- anti-abuse-wg - mailman.ripe.net

False positive CSAM blocking attributed to RIPE
by Jeremy Malcolm 29 Sep '21

29 Sep '21

Dear all, I am new to this list, although I am not completely new to the Internet technical community, as I am a long-time IGF (and occasionally ICANN) participant. I am writing about a case that has been referred to my organization involving global blocking (packet dropping, apparently) of IP addresses that have been reported as hosting CSAM by the Canadian Center for Child Protection (C3P). According to public information, the C3P runs a web crawler called Project Arachnid which searches for instances of CSAM on the clearweb, and sends automated takedown notices to providers. However, in the case that was reported to me, rather than allowing the hosting provider to take down the offending image, the takedown notice was followed by global packet dropping of the hosting IP address, which took down the entire server and other websites along with it: the hosting provider has attributed this censorship to RIPE, although I cannot verify whether or not this is true. If I am able to obtain more details from RIPE staff, I will follow up with them. Moreover the website in question was not a CSAM website, and neither was the image reported by the C3P a CSAM image. It was a scan of a 1960s postcard of an indigenous family, sent through the mail, which was included in a detailed ethnographic blog article about indigenous women and girls. In other words, this is an obvious false positive, and it should never have been reported as CSAM at all. I'm writing to find out if anyone has more information that they can share about how this might have happened, and how it can be prevented from happening in the future. Many thanks in advance for any help that you can offer. Not sure if I should include the RIPE Cooperation ML on this, given that it relates to the actions of the C3P? -- Jeremy Malcolm PhD LLB (Hons) B Com Executive Director, Prostasia Foundation https://prostasia.org - +1 415 650 2557 ᐧ

6 5

Survey UN-IGF DC-ISSS on Internet of Things security and policy
by Wout de Natris 27 Sep '21

27 Sep '21

Dear colleague, In this email you find a link to a survey on Internet of Things security and policy. The survey is a part of research currently undertaken within the UN-IGF’s Dynamic Coalition Internet Standards, Security and Safety’s Working Group Security by design – Internet of Things. For clarity, a short introduction. The Dynamic Coalition on Internet Standards, Security and Safety (DC-ISSS) brings together key stakeholders from the technical community, civil society, government policymakers, regulators, and corporate and individual adopters, with the shared goal of making online activity and interaction more secure and safer by achieving more widespread and rapid deployment of existing Internet standards and ICT best practices. (You can find more information on the DC-ISSS, the three working groups and their respective mission statements on the IGF website. You can also join the DC-ISSS here. https://www.intgovforum.org/multilingual/content/dynamic-coalition-on-inter….) Security by design is a prominent topic in the DC-ISSS’ workplan. The survey’s outcomes will assist it to define results that will be presented on at the IGF in Katowice, this December and will become an integral part of the policy recommendations, guidelines, toolkits and action/capacity building programmes the DC-ISSS foresees for 2022 and beyond. Please fill it in at your earliest convenience but no later than Friday 22 October at 12.00 UTC. Estimated time, ca. 10 minutes. Survey link: https://www.surveymonkey.com/r/M2RL9J7 Best regards, Wout de Natris Coordinator DC-ISSS DC-ISSS: Making the Internet more secure and safer

1 0

Call for Agenda Items, RIPE 83
by Brian Nisbet 15 Sep '21

15 Sep '21

Colleagues, As you're all hopefully aware the next RIPE meeting will be taking place, somewhere on the Internet, from the 22nd - 26th November this year. https://ripe83.ripe.net The Anti-Abuse WG will be meeting and Alireza, Tobias and I would invite people to submit topics for discussion, presentations for general enlightenment and, of course, work items for the working group. The session is currently scheduled for Wednesday 24th, but the date and time may both change as the various agendas fill up, we'll keep you posted. As always you can reach us at aa-wg-chair(a)ripe.net Thank you, Brian Co-Chair, RIPE AA-WG Brian Nisbet (he/him) Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

1 0

New on RIPE Labs: Day One Exploits - How to Effectively Reduce the Threat
by Alun Davies 19 Jul '21

