November 2021 - anti-abuse-wg

UCEPROTECT DNSBL possibly abusive practice and RIPEStat Blacklist entries widget
by Kristijonas Lukas Bukauskas 19 May '22

19 May '22

Hello, I noticed that RIPE NCC uses uceprotect-level1, uceprotect-level2 and uceprotect-level3 in RIPEStat Anti Abuse Blacklist Entries widget. There have been controversial positions about this blacklist recently: 1) https://success.trendmicro.com/solution/000236583-Emails-being-rejected-by-… [1] 2) https://blog.sucuri.net/2021/02/uceprotect-when-rbls-go-bad.html [2] UCEPROTECT blacklists the whole range of IP addresses, including the full IP range of some autonomous systems: UCEPROTECT states, '_Who is responsible for this listing? YOU ARE NOT! Your IP was NOT directly involved in abuse but has a bad neighborhood. Other customers within this range did not care about their security and got hacked, started spamming, or were even attacking others, while your provider has possibly not even noticed that there is a serious problem. We are sorry for you, but you have chosen a provider not acting fast enough on abusers'_) [http://www.uceprotect.net/en/rblcheck.php [3]]. It asks for a fee if some individual IP address wants to be whitelisted (http://www.whitelisted.org/), It abuses people who decide to challenge their blacklist by publishing conversations in their so-called _Cart00ney_ (http://www.uceprotect.net/en/index.php?m=8&s=0 [4]; http://www.uceprotect.org/cart00neys/index.html [5]). And the other type of threatening: http://www.uceprotect.org/ Does RIPE NCC have any position on this specific blacklist? Thank you! Links: ------ [1] https://success.trendmicro.com/solution/000236583-Emails-being-rejected-by-… [2] https://blog.sucuri.net/2021/02/uceprotect-when-rbls-go-bad.html [3] http://www.uceprotect.net/en/rblcheck.php [4] http://www.uceprotect.net/en/index.php?m=8&s=0 [5] http://www.uceprotect.org/cart00neys/index.html

16 42

RIPE 83: Anti-Abuse Working Group Minutes
by Tobias Knecht 30 Nov '21

30 Nov '21

Hello, first of all thanks again to all attendees of the Anti-Abuse Working Group Session and a special thanks to the presenters and the amazing people that put our Minutes together. Speaking of Minutes, please find attached the Minutes of last week's Working Group Session and let us know if you have any additions or clarifications before December the 7th. Thanks, Tobias

1 0

FYI: a new anti-abuse automation project will be starting soon
by L. Aaron Kaplan 23 Nov '21

