- anti-abuse-wg - mailman.ripe.net

Reminder Call For Agenda Items - RIPE87
by Brian Nisbet 25 Oct '23

25 Oct '23

Colleagues, We'd like to remind you that we still have time on the agenda for our next WG meeting, at RIPE 87 in Rome - https://ripe87.ripe.net/ Registration for the meeting, running from the 27th November - 1st December 2023, is open. The Anti-Abuse WG will be meeting and Markus, Tobias and I would invite people to submit topics for discussion, policy proposals, presentations for general enlightenment and, of course, work items for the working group. Speakers & presenters can either be present in Rome or reaching us live via the Internet! The Anti-Abuse WG session will be taking place on the 29th of November at 11:00 CST. As always you can reach us at aa-wg-chair(a)ripe.net Thanks, Brian Co-Chair, RIPE AA-WG Brian Nisbet (he/him) Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network North Dock Two, 93-94 North Wall Quay, Dublin 1, D01 V8Y6 +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

1 0

Invitation to share your views on internet standards
by Wout de Natris 11 Oct '23

11 Oct '23

Dear colleagues, If you had your say, which open, security-related Internet standards would be the first any organisation, public and private, should deploy? I invite you to respond to this question on the basis of a concept list now put up for consultation. Please share your views on the scope, categories and individual standards selected by our expert advisory panel. The consultation closes on 5 November. Here is the link: https://docs.google.com/document/d/1ZC6PBHOREbObHUgopAkPQbIWC_EgLQ8nDyDvULj… You can either contact me or look at is3coalition.org for more information. Kind regards, Wout de Natris - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - De Natris Consult Kamerlingh Onnesstraat 43 Tel: +31 648388813 2014 EK Haarlem Skype: wout.de.natris denatrisconsult(a)hotmail.nl<mailto:denatrisconsult@hotmail.nl> http://www.denatrisconsult.nl Blog http://woutdenatris.wordpress.com

1 0

Call For Agenda Items - RIPE 87
by Brian Nisbet 04 Sep '23

04 Sep '23

Colleagues, It's that time of the year again when we start to think about the agenda for our next WG meeting, at RIPE 87 in Rome - https://ripe87.ripe.net/ Registration for the meeting, running from the 27th November - 1st December 2023, is open. The Anti-Abuse WG will be meeting and Markus, Tobias and I would invite people to submit topics for discussion, policy proposals, presentations for general enlightenment and, of course, work items for the working group. Speakers & presenters can either be present in Rome or reaching us live via the Internet! The Anti-Abuse WG session will be taking place on the 29th of November at 11:00 CST. As always you can reach us at aa-wg-chair(a)ripe.net Thanks, Brian Co-Chair, RIPE AA-WG Brian Nisbet (he/him) Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network North Dock Two, 93-94 North Wall Quay, Dublin 1, D01 V8Y6 +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

1 0

Invitation to open consultation on internet security
by Wout de Natris 28 Aug '23

28 Aug '23

Dear colleagues, One of the fastest ways to achieve a higher level of internet and ICT security may be through buying secure by design, but do governments and companies do so? This is what IS3C tries to establish. This is the background: The Internet Governance Forum Dynamic Coalition on Internet Standards, Security and Safety will publish its report at the upcoming IGF in Kyoto. It's draft report aims to document existing policy requirements for public sector procurement contracts and supply chain management of digital technologies and asks whether security-related technical internet standards and ICT best practices are mentioned. It highlights emerging best practice and gaps in an effort to provide high-level guidance at the global level on how procurement plays a role in improving the security and safety of the global internet for all. We close with discussion and suggestions for future work. The document’s current status is open to feedback. We invite you to join this open consultation and share your views and to share links to policy documents, public or private on this topic not mentioned in the report. The deadline is Friday 25 August, 24.00 UTC. You can access the draft report for comments here: https://intgovforum.org/en/content/dynamic-coalition-on-internet-standards-… Kind regards, Wout de Natris IS3C coordinator - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - De Natris Consult Kamerlingh Onnesstraat 43 Tel: +31 648388813 2014 EK Haarlem Skype: wout.de.natris denatrisconsult(a)hotmail.nl<mailto:denatrisconsult@hotmail.nl> http://www.denatrisconsult.nl Blog http://woutdenatris.wordpress.com

