October 2021 - anti-abuse-wg - mailman.ripe.net

UCEPROTECT DNSBL possibly abusive practice and RIPEStat Blacklist entries widget
by Kristijonas Lukas Bukauskas 19 May '22

19 May '22

Hello, I noticed that RIPE NCC uses uceprotect-level1, uceprotect-level2 and uceprotect-level3 in RIPEStat Anti Abuse Blacklist Entries widget. There have been controversial positions about this blacklist recently: 1) https://success.trendmicro.com/solution/000236583-Emails-being-rejected-by-… [1] 2) https://blog.sucuri.net/2021/02/uceprotect-when-rbls-go-bad.html [2] UCEPROTECT blacklists the whole range of IP addresses, including the full IP range of some autonomous systems: UCEPROTECT states, '_Who is responsible for this listing? YOU ARE NOT! Your IP was NOT directly involved in abuse but has a bad neighborhood. Other customers within this range did not care about their security and got hacked, started spamming, or were even attacking others, while your provider has possibly not even noticed that there is a serious problem. We are sorry for you, but you have chosen a provider not acting fast enough on abusers'_) [http://www.uceprotect.net/en/rblcheck.php [3]]. It asks for a fee if some individual IP address wants to be whitelisted (http://www.whitelisted.org/), It abuses people who decide to challenge their blacklist by publishing conversations in their so-called _Cart00ney_ (http://www.uceprotect.net/en/index.php?m=8&s=0 [4]; http://www.uceprotect.org/cart00neys/index.html [5]). And the other type of threatening: http://www.uceprotect.org/ Does RIPE NCC have any position on this specific blacklist? Thank you! Links: ------ [1] https://success.trendmicro.com/solution/000236583-Emails-being-rejected-by-… [2] https://blog.sucuri.net/2021/02/uceprotect-when-rbls-go-bad.html [3] http://www.uceprotect.net/en/rblcheck.php [4] http://www.uceprotect.net/en/index.php?m=8&s=0 [5] http://www.uceprotect.org/cart00neys/index.html

16 42

RIPE Anti-Abuse WG Chair Selection @ RIPE 83
by Brian Nisbet 11 Nov '21

11 Nov '21

Colleagues, Both Alireza & Tobias' 3 year terms as AA-WG Co-Chairs will come to an end at RIPE 83. As per our current procedure this email is the start of the selection process for up to two Co-Chair positions for the WG and I would like to invite nominations (self- or otherwise) before 17:00 CET on Tuesday 16th November. More information on the process can be found here: https://www.ripe.net/participate/ripe/wg/active-wg/anti-abuse/anti-abuse-wg… Ideally Co-Chairs will be chosen by consensus within the WG, but if this cannot be managed, a vote will take place. The outcome of the process will be announced during the AA-WG session on Wednesday 24th November, between 10:30 - 12:00 CET. You can find out more about the role of WG Co-Chairs at: https://www.ripe.net/publications/docs/ripe-692 If you have any questions, or nominations, please do not hesitate to contact me. Brian Co-Chair, RIPE AA-WG Brian Nisbet (he/him) Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

2 2

Re: [anti-abuse-wg] Anti-Abuse Training: Questions for the WG
by Erik Bais 26 Oct '21

26 Oct '21

Hi Brian & AA-WG, I think that an AA automation training would be very helpful for the members. For what I had in mind is to get attendees experience with tools like Netbox (for address management among other things..), and 1 or 2 Abuse management software tools.. ( like Abuse.io or Abusix (hosted & commercial) ) I create some time ago a write up of what the training could entail ( not set in stone obviously .. ) feel free to take your own path .. https://docs.google.com/document/d/1V8yv7VmflmhJyu3jgz3R63YWNdhKKKaP8LEs25Z… Once people see how easy it is to move away from excel sheets for IP address management .. and see the benefits of off-the-shelves products .. and how this could help them in their daily work, I'm sure that we will be in a better place in the future. So a big +1 from me on any training for the NCC members on training on this subject. Regards, Erik Bais On 15/10/2021, 11:15, "anti-abuse-wg on behalf of Brian Nisbet" <anti-abuse-wg-bounces(a)ripe.net on behalf of brian.nisbet(a)heanet.ie> wrote: Colleagues, As you may remember the WG Co-Chairs have been talking to the NCC about some possible Anti-Abuse training in March of this year. This proposal got very little reaction from the community, so we are going to try again to see if there is interest, or if people who are already on this mailing list believe that there would be interest from other LIRs that they know. I have re-attached the proposal that Alireza sent to the mailing list in March. Between now and RIPE 83 (when this matter will be on the WG session agenda) I would ask the following questions: 1) Would training, as described, be of interest to you? 2) Would training, as described, be of interest to other LIRs you know of/work with? 3) If not, would there be other areas of Anti-Abuse training that would be of interest? 4) Would you be willing to help write training materials for this course? After the list discussion and discussion at RIPE 83 the Co-Chairs will work with the NCC Learning & Development Team to decide if there is enough interest to develop the course and, if there is, how to proceed from there. We really do believe this is something that would be of interest to a large number of small LIRs in the region, but that's not something we can really determine without the help of the WG Thank you, Brian Co-Chair, RIPE AA-WG Brian Nisbet (he/him) Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

