- anti-abuse-wg - mailman.ripe.net

RIPE 65 Draft Agenda
by Brian Nisbet 21 Aug '12

21 Aug '12

Colleagues, We have just over a month to go before RIPE65, so I wanted to share the draft WG agenda. The WG meeting will take place on Thursday 27th September at 14:00 CEST. A. Administrative Matters * Welcome * Scribe, Jabber, Stenography * Microphone Etiquette * Approve Minutes from RIPE 64 * Finalise agenda B. Update * B1. Recent List Discussion * B2. CleanIT Project Update * B3. RIPE NCC Data Protection Legal Advice Update C. Policies * RIPE Policy 2011-06 D. Interactions * D1. Working Groups * D3. RIPE NCC Gov/LEA Interactions Update E. Presentation * E1. Operation of "Copy Shops" X. A.O.B. Z. Agenda for RIPE 66 As always, if you have any comments or anything to add, please don't hesitate to get in contact. Regards, Brian & Tobias

1 0

Re: [anti-abuse-wg] 2011-06 Last Call for Comments (Abuse Contact Management in the RIPE NCC Database)
by Arnold 20 Aug '12

20 Aug '12

On 20/08/2012 3:10 AM, Emilio Madaio wrote: > Dear Colleagues, > > The proposal described in 2011-06, "Abuse Contact Management in the > RIPE NCC Database", is now at its Concluding Phase. > > > You can find the full proposal at: > > https://www.ripe.net/ripe/policies/proposals/2011-06 > > Please e-mail any final comments about this proposal to anti-abuse-wg(a)ripe.net > before 17 September 2012. > > > Regards > > Emilio Madaio > Policy Development Officer > RIPE NCC > > > FWIW, as a plain old 'net citizen interested in reporting and reducing SPAM, I wholeheartedly endorse the proposal Arnold -- Fight Spam - report it with the latest wxSR 0.5 http://www.columbinehoney.net/wxSR.shtml

1 0

Re: [anti-abuse-wg] 2011-06 Last Call for Comments (Abuse Contact Management in the RIPE NCC Database)
by Davide Migliavacca 20 Aug '12

20 Aug '12

> Please e-mail any final comments about this proposal to anti-abuse- > wg(a)ripe.net > before 17 September 2012. I fully support the proposal 2011-06 in its current form. Kind regards, Davide Migliavacca Cto, contactlab

1 0

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 12, Issue 16
by Wout de Natris 20 Aug '12

20 Aug '12

Brian, >From my side a full support for the proposal. Without any obligations the proposal may never work as foreseen. And I would like to stress that Jerry Upton wrote on behalf of M3AAWG and in function as director, so representing the M3AAWG members. Looking at who those members are, I venture to see this as a very large support on behalf of the proposal. Best, Wout > From: anti-abuse-wg-request(a)ripe.net > Subject: anti-abuse-wg Digest, Vol 12, Issue 16 > To: anti-abuse-wg(a)ripe.net > Date: Mon, 20 Aug 2012 12:00:02 +0200 > > Send anti-abuse-wg mailing list submissions to > anti-abuse-wg(a)ripe.net > > To subscribe or unsubscribe via the World Wide Web, visit > https://www.ripe.net/mailman/listinfo/anti-abuse-wg > or, via email, send a message with subject or body 'help' to > anti-abuse-wg-request(a)ripe.net > > You can reach the person managing the list at > anti-abuse-wg-owner(a)ripe.net > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of anti-abuse-wg digest..." > > > Today's Topics: > > 1. 2011-06 Move to Last Call (Abuse Contact Management in the > RIPE NCC Database) (Brian Nisbet) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 20 Aug 2012 08:55:07 +0100 > From: Brian Nisbet <brian.nisbet(a)heanet.ie> > Subject: [anti-abuse-wg] 2011-06 Move to Last Call (Abuse Contact > Management in the RIPE NCC Database) > To: anti-abuse-wg(a)ripe.net > Message-ID: <5031ED5B.6090905(a)heanet.ie> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > Colleagues, > > RIPE Proposal 2011-06 (Abuse Contact Management in the RIPE NCC > Database) has reached the end of its extended Review Phase and a > decision must now be made regarding the next steps. I (Tobias, as the > main proposer, has, as agreed & discussed stepped back from his co-chair > duties on this one) have gone through the various mails and discussions > from the the review phase, a short summary of which is below. > > I feel that the main thrust of the discussion on 2011-06 gave support to > the proposal. > > The initial discussion phase lead to a redrafting of the proposal and > some questions over the mandatory nature of the attribute and the future > of the IRTs. It was also clarified that while there may be further > output from the ACM-TF and/or further proposals in this space, 2011-06 > was considered to be standalone. > > The second version was published on 16th April 2012, addressing, I > believe, a number of points raised during the initial discussion phase. > Some objections remained, such as opinions on the mandatory nature of > the object and the lack of a wider plan. > > In May 2012 it was decided to go ahead and move the proposal to Review > Phase, during which the RIPE NCC presented their impact analysis. This > gave rise to discussion regarding the future of the IRT object. I > believe that it has been clarified that while the NCC will put plans in > place to deal with the decommissioning of the IRT object, they will, of > course, only do so if the community proposes this. They have > acknowledged that 2011-06 does not contain this proposal and so no > action regarding the IRT object will be taken on foot of this proposal. > I believe that the wider IRT community are happy with this. > > There was relatively little discussion during Review Phase, so it was > extended for a further four weeks. During this time a number of > objections were restated (mandatory nature and data protection issues) > and discussed and a few new expressions of support were made. > > Overall it appears that there are three sustained objections to the > proposal and twelve clear expressions of support. The opinion of some > members of the list (who have commented) is unclear, however I feel > there is sufficient consensus to move this proposal to Last Call. > > Emilio will made the formal announcement from the RIPE NCC PDO. > > If you disagree with this interpretation, please let me know. > > Brian > Co-Chair, Anti-Abuse WG > > > > End of anti-abuse-wg Digest, Vol 12, Issue 16 > *********************************************

