPE Labs: Help to Understand Secure Email Around the Globe
by Mirjam Kuehne 10 Jul '20

10 Jul '20

Dear colleagues, Olamide Omolola and Tobias Fiebig are studying the degree to which email systems are configured securely. And they need your help: they want to receive emails from as many different mail providers around the world as possible. You can find more details in this RIPE Labs article: https://labs.ripe.net/Members/mirjam/help-to-understand-secure-email-around… Kind regards, Mirjam Kühne RIPE Labs Editor

1 0

Fwd: Re: botnet controllers
by info＠fos-vpn.org 09 Jul '20

09 Jul '20

All I would like from Spamhaus is to stop publishing fake SBL records in order to discredit us and to use that to put pressure both upon us and our upstreams. Non-logging VPN services are as legal within the EU as Exit Nodes of the Tor Network (which have massive abuse entries in various data bases, especially the larger ones) and public WiFi Hotspots, which can be used for abusive activities, too. I don't know who "PP" is (probably the same person which posts under the nickname "Petras Simeon" on Twitter and on various boards), but he contacted us and our upstream providers without telling his name, just using this email address: phishphucker(a)storey.ovh and sending us the list of SBL entries which he also posted here. Don't know if he's working for Spamhaus or not, but before attacking others publicly, people should reveal their true identity, anything else would be sneaky in my opinion.

8 8

Helping EU identify BGP Hijacking as a risk
by CSIRT.UMINHO Marco Teixeira 09 Jul '20

09 Jul '20

Hello fellow members, I will take the chance to also thank Angel for bringing this to our attention. It seems "regulation" is coming... I wonder if "BGP Hijacking" poses a risk to "the safety and rights of users or the rights of companies to compete in a fair market". I guess so, and I urge all that feel the same, to participate in this public consultation: hXXps://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/12417-Digital-Services-Act-deepening-the-Internal-Market-and-clarifying-responsibilities-for-digital-services/public-consultation Wouldn't it be great if transit providers registered in the EU, or selling to EU companies, were obliged (regulated) to implement RPKI? Maybe we could even have the EU "add a routing regulator role to the RIPE NCC"! :) Regards, Marco De: anti-abuse-wg <anti-abuse-wg-bounces(a)ripe.net> Em nome de Brian Nisbet Enviada: 9 de julho de 2020 10:16 Para: Angel Fernandez Pineda <anfernandez(a)grupogodo.com>; anti-abuse-wg(a)ripe.net Assunto: Re: [anti-abuse-wg] Fwd: Re: botnet controllers Angel, Thank you for this, a very useful prompt! Brian Brian Nisbet Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 mailto:brian.nisbet@heanet.ie http://www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270 ________________________________________ From: anti-abuse-wg <mailto:anti-abuse-wg-bounces@ripe.net> on behalf of Angel Fernandez Pineda <mailto:anfernandez@grupogodo.com> Sent: Thursday 9 July 2020 08:16 To: mailto:anti-abuse-wg@ripe.net <mailto:anti-abuse-wg@ripe.net> Subject: Re: [anti-abuse-wg] Fwd: Re: botnet controllers CAUTION[External]: This email originated from outside of the organisation. Do not click on links or open the attachments unless you recognise the sender and know the content is safe. Hi, I would like to make a recommendation to all of you. The EU has opened a consultation on the Digital Service Act, a future regulation that aims to review the role of digital platforms and technoly intermediaries and establish regulations to protect the rights of users and companies that operate online wherever is required. Of course, the role of ISPs or organizations like RIPE NCC can be subject to asses. The aim of the European Commission with the consultation is to identify situations that put at risk the safety and rights of users or the rights of companies to compete in a fair market. To those of you who know that this discussion, repeated so many times in this WG, will not reach to anything, I would like to invite you to dedicate a little of your time to answering the consultation. You will find it at: https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fec.europa… Best, ángel Grupo Godó de Comunicación ________________________________________ De: anti-abuse-wg <mailto:anti-abuse-wg-bounces@ripe.net> en nombre de Serge Droz via anti-abuse-wg <mailto:anti-abuse-wg@ripe.net> Enviado: jueves, 9 de julio de 2020 8:29 Para: mailto:anti-abuse-wg@ripe.net <mailto:anti-abuse-wg@ripe.net> Asunto: Re: [anti-abuse-wg] Fwd: Re: botnet controllers Hi Info Maybe one of the reasons some Non-logging VPNs end up on blacklist sis that the Non-Looging phrase is just an excuse to not go after misuse. The rights to privacy and free speech do not mean anything goes. You can fight abuse without violating privacy. But of course that's not for free, you need abuse people that investigate and they cost money. Sadly, many of these VPNs frankly just don't care, using the lame excuse that they are protecting fundamental rights, when in fact they are just don't care or take responsibility. I don't agree with everything Spamhaus does, but I find them responsible and and always found a way way to talk to them. I was reluctant writing this, because I'm not sure this discussion will lead anywhere. It's one of these where opinions seem to already have been formed. But you start accusing people of posting anonymously. I totally agree this is bad, but then, who are you, mailto:info@fos-vpn.org? You don't seem to offer a name yourself. I find this a bit hypocritical. Best Serge On 08.07.20 20:46, mailto:info@fos-vpn.org wrote: > All I would like from Spamhaus is to stop publishing fake SBL records in > order to discredit us and to use that to put pressure both upon us and > our upstreams. > Non-logging VPN services are as legal within the EU as Exit Nodes of the > Tor Network (which have massive abuse entries in various data bases, > especially the larger ones) and public WiFi Hotspots, which can be used > for abusive activities, too. > > I don't know who "PP" is (probably the same person which posts under the > nickname "Petras Simeon" on Twitter and on various boards), but he > contacted us and our upstream providers without telling his name, just > using this email address: mailto:phishphucker@storey.ovh and sending us the > list of SBL entries which he also posted here. > Don't know if he's working for Spamhaus or not, but before attacking > others publicly, people should reveal their true identity, anything else > would be sneaky in my opinion. > -- Dr. Serge Droz Chair of the FIRST Board of Directors https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.first…

