September 2021 - anti-abuse-wg

UCEPROTECT DNSBL possibly abusive practice and RIPEStat Blacklist entries widget
by Kristijonas Lukas Bukauskas 19 May '22

19 May '22

Hello, I noticed that RIPE NCC uses uceprotect-level1, uceprotect-level2 and uceprotect-level3 in RIPEStat Anti Abuse Blacklist Entries widget. There have been controversial positions about this blacklist recently: 1) https://success.trendmicro.com/solution/000236583-Emails-being-rejected-by-… [1] 2) https://blog.sucuri.net/2021/02/uceprotect-when-rbls-go-bad.html [2] UCEPROTECT blacklists the whole range of IP addresses, including the full IP range of some autonomous systems: UCEPROTECT states, '_Who is responsible for this listing? YOU ARE NOT! Your IP was NOT directly involved in abuse but has a bad neighborhood. Other customers within this range did not care about their security and got hacked, started spamming, or were even attacking others, while your provider has possibly not even noticed that there is a serious problem. We are sorry for you, but you have chosen a provider not acting fast enough on abusers'_) [http://www.uceprotect.net/en/rblcheck.php [3]]. It asks for a fee if some individual IP address wants to be whitelisted (http://www.whitelisted.org/), It abuses people who decide to challenge their blacklist by publishing conversations in their so-called _Cart00ney_ (http://www.uceprotect.net/en/index.php?m=8&s=0 [4]; http://www.uceprotect.org/cart00neys/index.html [5]). And the other type of threatening: http://www.uceprotect.org/ Does RIPE NCC have any position on this specific blacklist? Thank you! Links: ------ [1] https://success.trendmicro.com/solution/000236583-Emails-being-rejected-by-… [2] https://blog.sucuri.net/2021/02/uceprotect-when-rbls-go-bad.html [3] http://www.uceprotect.net/en/rblcheck.php [4] http://www.uceprotect.net/en/index.php?m=8&s=0 [5] http://www.uceprotect.org/cart00neys/index.html

16 42

False positive CSAM blocking attributed to RIPE
by Jeremy Malcolm 29 Sep '21

29 Sep '21

Dear all, I am new to this list, although I am not completely new to the Internet technical community, as I am a long-time IGF (and occasionally ICANN) participant. I am writing about a case that has been referred to my organization involving global blocking (packet dropping, apparently) of IP addresses that have been reported as hosting CSAM by the Canadian Center for Child Protection (C3P). According to public information, the C3P runs a web crawler called Project Arachnid which searches for instances of CSAM on the clearweb, and sends automated takedown notices to providers. However, in the case that was reported to me, rather than allowing the hosting provider to take down the offending image, the takedown notice was followed by global packet dropping of the hosting IP address, which took down the entire server and other websites along with it: the hosting provider has attributed this censorship to RIPE, although I cannot verify whether or not this is true. If I am able to obtain more details from RIPE staff, I will follow up with them. Moreover the website in question was not a CSAM website, and neither was the image reported by the C3P a CSAM image. It was a scan of a 1960s postcard of an indigenous family, sent through the mail, which was included in a detailed ethnographic blog article about indigenous women and girls. In other words, this is an obvious false positive, and it should never have been reported as CSAM at all. I'm writing to find out if anyone has more information that they can share about how this might have happened, and how it can be prevented from happening in the future. Many thanks in advance for any help that you can offer. Not sure if I should include the RIPE Cooperation ML on this, given that it relates to the actions of the C3P? -- Jeremy Malcolm PhD LLB (Hons) B Com Executive Director, Prostasia Foundation https://prostasia.org - +1 415 650 2557 ᐧ

6 5

Survey UN-IGF DC-ISSS on Internet of Things security and policy
by Wout de Natris 27 Sep '21

27 Sep '21

Dear colleague, In this email you find a link to a survey on Internet of Things security and policy. The survey is a part of research currently undertaken within the UN-IGF’s Dynamic Coalition Internet Standards, Security and Safety’s Working Group Security by design – Internet of Things. For clarity, a short introduction. The Dynamic Coalition on Internet Standards, Security and Safety (DC-ISSS) brings together key stakeholders from the technical community, civil society, government policymakers, regulators, and corporate and individual adopters, with the shared goal of making online activity and interaction more secure and safer by achieving more widespread and rapid deployment of existing Internet standards and ICT best practices. (You can find more information on the DC-ISSS, the three working groups and their respective mission statements on the IGF website. You can also join the DC-ISSS here. https://www.intgovforum.org/multilingual/content/dynamic-coalition-on-inter….) Security by design is a prominent topic in the DC-ISSS’ workplan. The survey’s outcomes will assist it to define results that will be presented on at the IGF in Katowice, this December and will become an integral part of the policy recommendations, guidelines, toolkits and action/capacity building programmes the DC-ISSS foresees for 2022 and beyond. Please fill it in at your earliest convenience but no later than Friday 22 October at 12.00 UTC. Estimated time, ca. 10 minutes. Survey link: https://www.surveymonkey.com/r/M2RL9J7 Best regards, Wout de Natris Coordinator DC-ISSS DC-ISSS: Making the Internet more secure and safer

1 0

Call for Agenda Items, RIPE 83
by Brian Nisbet 15 Sep '21

15 Sep '21

Colleagues, As you're all hopefully aware the next RIPE meeting will be taking place, somewhere on the Internet, from the 22nd - 26th November this year. https://ripe83.ripe.net The Anti-Abuse WG will be meeting and Alireza, Tobias and I would invite people to submit topics for discussion, presentations for general enlightenment and, of course, work items for the working group. The session is currently scheduled for Wednesday 24th, but the date and time may both change as the various agendas fill up, we'll keep you posted. As always you can reach us at aa-wg-chair(a)ripe.net Thank you, Brian Co-Chair, RIPE AA-WG Brian Nisbet (he/him) Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

1 0