4 3

2011-06 Last Call for Comments (Abuse Contact Management in the RIPE NCC Database)
by Emilio Madaio 20 Aug '12

20 Aug '12

Dear Colleagues, The proposal described in 2011-06, "Abuse Contact Management in the RIPE NCC Database", is now at its Concluding Phase. You can find the full proposal at: https://www.ripe.net/ripe/policies/proposals/2011-06 Please e-mail any final comments about this proposal to anti-abuse-wg(a)ripe.net before 17 September 2012. Regards Emilio Madaio Policy Development Officer RIPE NCC

1 0

2011-06 Move to Last Call (Abuse Contact Management in the RIPE NCC Database)
by Brian Nisbet 20 Aug '12

20 Aug '12

Colleagues, RIPE Proposal 2011-06 (Abuse Contact Management in the RIPE NCC Database) has reached the end of its extended Review Phase and a decision must now be made regarding the next steps. I (Tobias, as the main proposer, has, as agreed & discussed stepped back from his co-chair duties on this one) have gone through the various mails and discussions from the the review phase, a short summary of which is below. I feel that the main thrust of the discussion on 2011-06 gave support to the proposal. The initial discussion phase lead to a redrafting of the proposal and some questions over the mandatory nature of the attribute and the future of the IRTs. It was also clarified that while there may be further output from the ACM-TF and/or further proposals in this space, 2011-06 was considered to be standalone. The second version was published on 16th April 2012, addressing, I believe, a number of points raised during the initial discussion phase. Some objections remained, such as opinions on the mandatory nature of the object and the lack of a wider plan. In May 2012 it was decided to go ahead and move the proposal to Review Phase, during which the RIPE NCC presented their impact analysis. This gave rise to discussion regarding the future of the IRT object. I believe that it has been clarified that while the NCC will put plans in place to deal with the decommissioning of the IRT object, they will, of course, only do so if the community proposes this. They have acknowledged that 2011-06 does not contain this proposal and so no action regarding the IRT object will be taken on foot of this proposal. I believe that the wider IRT community are happy with this. There was relatively little discussion during Review Phase, so it was extended for a further four weeks. During this time a number of objections were restated (mandatory nature and data protection issues) and discussed and a few new expressions of support were made. Overall it appears that there are three sustained objections to the proposal and twelve clear expressions of support. The opinion of some members of the list (who have commented) is unclear, however I feel there is sufficient consensus to move this proposal to Last Call. Emilio will made the formal announcement from the RIPE NCC PDO. If you disagree with this interpretation, please let me know. Brian Co-Chair, Anti-Abuse WG

1 0

Re: [anti-abuse-wg] Hold time for abused address space - DNSChanger IP's reallocated
by "Michele Neylon :: Blacknight" 18 Aug '12

18 Aug '12

We've ended up with IP space that had a "reputation" in the past It's quite annoying to discover that you IP block, or a part of it, is blacklisted before you even get a chance to use it .. Though I wonder is the overall scarcity of IPv4 space going to mean that IP blocks will end up being reassigned more quickly as there's fewer and fewer .. Mr Michele Neylon Blacknight Solutions ♞ Hosting & Colocation, Brand Protection ICANN Accredited Registrar http://www.blacknight.co http://blog.blacknight.com/ http://blacknight.cat http://mneylon.tel Intl. +353 (0) 59 9183072 US: 213-233-1612 Locall: 1850 929 929 Direct Dial: +353 (0)59 9183090 Facebook: http://fb.me/blacknight Twitter: http://twitter.com/mneylon ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,Ireland Company No.: 370845