1 0

Fwd: Re: botnet controllers
by info＠fos-vpn.org 08 Jul '20

08 Jul '20

Please allow me to comment on this on behalf of the VPN services affected by the accusations: https://www.ripe.net/participate/mail/forum/anti-abuse-wg/PDRhZGNmYmVmLTNmM… When you run a VPN service it simply lies in the nature of things that some miscreants buy accounts which lead to various types of complaints. Our principle is not to serve the bad, but the good! We checked all SBL listings in the past and found out that most of them were simply invalid. Our removal requests were all ignored by Spamhaus, refusing any communication with us. The problem with Spamhaus is that they can do whatever they want and nearly everyone follows them. After starting legal actions in the UK against them based on their wrong accusations they moved their headquarters to Andorra, using the address of a hospital located there. Earlier on a person we know very well tried the same in Switzerland and found out that they are not even registered there; they just rented some offices from Regus in Geneva. Unlike other services such as BitNinja or Blocklist, Spamhaus has no real imprint on its website. All those names such as Thomas Morrison, Pete Dawes or Vincent Hanna are fake identities. Except a few insiders nobody knows who's behind that company, which claims to be nonprofit. It is true that VPN services which don't log any user activities attract people with bad intentions and believe me: We are not happy about that either...but we have to live with that. To us it seemed that it became a real passion of Mr. Steve Linford to destroy non-logging VPN providers; providers which are needed in countries like Iran or China to protect the freedom of speech (we have a lot of customers there). More than 90 per cent of all VPN providers don't allow any Port Forwarding, but closing all Ports would be a kind of censorship in our opinion. We do have our ToS which don't allow any misuse of our service, but we have no control over the actions of our users whatsoever. I know that most of you won't be satisfied with that answer, but this is how we see things from our perspective.