19 Jul '21

Dear colleagues, Recent Day One attacks have demonstrated how difficult it can be for organisations to react when vulnerabilities are announced. In this new guest post on RIPE Labs, Kathleen Moriarty looks at how the move toward pervasive zero trust architectures and DevOps processes could help reduce the problem: https://labs.ripe.net/author/kathleen_moriarty/day-one-exploits-how-to-effe… Kind regards, Alun Davies RIPE Labs Editor RIPE NCC

1 0

Making the internet more secure: An invitation
by Wout de Natris 17 Jun '21

17 Jun '21

Dear colleagues, On Monday 28 June at 11.30 UTC (13.30 CET) the Dynamic Coalition on Internet Standards, Security and Safety presents itself, its three working groups that started in 2021 and their respective workplans and mission statements. You are kindly invited to join this virtual workshop. A more secure and safer Internet, ICT and IoT, is in the interest of every end user. Whether corporate, public services or individuals, all end users should be adequately protected by state of the art security, available in the form of Internet standards and ICT/IoT best practices concerning security. Presently these standards and best practices are seriously underused, leaving the world at large, and its private and public interests, less protected than is currently possible. The DC-ISSS aims to ensure that standards and best practices play their full role in addressing these challenges through establishing the conditions for their wider, more effective and more rapid adoption by key decision-takers in the implementation chain. Said deployment is of direct interest to your organisation. Closing the gap between the theory and the practices of digital security is the main theme of the DC’s working groups. The gap between the theory of roadmaps on IoT security and secure-by-design devices and sensors. The gap between current tertiary schooling in cyber security curricula and the demands industry and other employers make on, not only, educational facilities but also those graduating there. The gap between the necessity of a more secure digital environment and the lack of active, security demand and thus offer of security. Deployment equals a significantly higher level of protection against the exploitation of vulnerabilities, hacks and extortion. It’s in your interest. In this session the current three working groups: security by design – Internet of Things; education and skills and; procurement, supply chain management and the creation of a business case for deployment will present their respective plans for 2021. These plans will be published shortly on the IGF website here: (https://www.intgovforum.org/multilingual/content/dynamic-coalition-on-inter…). On the same page you can join the email list of the DC-ISSS. The second half of the session is your opportunity to raise questions, suggest research or direction, to add expertise and knowledge to the programme. The DC-ISSS Leadership team is open to have one on one sessions during EuroDIG or after. Please let us know if you are interested to learn more. The DC-ISSS is in need of support. 1) Contributions in kind in the form of knowledge and expertise. 2) Introductions to experts and expert organisations. 3) Financial contributions to conduct the research, the writing of reports, to conduct active outreach and allow for support, coordination and presentations. We look forward to welcoming you on Monday 28 June, 11.30 UTC (13.30 CEST). Do not forget to register on the EuroDIG website in order to participate. (https://www.eurodig.org/get-involved/register-for-eurodig-2021/), 25 June at the latest. Best regards, Wout de Natris Coordinator DC-ISSS DC-ISSS: Making the Internet more secure and safer - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - De Natris Consult Kamerlingh Onnesstraat 43 Tel: +31 648388813 2014 EK Haarlem Skype: wout.de.natris denatrisconsult(a)hotmail.nl<mailto:denatrisconsult@hotmail.nl> http://www.denatrisconsult.nl Blog http://woutdenatris.wordpress.com

1 0

RIPE 82 Anti-Abuse WG minutes
by Brian Nisbet 09 Jun '21

09 Jun '21

Colleagues, Please find attached the minutes of our recent meeting, lovingly prepared by the NCC. Please do take a look and come back to the Co-Chairs with any issues or corrections. Thanks, Brian Co-Chair, RIPE AA-WG Brian Nisbet (he/him) Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

1 0

New on RIPE Labs: RIPE NCC Anti-Abuse Support - What to Do if It Happens to You
by Alun Davies 28 May '21

28 May '21

Dear colleagues, At the RIPE NCC, we get lots of requests for assistance from people dealing with online abuse. In this new article on RIPE Labs, Angela Dall'Ara talks about how you can use RIPE NCC tools to help resolve abuse issues, but also takes a look at what you can do when further steps need to be taken. https://labs.ripe.net/author/angela_dallara/ripe-ncc-anti-abuse-support-wha… Kind regards, Alun Davies RIPE Labs Editor RIPE NCC

3 3

Re: [anti-abuse-wg] Input request for system on how to approach abuse filtering on Route Servers - bad hosters
by Erik Bais 20 May '21