11 34

Re: [anti-abuse-wg] Hold time for abused address space - DNSChanger IP's reallocated
by Joe St Sauver 16 Aug '12

16 Aug '12

Thor commented: #Email spam is universally defined as unsolicited bulk email. It must be #extremely rare for someone to join an anti-abuse *working* group without #knowing basic concepts such as this one. Actually, the question of "what's spam?" can be surprisingly tricky when things like national and local legislation gets factored in, to the point that some organizations prefer to refer to "unwanted email" or "abusive email" instead of "spam" instead. See, for example, reports from the MAAWG Email Metrics Program, e.g., www.maawg.org/sites/maawg/files/news/MAAWG_2011_Q1Q2Q3_Metrics_Report_15.pdf which reports industry percentages for "abusive email" Regards, Joe

2 1

Hold time for abused address space - DNSChanger IP's reallocated
by Heather Schiller 15 Aug '12

15 Aug '12

Last Friday, RIPE reallocated 2 address blocks involved in DNSChanger malware - one of them is already routed. Infected users are still sending DNS queries to this address space. The new holders of this space are getting a lot of DNS queries - they are in the position to see who is infected, what they are querying for and provide any DNS response they wish to those queries. News article: http://www.cso.com.au/article/433502/new_hijack_threat_emerges_dns_changer_… RIPE's response: https://www.ripe.net/internet-coordination/news/clarification-on-reallocate… I think reallocation of this address space so quickly, is irresponsible and puts users at risk. The RIR's debogonize other address ranges and check their status before allocation. The court appointed honest DNS service was only turned down a month ago, with thousands of users still infected. While users have had plenty of opportunity to clean up their computers, many are still infected. In some cases, providers have intentionally chosen not to notify their customers. I asked on the address-policy list, how long RIPE holds back netblocks before allocation. From RIPE's response above, they hold address blocks for 6 weeks and it sounds as though they would have reallocated it while the court appointed honest DNS service was running had that 6 weeks expired before the court ordered honest service ended. Court order or not, should there be a policy/process to give guidance to RIR's on how to handle abused address space? Should address space that has been "poisoned" where it continues to get traffic from infected hosts long after the servers/malware/domains are removed be reallocated to new unsuspecting organizations? Should the space be held for some specified amount of time? Or until it drops below some threshold of traffic? Should a research or security organization be contracted to work on cleaning up the space? should the RIR do that? --Heather

1 0

Comments on Abuse Contact Management in the RIPE Database
by Jerry Upton 15 Aug '12

15 Aug '12

The Messaging, Malware and Mobile Anti-Abuse Working Group(M3AAWG) is a global nonprofit organization founded to develop effective modelsand solutions to combat online abuse such as phishing, botnets, fraud, spam,viruses and denial-of-service attacks that can cause great harm to bothindividual and national economies. M3AAWG includes technical experts,researchers and policy specialists from a broad base of Internet serviceproviders and network operators representing over one billion email accounts,and from key technology providers, academia and volume messaging senderorganizations M3AAWG supports RIPE’s proposal to introduce a new contactattribute named "abuse-c:", which can be included in inetnum,inet6num and aut-num objects(https://www.ripe.net/ripe/policies/proposals/2011-06). The investigation and prosecution of criminal activity andabuse on the Internet would be greatly facilitated by the availability of suchdata being included in WHOIS. Theproliferation of spam and the transmission of malware of all types, which arethe fundamental target of the work undertaken by M3AAWG and its members, arethe most common and serious types of privacy intrusions, occurring billions oftimes a day, worldwide. ARIN Draft Policy “Abuse Contact Management in the RIPE NCCDatabase” states “abuse-c … provides a more efficient way for maintainers toorganize their provided information and helps to increase accuracy andefficiency in routing abuse reports to the correct network contact. Inaddition, it helps all kinds of institutions to find the correct abuse contactinformation more easily.” For anti-abuse researchers, investigators and systemsoperators, WHOIS and a publicly available point of intercept identifying anabuse contact is essential and fundamental information. People who manage abuseof their networks need to easily, readily and accurately identify all entitieson a given network. Therefore,M3AAWG firmly supports the adoption of the RIPE Draft Policy “Abuse ContactManagement in the RIPE NCC Database.” Sincerely, Jerry Upton, Executive Director Messaging, Malware and Mobile Anti-Abuse Working Group(M3AAWG) jerry.upton(a)m3aawg.org http://www.m3aawg.org

1 0