- anti-abuse-wg - mailman.ripe.net

Re: [anti-abuse-wg] Secure Domain Foundation anti-abuse cost research
by Michele Neylon - Blacknight 16 Apr '15

16 Apr '15

Drew Thanks for sharing this I think it’s a really good idea to try and get some metrics of what it’s costing us all to deal with abuse so this kind of research could be very valuable Regards Michele (Disclosure – I’m involved with the SDF ) -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains http://www.blacknight.host/ http://blog.blacknight.com/ http://www.blacknight.press - get our latest news & media coverage http://www.technology.ie Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Social: http://mneylon.social ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,Ireland Company No.: 370845 From: Drew Bagley Date: Thursday 16 April 2015 14:32 To: "anti-abuse-wg(a)ripe.net<mailto:anti-abuse-wg@ripe.net>" Subject: [anti-abuse-wg] Secure Domain Foundation anti-abuse cost research Greetings, I help lead the Secure Domain Foundation in its efforts to curb domain abuse through information sharing. We are currently trying to learn more about the cost of abuse and abuse mitigation for registrars, registries, and hosting companies. This will help us determine new ways to make proactive anti-abuse good for business. To assist us in this effort, we have created a brief survey: http://goo.gl/forms/UMckkncSTX If you are willing to participate then it would be terrific if you could complete the survey by April 30th. Thank you so much in advance for your help. Please let me know if you have any questions or feedback. Sincerely, Drew -- Drew Bagley Director of Operations Secure Domain Foundation drew(a)securedomain.org<mailto:drew@securedomain.org>

1 0

Secure Domain Foundation anti-abuse cost research
by Drew Bagley 16 Apr '15

16 Apr '15

Greetings, I help lead the Secure Domain Foundation in its efforts to curb domain abuse through information sharing. We are currently trying to learn more about the cost of abuse and abuse mitigation for registrars, registries, and hosting companies. This will help us determine new ways to make proactive anti-abuse good for business. To assist us in this effort, we have created a brief survey: http://goo.gl/forms/UMckkncSTX If you are willing to participate then it would be terrific if you could complete the survey by April 30th. Thank you so much in advance for your help. Please let me know if you have any questions or feedback. Sincerely, Drew -- Drew Bagley Director of Operations Secure Domain Foundation drew(a)securedomain.org

1 0

Working Group Chair Selection Procedure
by Tobias Knecht 14 Apr '15

14 Apr '15

Colleagues, As per the draft agenda for our meeting at RIPE70 and the previously circulated procedures for Working Group Chair selection etc. I would like to let you all know what will happen in Amsterdam. At RIPE70 Brian will be standing down as per the agreed procedures. The meeting will then have the opportunity to choose a second chair for the working group. This mail should be taken as a call for candidates. If you are interested, please mail the mailing list to let us all know. You do not need to be physically present at RIPE70 in order to put yourself forward. Any expressions of interest should be sent to the list before Wednesday 6th May. Brian has stated that he is interested in continuing as a co-chair of the working group. If there are any questions, please do not hesitate to contact me. Thanks, Tobias -- | Tobias Knecht | CEO | abusix GmbH | tk(a)abusix.com | http://abusix.com | Haid-und-Neu-Strasse 18-20 | 76131 Karlsruhe | Germany | mobile_eu: +49 170 455 98 45 | mobile_us: +1 408 960 3785 | --- | Register of Companies(Handelsregister): HRB 707959 | District of Court(Amtsgericht) Mannheim/Germany | Registered Office: Karlsruhe/Germany | CEO: Tobias Knecht Follow abusix on Twitter! http://twitter.com/abusix

2 1

Draft Agenda, AA-WG Meeting At RIPE 70
by Brian Nisbet 13 Apr '15

13 Apr '15

Colleagues, Please find below the current draft agenda for the Anti-Abuse WG meeting at RIPE 70. The meeting will take place on Wednesday 13th May at 14:00 CEST. A. Administrative Matters * Welcome * Scribe, Jabber, Stenography * Microphone Etiquette * Approve Minutes from RIPE 69 * Finalise agenda B. Update * B1. Recent List Discussion * B2. AA-WG Chair Matters C. Policies D. Interactions * D1. Working Groups * D2. RIPE NCC Gov/LEA Interactions Update E. Presentation * E1. Mapping out Cyber Crime Infrastructure - A Law Enforcement Approach - Jon Flaherty UK National Crime Agency National Cyber Crime Unit X. A.O.B. Z. Agenda for RIPE 71