20 May '21

Hi Thomas, Thank you for your reply and insight. I’m not asking for IXP’s to look in the traffic.. I’m looking for a top 50 list of badhosts.. that is generated in a way that we as a community would feel comfortable with as a start. Use that top 50 list .. as the ASn filtering, to get to a way of clean internet for the default Routeserver customer. ( secure by design / default ) If that customer would like to receive the unfiltered option, they could set that via the IXP portal in their member account and receive the unfiltered view. Or setup direct peerings .. It is already possible to do this for someone if they know how to do it, via BGP communities or RPSL in the RIPE DB.. But the problem is that the list might not get updated .. and it is easier to do this for the whole group with regular updates, without re-configing all routers on a peering lan. As we are now talking about this in the Dutch community, it should be possible to push this also to other regions .. and it should be open for everyone to see why they would be listed and what the qualifiers are that they are there … That way we can avoid the real badhosts to pick out an internet exchange that doesn’t support filtering on this, just so they can push their bad packets into some networks. Regards, Erik Bais From: anti-abuse-wg <anti-abuse-wg-bounces(a)ripe.net> on behalf of Thomas King <thomas.king(a)de-cix.net> Date: Wednesday 19 May 2021 at 13:14 To: Erik Bais <erik(a)bais.name>, "connect-wg(a)ripe.net" <connect-wg(a)ripe.net>, "anti-abuse-wg(a)ripe.net" <anti-abuse-wg(a)ripe.net> Subject: Re: [anti-abuse-wg] Input request for system on how to approach abuse filtering on Route Servers - bad hosters Hi Erik, This is a vital topic! You focused a bit on the Dutch community. However, I think it is globally significant. We at DE-CIX are very active in reacting to abusive peers on our IXPs. We have disconnected peers who were (repeatedly) not obeying the law or the DE-CIX Terms and Conditions. I gave a talk about what DE-CIX does in this regard during RIPE75 (https://ripe75.ripe.net/archives/video/103/). Disclaimer: I am not a lawyer. The European telecommunication law does not allow IXPs to look into peers' traffic on the application level (for a good reason, I believe). So, we do not know if a peer hosts malware or is sending out spam only. DE-CIX is only allowed to look into the operational data (e.g., Route or ASN hijacks) or behavior (e.g., unwanted traffic due to static routes on the Peering LAN). Based on this information, DE-CIX is acting. I am highlighting this because I see issues if IXPs (or carriers and transit providers) are used as central infrastructure to filter data due to information they cannot verify or generate. Just think about the central DNS filtering and censoring discussion we had on a European level to stop certain abusive and harmful Internet services from being accessible. Best regards, Thomas -- Dr. Thomas King Chief Technology Officer (CTO) DE-CIX Management GmbH | Lindleystraße 12 | 60314 Frankfurt am Main | Germany | www.de-cix.net<http://www.de-cix.net> | Phone +49 69 1730902 87 | Mobile +49 175 1161428 | Fax +49 69 4056 2716 | thomas.king(a)de-cix.net<mailto:thomas.king@de-cix.net> | Geschaeftsfuehrer Harald A. Summa and Sebastian Seifert | Registergericht AG Koeln HRB 51135 DE-CIX 25th anniversary: Without you the Internet would not be the same! Join us on the journey at https://withoutyou.de-cix.net From: connect-wg <connect-wg-bounces(a)ripe.net<mailto:connect-wg-bounces@ripe.net>> On Behalf Of Erik Bais Sent: Tuesday, 18 May 2021 21:52 To: connect-wg(a)ripe.net<mailto:connect-wg@ripe.net>; anti-abuse-wg(a)ripe.net<mailto:anti-abuse-wg@ripe.net> Subject: [connect-wg] Input request for system on how to approach abuse filtering on Route Servers - bad hosters Hi, As I asked during the Connect WG today, there are discussions currently going on in the Dutch network community to see if there is a way to get a cleaner feed from routeservers on internet exchanges. ( by default ) As you may know there is an Dutch Anti Abuse Network initiative ( AAN ) – abuse.nl The companies associated with AAN setup and all signed a manifest ( in Dutch - https://www.abuse.nl/manifest/ ) that states that we will all do our best to provide a better and cleaner internet. As members of the member organisation of the largest Internet Exchange, AMS-IX, we like to start with the discussion on asking the AMS-IX to filter certain AS numbers from the default routeserver view. The issue is that even if you don’t peer with certain networks directly, the change is very real that you will receive or that the other network receive your prefixes and that you may not want to peer with those networks. What we like to have is an independent way of generating a list with badhosts ( say a top 50 ) .. ( and with our Dutch infrastructure we have a couple on the Dutch infrastructure as well.. ) A couple years ago there was the list of HostExploit .. or one could have a look at the drop-list of SH .. Personally I would like a proper model that one can explain why a certain network is listed on a certain list with a clear method explaining of what kind of abuse is noted in the said network. Topics that should be included on the rating for the list : * Phishing (hosting sites / domain registrations ) * Malware hosting ( binaries and C&C’s ) * DDOS traffic ( number of amplification devices in the network compared to the number of IP address ratio ) * Login attacks / excessive port scanning * Hosting of Child exploitation content * Infected websites / Zeus Botnets * Etc So yeah, something similar as the Top 50 of HostExploit ranking .. but HostExploit stopped producing these lists in 2014. By filtering a top 50 of badness hosters on the Routeservers would remove the cheap IXP option for network connectivity at the better Internet Exchanges and provide a way to remove any DDOS traffic via BGP null-routing via Transits. And companies that would still want to peer with a certain network, can still do so by direct peering setup via the IXP infra. And it will not bring the IXP in a position where it will be asked on why they are still offering services to certain parties .. as that might become legally difficult especially in a membership organisation. So we don’t mind if we take their money as long as are not forced to peer with them via the routeservers. Your constructive feedback is highly appreciated. Regards, Erik Bais A2B Internet