3 2

New on RIPE Labs: The Role of Service Providers in Transforming Security
by Alun Davies 25 Oct '21

25 Oct '21

Dear colleagues, In this new guest post on RIPE Labs, Kathleen Moriarty talks about how service providers can help improve Internet security. Even though taking measures in this area can require a lot of effort, Kathleen shows why doing so is very much worthwhile: https://labs.ripe.net/author/kathleen_moriarty/the-role-of-service-provider… Kind regards, Alun Davies RIPE Labs Editor RIPE NCC

1 0

Anti-Abuse Training: Questions for the WG
by Brian Nisbet 24 Oct '21

24 Oct '21

Colleagues, As you may remember the WG Co-Chairs have been talking to the NCC about some possible Anti-Abuse training in March of this year. This proposal got very little reaction from the community, so we are going to try again to see if there is interest, or if people who are already on this mailing list believe that there would be interest from other LIRs that they know. I have re-attached the proposal that Alireza sent to the mailing list in March. Between now and RIPE 83 (when this matter will be on the WG session agenda) I would ask the following questions: 1) Would training, as described, be of interest to you? 2) Would training, as described, be of interest to other LIRs you know of/work with? 3) If not, would there be other areas of Anti-Abuse training that would be of interest? 4) Would you be willing to help write training materials for this course? After the list discussion and discussion at RIPE 83 the Co-Chairs will work with the NCC Learning & Development Team to decide if there is enough interest to develop the course and, if there is, how to proceed from there. We really do believe this is something that would be of interest to a large number of small LIRs in the region, but that's not something we can really determine without the help of the WG Thank you, Brian Co-Chair, RIPE AA-WG Brian Nisbet (he/him) Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

8 9

Re: [anti-abuse-wg] Abuse address checking
by Ángel González Berdasco 17 Oct '21

17 Oct '21

Lol, a vacation autoreply to pass RIPE email address validation. 🤭 It kinda misses the point if they don't read them as well. -- INCIBE-CERT - Spanish National CSIRT https://www.incibe-cert.es/ PGP keys: https://www.incibe-cert.es/en/what-is-incibe-cert/pgp-public-keys ==================================================================== INCIBE-CERT is the Spanish National CSIRT designated for citizens, private law entities, other entities not included in the subjective scope of application of the "Ley 40/2015, de 1 de octubre, de Régimen Jurídico del Sector Público", as well as digital service providers, operators of essential services and critical operators under the terms of the "Real Decreto-ley 12/2018, de 7 de septiembre, de seguridad de las redes y sistemas de información" that transposes the Directive (EU) 2016/1148 of the European Parliament and of the Council of 6 July 2016 concerning measures for a high common level of security of network and information systems across the Union. ==================================================================== In compliance with the General Data Protection Regulation of the EU (Regulation EU 2016/679, of 27 April 2016) we inform you that your personal and corporate data (as well as those included in attached documents); and e-mail address, may be included in our records for the purpose derived from legal, contractual or pre-contractual obligations or in order to respond to your queries. You may exercise your rights of access, correction, cancellation, portability, limitation of processing and opposition under the terms established by current legislation and free of charge by sending an e-mail to dpd(a)incibe.es<mailto:dpd@incibe.es>. The Data Controller is S.M.E. Instituto Nacional de Ciberseguridad de España, M.P., S.A. More information is available on our website: https://www.incibe.es/proteccion-datos-personales and https://www.incibe.es/registro-actividad. ====================================================================

1 0

Abuse address checking
by Alessandro Vesely 17 Oct '21

17 Oct '21

Hi, it is rather common to find auto-responders at abuse addresses. For this one, however, it took me a minute to understand its intent, Best Ale -------- Forwarded Message -------- Subject: Confirmacion para RIPE Date: Sun, 17 Oct 2021 04:32:32 +0200 To: abuse(a)tana.it Auto-Submitted: auto-replied (vacation) OK, me llegan los correos!!.....

1 0

Reminder: Call for Agenda Items RIPE 83
by Brian Nisbet 13 Oct '21

13 Oct '21

Colleagues, As you're all hopefully aware the next RIPE meeting will be taking place, somewhere on the Internet, from the 22nd - 26th November this year. https://ripe83.ripe.net The Anti-Abuse WG will be meeting and Alireza, Tobias and I would invite people to submit topics for discussion, presentations for general enlightenment and, of course, work items for the working group. The session is currently scheduled for Wednesday 24th, but the date and time may both change as the various agendas fill up, we'll keep you posted. As always you can reach us at aa-wg-chair(a)ripe.net Thank you, Brian Co-Chair, RIPE AA-WG Brian Nisbet (he/him) Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

1 0

Re: [anti-abuse-wg] [aa-wg-chair] RIPE WG Introduction Videos
by Brian Nisbet 12 Oct '21

12 Oct '21

Kjerstin, 15:00 CET on the 28th looks good to me, thanks. Brian Brian Nisbet (he/him) Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270 ________________________________ From: Kjerstin Burdiek <kburdiek(a)ripe.net> Sent: Tuesday 12 October 2021 16:09 To: Brian Nisbet <brian.nisbet(a)heanet.ie> Subject: Re: [aa-wg-chair] RIPE WG Introduction Videos CAUTION[External]: This email originated from outside of the organisation. Do not click on links or open the attachments unless you recognise the sender and know the content is safe.

1 0