4 5

Fwd: Re: botnet controllers
by info＠fos-vpn.org 08 Jul '20

08 Jul '20

@Jordi Palet Martinez: If Spamhaus would just list IP addresses we wouldn't mind that. The reality is different though. We brought a /24 prefix to a certain hosting provider which I don't want to name here and a few weeks after that Spamhaus listed the other clean prefixes of that company (which have no direct connection to our IPs) on SBL. The result was that all other customers were unable to sent any emails. The company had to refund them, resulting in a financial damage of more than 7000 Euros. There is no way to prevent this, because right after legal actions were taken in the United Kingdom by one of our upstream partners they moved their companys' headquarters to Andorra, which is outside the EU. Spamhaus is no legal entity, but they behave like one. They can do that because during recent years they gained an enormous power: Most email providers take their lists without any question, so if they want they can destroy an entire hosting provider, and if you want to take legal actions against them you need to find a law firm which is active in Andorra. Why don't they reveal their identities like BitNinja does in its imprint? Then all parties could present their evidence in court.

2 1

[Fwd: Re: Fwd: Re: botnet controllers]
by Alex de Joode 08 Jul '20

08 Jul '20

Jordi, Transparency and accountability are key for services that act like a combined privatised police, court and penal force. Unfortunately Spamhaus does not deliver in that department. While the service certainly has merit, they sometimes feels warranted to enforce policies that hurt legal and valid business models like unmanaged hosting and cloud services, vpn's or tor-exits just to name a few. Judge, Jury and Executioner are 3 distinct roles in western democraties, this is for a reason. As a lot of organisations use Spamhaus, this means they have a fudiciary obligation to have clearand targetted policies, a speedy and transparant complaints procedure and they need to provide some form of arbitrage, just to ensure personal issues and preferences are not a factor. To describe Spamhaus usage as "It is up to each individual or organization to use them or not." fundamentally mislabels their position in the abuse handling ecosystem. (it is a bit like arguing we have a working abuse@ mail address, but do not handle abuse at all) -- IDGARA | Alex de Joode | alex(a)idgara.nl | +31651108221 | Skype:adejoode On Wed, 08-07-2020 15h 08min, JORDI PALET MARTINEZ via anti-abuse-wg <anti-abuse-wg(a)ripe.net> wrote: > In a couple of occasions (many years ago), some of the IPs under my responsibility, were listed at spamhaus. I contacted them and got delisted, no problem. Of course, after that I took measures so my IP addresses are never involved even by accident, in any "bad" activity: it is my duty. > > My conclusion is that it offers a good service, which I can use or not, it is my decision. > > I think services such as spamhaus are good, and I don't know if legally they need to be "registered". I could, as a natural person, so no need for registration if is not a business (no incomes), make this kind of service, for free, and for privacy reasons, and understanding that I may be damaging high-level criminal activities, seek my personal and family protection by not disclosing my real data. > > I don't think there is nothing wrong about that, because I'm not "forcing" anyone to trust my service or use it, or anything similar. It is up to each individual or organization to use them or not. > > If ISP a, b, and c, are abusing my network in any way, and I decide to create a public web page to list them, if I can keep the demonstration of that, there is no court that can tell me "you're doing something illegal". I'm just telling the world "those guys have abused my network, you can use it to filter them to avoid having the same trouble", and I can do that I an anonymous way. > > That said, I think it is a bad excuse to say that there is no login to protect freedom of speech. You can do login but not provide that data to "bad" governments. Only if your own country LEA ask for it, because there was a criminal activity on that connection you will need to provide the data. This is the same for *any* other service. I can't agree that VPN's are a different thing. > > Note that I'm not trying to say if this or that service is good or bad, but to say that rules are made for all. > > Regards, > Jordi > @jordipalet >

2 1

Draft Minutes - AA-WG @ RIPE80
by Brian Nisbet 07 Jul '20

07 Jul '20

Colleagues, Please find attached the draft minutes from our working group session at RIPE 80. Could you let the Co-Chairs know, by Friday 17th July, if there are any errors or omissions? Thanks, Brian Co-Chair, RIPE AA-WG Brian Nisbet Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

4 4