4 6

Input request for system on how to approach abuse filtering on Route Servers - bad hosters
by Erik Bais 19 May '21

19 May '21

Hi, As I asked during the Connect WG today, there are discussions currently going on in the Dutch network community to see if there is a way to get a cleaner feed from routeservers on internet exchanges. ( by default ) As you may know there is an Dutch Anti Abuse Network initiative ( AAN ) – abuse.nl The companies associated with AAN setup and all signed a manifest ( in Dutch - https://www.abuse.nl/manifest/ ) that states that we will all do our best to provide a better and cleaner internet. As members of the member organisation of the largest Internet Exchange, AMS-IX, we like to start with the discussion on asking the AMS-IX to filter certain AS numbers from the default routeserver view. The issue is that even if you don’t peer with certain networks directly, the change is very real that you will receive or that the other network receive your prefixes and that you may not want to peer with those networks. What we like to have is an independent way of generating a list with badhosts ( say a top 50 ) .. ( and with our Dutch infrastructure we have a couple on the Dutch infrastructure as well.. ) A couple years ago there was the list of HostExploit .. or one could have a look at the drop-list of SH .. Personally I would like a proper model that one can explain why a certain network is listed on a certain list with a clear method explaining of what kind of abuse is noted in the said network. Topics that should be included on the rating for the list : * Phishing (hosting sites / domain registrations ) * Malware hosting ( binaries and C&C’s ) * DDOS traffic ( number of amplification devices in the network compared to the number of IP address ratio ) * Login attacks / excessive port scanning * Hosting of Child exploitation content * Infected websites / Zeus Botnets * Etc So yeah, something similar as the Top 50 of HostExploit ranking .. but HostExploit stopped producing these lists in 2014. By filtering a top 50 of badness hosters on the Routeservers would remove the cheap IXP option for network connectivity at the better Internet Exchanges and provide a way to remove any DDOS traffic via BGP null-routing via Transits. And companies that would still want to peer with a certain network, can still do so by direct peering setup via the IXP infra. And it will not bring the IXP in a position where it will be asked on why they are still offering services to certain parties .. as that might become legally difficult especially in a membership organisation. So we don’t mind if we take their money as long as are not forced to peer with them via the routeservers. Your constructive feedback is highly appreciated. Regards, Erik Bais A2B Internet

3 2

Re: [anti-abuse-wg] Input request for system on how to approach abuse filtering on Route Servers - bad hosters
by Thomas King 19 May '21