1 1

Non-Efficacious Use of UCEPROTECT RBL data in RIPEstat
by Ping Technology Labs LTD 21 Aug '23

21 Aug '23

Hello, I am revisiting an issue last mentioned in a 2021 archive (I think): https://www.ripe.net/ripe/mail/archives/anti-abuse-wg/2021-March/006190.html The issue relates to the use of the UCEProtect RBL in RIPEstats blocklist. The previous discussion had several members voice objections to use of UCEProtect in RIPEstat on grounds of data accuracy and bad conduct/practice by UCE. The issue ended with RIPE mentioning they will look to expand the list of RBLs they sample from and in doing so, we will likely improve overall accuracy of RIPEstate blocklist by minimising the importance of any single list which in itself may be inaccurate. This work was planned to start Q3 2021, however, to the best of my knowledge, it doesn't look like there has been any material change to the RIPEstat blocklist or API. I am revisiting the issue as I would like to further voice my objection to using UCE with such high priority in RIPEstat due to the blocklist, particularly Level 3, not being efficacious in marking abusive resources. UCE has three types of blacklists: 1. Level 1 - Specific IP addresses 2. Level 2 - Subnets 3. Level 3 - ASNs Each resource type, i.e IP, Subnet, ASN accrues abusive points, or "impacts" as UCE labels them, which cascade up each level if the ASN does not resolve them. The UCE Level 3 is levied against entire ASNs as a result of an ASN accuring impact points from IP addresses and subnets they operate. This sounds okay, however, the methodology UCE uses is deeply floored and allows single IP address resources to accrue multiple points which can therefore tarnish an entire subnet, or ASN if not dealt with, leading to every other end user on that ASN potentially being flagged for abuse. This has come to my attention as we have connectivity with a carrier whose ASN is flagged with UCE L3 and as an end user of their network we have experienced negative side effects. Our carrier acts as a good example here so we will mention them specifically - AS42689 Glide Student & Residential Limited. Glide serves over 350,000 customers in the UK and is one the country's largest carriers yet they are marked as an abusive L3 "Draconic" ASN by UCE and therefore shows on RIPEstats blocked list along with every single resource on the ASN. I did some research into whether this is justified or not and was incredibly shocked to see that the entire ASN which serves 350,000+ customers has been given UCE L3 because of a *single abusive IP Address* ( 5.151.61.252) in the network which has had a high velocity of abusive. Ofcourse, the carrier should have taken action on this single IP address and end user, however, in no case is it suitable to mark all other IP addresses (and end users) on their network as abusive just because of a single bad actor. This Level 3 blacklist is not an efficacious indicator of abusive resources and instead is a better indicator of a somewhat lazy/or spotty approach to handling abuse from an operator perspective and is likely only present on UCE so they can charge a 449 CHF express delisting fee to ASNs that end up on this list. >From my understanding, the RIPEstat blocklist is meant to help indicate potentially abusive and harmful resources and whether RIPE likes it or not, their use of specific RBLs legitimizes them and adds a layer of perceived confidence in the data. Using the UCE L3 datasource for the RIPEstat tools isn't suitable and leads to more harm than good by implicating an entire network of end users to the abusive actions of a single non-related user of that network. I'd like RIPE to revisit their use of UCE, particularly Level 3, and remove it from their tools. I imagine my thoughts are echoed by other members but if anybody else has any opposing thoughts I would be happy to hear them :) Cheers, Timur Gok Managing Director [image: Logo] <https://www.pingproxies.com/> admin(a)pinglabs.co.uk - www.pinglabs.co.uk International House, 12 Constance Street, London, United Kingdom, E16 2DQ [image: LinkedIn icon] <https://www.linkedin.com/in/timur-gok-6a7074159/> [image: Twitter icon] <https://twitter.com/pingproxies>

2 1

The Register - How a dispute over IPv4 addresses blew the lid off an effort to reshape global allocation
by Cedric Pernet 03 Jul '23