23 Nov '21

Dear Anti-Abuse WG, As already mentioned to Brian and the WG chairs in a private mail, I would like to raise your attention towards a new initiative that I will be pursuing in 2022: an open source abuse handling automation tool for smaller network operators. Thanks to the RIPE CPF it got some initial funding. Here is the RIPE CPF summary: Project abstract ---------------- ``` Open Source Automatic Incident Report Handling and Response Tool for RIPE Members RIPE members range from large network operators to small or even very small networks (the “long tail”). Common to all of them, is that they have publicly routed and active IP addresses and devices which are reachable from the Internet. With Internet-wide scanning tools (shodan, etc.), any vulnerable device is discoverable with a click of a button for any malicious actor. While large network operators can spend a lot on IT security-incidence response (IR), network hygiene and incident report handling, smaller ones can’t. In our experience, these smaller networks very selectively deal with IR. Many of the reports sent by national CERTs are ignored due to the lack of personnel, skills or resources. The effect being that Internet hygiene is suboptimal in the long tail. Which in turn, creates more hacked devices, DDoS amplifiers, etc. and poses more threats to the global network. Our project aims at bringing the best of breed open-source technology as a turn-key package to the “long tail” networks to plug into their customer contacts database (CRM) system on the one side and to the global feeds of threat intelligence and scanning alerts (such as shadowserver.org). Automate the IR, improve network hygiene! ``` (Source: https://www.ripe.net/support/cpf/funding-recipients-2021) Rest assured, I am aware of all the good work done at this WG and at abuse.io and abusix. Not trying to re-invent the wheel, no worries :) About myself and motivation for this project -------------------------------------------- I have been working at a European national CERT for 12 years and am one of the two co-founders of the https://intelmq.org Incident Response (IR) automation project. IntelMQ is mainly geared towards the "information router" role of national CERTs. Less so for network operators. What struck me during that time at the national CERT is that there is a wide variation between how some network operators clean up after abuse reports, and some do the bare minimum (no accusation here!). Even though good tools such as abusix would exist for them. So, the question is: *why* is that so? There must be a good reason for it. And this leads me to the project motivation. The first part of this project shall analyse, *why* and *how many* of the abuse notifications are not done. Is it the network operator? Is it the end-customer? Is it culture? Is it lack of resources? Is it the (economic) network externalities? Is it all of the above? I believe, once we identify some of the blockers, we can *improve* existing solutions, add to the portfolio of existing solutions and/or combine them into a packages which might actually do the next step without much effort. Ideally, abusix, abuseio, intelmq, n6, warden, ... (all these tools which help in IR for network operators) would get a boost by this project AND the network operators get improved tools.[1] Request for your help --------------------- Since this is an open source project, I would like to reach out to anyone here who is interested and start collecting some initial quantitative interviews with you on the questions (the "why?" questions) above (interviews will start in mid-Dec). In parallel, I'll be doing some lit.research on the topic. I'd be thrilled to have the combined knowledge of the WG as part of this project. After all, the problem we are trying to solve is similar to tackling pollution or climate change (just - for the internet): it's a super hard problem. Lots of externalities, lots of hard nuts to crack and for sure no-one can solve this problem on his/her own. Thanks for your time, reading this. Aaron Kaplan. PS: I probably can't make it to tomorrow's Anti-Abuse WG session (I have parallel calls which I can't skip). But I'd appreciate you reaching out to me via email. In in the WG session tomorrow you could mention this little project of mine, I'd be quite happy about that. [1] I am very aware that with limited funding and an infinitely, arbitrarily large problem, we won't be able to tackle all of it in this small project. But we can try and add the our global anti-abuse capabilities. Hence, I am reaching out to this WG for input and advice.

1 0

RIPE Database Purposes - Video presentation
by denis walker 23 Nov '21

23 Nov '21

Colleagues In advance of my presentations tomorrow, if you have a spare 15 minutes please watch the pre-recorded presentation: https://ripe83.ripe.net/wp-content/uploads/presentations/DB_WG-Denis_Walker… cheers denis co-chair DSB-WG

1 0

Agenda Update - RIPE 83
by Brian Nisbet 22 Nov '21

22 Nov '21

Colleagues, A small addition to our agenda for Wednesday 24th (session starting at 10:30 CET) about the RIPE DB. And while the closing date for nominations has passed, if anyone has a sudden interest in putting themselves forward as a potential Co-Chair of the WG, then please do email me before Wednesday morning! A. Administrative Matters * Welcome * Scribe, Chat, Stenography * Chat Etiquette * Ratings Where Appropriate * Approve Minutes from RIPE 82 * Finalise agenda * Working Group Chair Selection B. Update * B1. Recent List Discussion C. Policies - *C.1. D. Interactions - *D.1. RIPE NCC Abuse Handling Training (15' - 20') *D.2. RIPE RIPE Database Purposes in the 2020s and Beyond - Denis Walker E. Presentation - *E.1. *E.1. "The Hijackers Guide to the Galaxy: Off-path Taking over Internet Resources" - Tianxiang Dai, Technische Universität Darmstadt X. A.O.B. Z. Agenda for RIPE 84 Thanks, Brian Co-Chair, RIPE AA-WG Brian Nisbet (he/him) Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

1 0

Re: [anti-abuse-wg] Is there any analysis on root causes of mail account break-ins?
by Natale Maria Bianchi 17 Nov '21

17 Nov '21

Almost 10 years ago I wrote this short blog article with some ideas arising from the examination of a fairly large numbers of incidents: https://www.spamhaus.org/news/article/681/spam-through-compromised-password… I think that it is basically still quite current, except for some GDPR-related aspects, and although the last sentence was clearly, well, a little too optimistic. Unfortunately MSAs did not evolve as fast as we hoped, and several organisations continue to allow compromised accounts to start sending with astounding intensities. Natale M Bianchi

1 0

Is there any analysis on root causes of mail account break-ins?
by Hans-Martin Mosner 17 Nov '21