19 May '21

Hi Erik, This is a vital topic! You focused a bit on the Dutch community. However, I think it is globally significant. We at DE-CIX are very active in reacting to abusive peers on our IXPs. We have disconnected peers who were (repeatedly) not obeying the law or the DE-CIX Terms and Conditions. I gave a talk about what DE-CIX does in this regard during RIPE75 (https://ripe75.ripe.net/archives/video/103/). Disclaimer: I am not a lawyer. The European telecommunication law does not allow IXPs to look into peers' traffic on the application level (for a good reason, I believe). So, we do not know if a peer hosts malware or is sending out spam only. DE-CIX is only allowed to look into the operational data (e.g., Route or ASN hijacks) or behavior (e.g., unwanted traffic due to static routes on the Peering LAN). Based on this information, DE-CIX is acting. I am highlighting this because I see issues if IXPs (or carriers and transit providers) are used as central infrastructure to filter data due to information they cannot verify or generate. Just think about the central DNS filtering and censoring discussion we had on a European level to stop certain abusive and harmful Internet services from being accessible. Best regards, Thomas -- Dr. Thomas King Chief Technology Officer (CTO) DE-CIX Management GmbH | Lindleystraße 12 | 60314 Frankfurt am Main | Germany | www.de-cix.net <http://www.de-cix.net> | Phone +49 69 1730902 87 | Mobile +49 175 1161428 | Fax +49 69 4056 2716 | thomas.king(a)de-cix.net <mailto:thomas.king@de-cix.net> | Geschaeftsfuehrer Harald A. Summa and Sebastian Seifert | Registergericht AG Koeln HRB 51135 DE-CIX 25th anniversary: Without you the Internet would not be the same! Join us on the journey at https://withoutyou.de-cix.net From: connect-wg <connect-wg-bounces(a)ripe.net <mailto:connect-wg-bounces@ripe.net> > On Behalf Of Erik Bais Sent: Tuesday, 18 May 2021 21:52 To: connect-wg(a)ripe.net <mailto:connect-wg@ripe.net> ; anti-abuse-wg(a)ripe.net <mailto:anti-abuse-wg@ripe.net> Subject: [connect-wg] Input request for system on how to approach abuse filtering on Route Servers - bad hosters Hi, As I asked during the Connect WG today, there are discussions currently going on in the Dutch network community to see if there is a way to get a cleaner feed from routeservers on internet exchanges. ( by default ) As you may know there is an Dutch Anti Abuse Network initiative ( AAN ) – abuse.nl The companies associated with AAN setup and all signed a manifest ( in Dutch - https://www.abuse.nl/manifest/ ) that states that we will all do our best to provide a better and cleaner internet. As members of the member organisation of the largest Internet Exchange, AMS-IX, we like to start with the discussion on asking the AMS-IX to filter certain AS numbers from the default routeserver view. The issue is that even if you don’t peer with certain networks directly, the change is very real that you will receive or that the other network receive your prefixes and that you may not want to peer with those networks. What we like to have is an independent way of generating a list with badhosts ( say a top 50 ) .. ( and with our Dutch infrastructure we have a couple on the Dutch infrastructure as well.. ) A couple years ago there was the list of HostExploit .. or one could have a look at the drop-list of SH .. Personally I would like a proper model that one can explain why a certain network is listed on a certain list with a clear method explaining of what kind of abuse is noted in the said network. Topics that should be included on the rating for the list : * Phishing (hosting sites / domain registrations ) * Malware hosting ( binaries and C&C’s ) * DDOS traffic ( number of amplification devices in the network compared to the number of IP address ratio ) * Login attacks / excessive port scanning * Hosting of Child exploitation content * Infected websites / Zeus Botnets * Etc So yeah, something similar as the Top 50 of HostExploit ranking .. but HostExploit stopped producing these lists in 2014. By filtering a top 50 of badness hosters on the Routeservers would remove the cheap IXP option for network connectivity at the better Internet Exchanges and provide a way to remove any DDOS traffic via BGP null-routing via Transits. And companies that would still want to peer with a certain network, can still do so by direct peering setup via the IXP infra. And it will not bring the IXP in a position where it will be asked on why they are still offering services to certain parties .. as that might become legally difficult especially in a membership organisation. So we don’t mind if we take their money as long as are not forced to peer with them via the routeservers. Your constructive feedback is highly appreciated. Regards, Erik Bais A2B Internet

1 0