03 Jul '23

Hi all, Just saw this one on Lu Heng, NRS, AFRINIC... https://www.theregister.com/2023/07/03/what_is_number_resource_society/ Cheers, Cedric. -- Cedric PERNET Senior Threat Researcher, CSS Team / Trend Micro

2 1

Draft Minutes - AA-WG RIPE86 Session
by Brian Nisbet 14 Jun '23

14 Jun '23

Colleagues, Please find attached the draft minutes of the WG session at RIPE86. Thanks to the NCC for preparing them. Please come back to the Co-Chairs no later than 17:00 CEST on Thursday 22nd June if you have any amendments. Thank you, Brian Co-Chair, RIPE AA-WG Brian Nisbet (he/him) Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network North Dock Two, 93-94 North Wall Quay, Dublin 1, D01 V8Y6 +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

1 0

Is SWIP dead?
by Alessandro Vesely 24 May '23

24 May '23

Hi all, I heard about the Shared WHOIS Project from MIPSpace, an IP reputation database who reads in Cc:. They say it should be available at every RIR, but at RIPE I only found this: https://ftp.ripe.net/ripe/inaddr/arin-templates/swipinstruction.txt It is a 1998 article with guidelines for using it. Does it have any validity? I also found a swip.net site, with no content but an expired certificate. IP reputation databases want a proof that a domain has exclusive use of an address or range thereof. There seem to be obvious reasons for such a requirement. And black lists are still a strong anti-spam tool. However, ISPs don't consider it worth, or reserve registration to 1st class customers. While the question in the subject is somewhat rhetorical, isn't there any other way to solve this problem? Any rule or service RIPE might undertake? Best Ale --

1 0

Request for information ICT procurement procedures
by Wout de Natris 22 May '23

22 May '23

Dear colleagues, The internet Standards, Security and Safety Coalition, an IGF Dynamic Coalition, seeks your assistance in the following. Attached you find a PDF inviting you to assist our researchers Liz Orembo and Mallory Knodel in identifying procurement documents in your respective countries and/or organisations. Do they contain a demand for security when purchasing ICTs and if so, what kind? More is explained in the attached PDF. Please consider this request, as your input will make our work far stronger. Should you be able to answer this request, please answer me privately. Best regards, Wout de Natris - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - De Natris Consult Kamerlingh Onnesstraat 43 Tel: +31 648388813 2014 EK Haarlem Skype: wout.de.natris denatrisconsult(a)hotmail.nl<mailto:denatrisconsult@hotmail.nl> http://www.denatrisconsult.nl Blog http://woutdenatris.wordpress.com

1 0

Invitation to ICT procurement and supply chain management workshop
by Wout de Natris 10 May '23

10 May '23

Dear colleagues, Through support of the RIPE Fund, the IGF Dynamic Coalition Internet Standards, Security and Safety Coalition (IS3C) currently undertakes a global research study into procurement and supply chain management policy documents and in how far they advocate using procurement to ensure security by design for ICT and IoT. Imagine how internet and ICT security will improve when governments and large organisations start demanding ICT and IoT products, services and devices to be made secure by design? At EuroDIG, the European Dialogue on Internet Governance, IS3C’s researchers present their intermediate report. You are invited to this (hybrid) workshop and participate actively in the debate. This workshop is an open consultation allowing all stakeholders to share their views on the draft outcomes and conclusions. We hope that you can find the time to join, online or in person, and provide us with the input we need for our final report, to be presented at the Internet Governance Forum in Kyoto, this October. Workshop: IS3C (DC): How to procure and purchase ICTs secure by design? When: Monday 19 June 14.00 - 15.30 EET (11 UTC) Where: University of Tampere, Finland in Room 3 Sign up: https://www.eurodig.org/get-involved/register-for-eurodig-2023/ More info: https://eurodigwiki.org/wiki/Pre_09_2023 Best regards, Wout de Natris IS3C coordinator IS3C: Making the internet more secure and safer - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - De Natris Consult Kamerlingh Onnesstraat 43 Tel: +31 648388813 2014 EK Haarlem Skype: wout.de.natris denatrisconsult(a)hotmail.nl<mailto:denatrisconsult@hotmail.nl> http://www.denatrisconsult.nl Blog http://woutdenatris.wordpress.com

1 0