17 Nov '21

Hi folks, I'm trying to understand the root causes and vulnerabilities that lead to hacked mailboxes. Currently, we can handle dynamic IP ranges pretty well, and we have an extensive list of network ranges whose owner are spammers or knowingly accept spammers as customers. So what mainly remains as spam sources are hacked servers/websites, hacked mail accounts, and freemail accounts registered with the purpose of spamming (I'm looking at you, Google). Here I want to focus on hacked mail accounts. I can think of two major root causes but I have no idea about their relative significance: * Easily guessable passwords, with two subcauses for exploits: o Brute force authentication attempts - I'm seeing them regularly, and the most egregious networks (e.g. 5.188.206.0/24) are fully blocked at our mailserver, but some mailops are less struct about blocking such abusers. o Hashed password data exfiltration and cracking (for example using JtR) these lists - this would work better with weaker password hashing, but with weak passwords and some CPU power it is probably possible even for strong hash algorithms. * Malware on client machines where passwords are either stored in a password vault, or entered manually. My gut feeling is that some organizations are especially prone to hacked mail accounts. We're seeing lots of south american government agency users, and many accounts at educational institutions. The latter are often hosted using Microsoft O365 services, and I highly suspect that weak passwords for all the freshly created student accounts may be a major cause, although exfiltrated password data may be a possibility, too. So does anyone have pointers to studies analyzing these (and probably more) causes of exploited mail accounts? Cheers, Hans-Martin

4 3

Call For Co-Chair Nominations & Updated Agenda: RIPE 83 AA-WG Session
by Brian Nisbet 15 Nov '21

15 Nov '21

Colleagues, With the initial deadline for nominations for Co-Chairs arriving tomorrow, I wanted to let you all know that we have had one nomination so far. Numerically this is enough, but I would encourage those who have an interest in the sustainability, growth & evolution of the Anti-Abuse WG to consider putting themselves forward. You can send your nominations directly to me - brian.nisbet(a)heanet.ie In other news, we have an update for the draft agenda for our session next week, but I would note that there is still available time if anyone has any last minute entries. A. Administrative Matters * Welcome * Scribe, Chat, Stenography * Chat Etiquette * Ratings Where Appropriate * Approve Minutes from RIPE 82 * Finalise agenda * Working Group Chair Selection B. Update * B1. Recent List Discussion D. Interactions *D.1. RIPE NCC Abuse Handling Training E. Presentations *E.1. "The Hijackers Guide to the Galaxy: Off-path Taking over Internet Resources" - Tianxiang Dai, Technische Universität Darmstadt X. A.O.B. Z. Agenda for RIPE 84 Brian Nisbet (he/him) Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

1 0

RIPE Anti-Abuse WG Chair Selection @ RIPE 83
by Brian Nisbet 11 Nov '21

11 Nov '21

Colleagues, Both Alireza & Tobias' 3 year terms as AA-WG Co-Chairs will come to an end at RIPE 83. As per our current procedure this email is the start of the selection process for up to two Co-Chair positions for the WG and I would like to invite nominations (self- or otherwise) before 17:00 CET on Tuesday 16th November. More information on the process can be found here: https://www.ripe.net/participate/ripe/wg/active-wg/anti-abuse/anti-abuse-wg… Ideally Co-Chairs will be chosen by consensus within the WG, but if this cannot be managed, a vote will take place. The outcome of the process will be announced during the AA-WG session on Wednesday 24th November, between 10:30 - 12:00 CET. You can find out more about the role of WG Co-Chairs at: https://www.ripe.net/publications/docs/ripe-692 If you have any questions, or nominations, please do not hesitate to contact me. Brian Co-Chair, RIPE AA-WG Brian Nisbet (he/him) Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

2 2

RIPE 83 Draft Agenda & Final Call For Content
by Brian Nisbet 03 Nov '21

03 Nov '21

Colleagues, We have a draft agenda for RIPE 83. The AA-WG session will be taking place on Wednesday 24th November. We do still have "spare" time on the agenda, so if you have any items you would like to present to the working group, then please do contact aa-wg-chair(a)ripe.net I would also repeat my call for anyone who may be interested in putting themselves forward for one of the two Co-Chair positions that are up for selection at RIPE 83. A. Administrative Matters * Welcome * Scribe, Chat, Stenography * Chat Etiquette * Ratings Where Appropriate * Approve Minutes from RIPE 82 * Finalise agenda * Working Group Chair Selection B. Update * B1. Recent List Discussion D. Interactions - *D.1. RIPE NCC Abuse Handling Training X. A.O.B. Z. Agenda for RIPE 84 Thanks, Brian Co-Chair, RIPE AA-WG Brian Nisbet (he/him) Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

1 0