1 0

Meeting with Law Enforcement Agencies (LEAs)
by Marco Hogewoning 23 Mar '15

23 Mar '15

Dear Colleagues, We recently held our seventh meeting for Law Enforcement Agencies (LEAs), in partnership with the British National Crime Agency (NCA) and the other RIRs. Held on 12 March 2015, the purpose of this meeting was to discuss trends and developments that might impact the operations of LEAs and to gather the global law enforcement community’s perspective. A number of key points arose throughout the day: - The RIPE NCC highlighted that much of the information that LEAs required was publicly available and did not require a Dutch court order - Attendees agreed that the current multi-stakeholder model of Internet governance was preferable, but felt that LEAs and governments needed to engage more effectively within the existing structures - The relatively slow adoption of IPv6 and the spread of IP address sharing technologies such as Carrier Grade NAT will increasingly create issues around identifying specific end users - LEAs felt that cooperation with the private sector is extremely important and could improve greatly, but it was also understood that this came with additional costs In response to feedback from the RIPE community, a more detailed report of this meeting has been prepared and is available here: https://www.ripe.net/ripe/meetings/lea-meetings/ripe-ncc-law-enforcement-me… We would like to thank the NCA for its help in putting together this day and are looking forward to continue our engagement with the global law enforcement community. We are happy to answer any questions you may have about this meeting or our LEA engagement activities in general. Regards, Marco Hogewoning External Relations Officer - Technical Advisor RIPE NCC

4 4

New on RIPE Labs: Inferring DDoS Attacks from Darknet Space
by Mirjam Kuehne 20 Mar '15

20 Mar '15

Dear colleagues, Please see this new article on RIPE Labs by Claude Fachkha: This work proposes a novel approach to infer and characterise Internet-scale DNS Distributed Reflection Denial of Service (DRDoS) attacks by leveraging the darknet space. The aim of this work is to extract useful information related to DRDoS activities such as intensity, rate and geo-location in addition to various network-layer and flow-based insights. https://labs.ripe.net/Members/claude_fachkha/inferring-distributed-reflecti… Kind regards, Mirjam Kuehne RIPE NCC

1 0

Introduction and the AbuseIO project
by Bart Vrancken 18 Mar '15

18 Mar '15

Hello AA-WG peoples, I am new to this workgroup so let me start by introducing myself: I am Bart Vrancken, Engineer at a Dutch ISP BIT. Next to the normal day-day work i handle most of the abuse sent by notifiers. For a while now i am also part at the Abuse-NL workgroup. On IRC i can be found under the names CrossWire or Kruisdraad. Outside office hours (who can call it spare time these days ...) i spent my time with my two daughters and volunteer with the dutch 'coastguard' service. Since 2009 i have been working on a tool to manage the abuse flow, and recently started the Open Source AbuseIO (https://abuse.io) project so anyone could benefit from it. For the ISP/Hosters that still manually process their abuse it might be interesting to have a look at it ;) I'll be at the RIPE-70 meeting to shake some hands ;) -- Met vriendelijke groet, Bart Vrancken, Engineer BIT BV | bart(a)bit.nl | +31 318 648688 Kvk: 09090351 | CROS-RIPE | GPG 3A99BD6E

2 1

Re: [anti-abuse-wg] Abuse-C attributes - required e-mail address contact method.
by Ronald F. Guilmette 18 Mar '15

18 Mar '15

My two cents... The person/company who proposed this proposal used the word "complainant" to refer to someone (anyone) attempting to report a case of network abuse to its source network administrators. Personally, speaking only for myself, I object to being called a "complainant" or a "complainer", e.g. when I attempt to do the decent thing and take up _my_ valuable time to notify responsible (?) network administrators about something I feel that they themselves may want to know about, and indeed should want to know about. Of course, the Powers That Be at many networks ... the bean counters and the higher level managers... often view _any_ communication with any party other than a paying customer as a waste of time and money, and thus, the personel underneath these folks inevitably come to develop an "us versus them" attitude which leads inevitably to viewing reports generated by outsiders, aka non-paying customers, as "complaints" and the senders as "complainers" whose only (or primary) goal is to cost the receiving company time and money, rather than the opposite, i.e. attempting to _help_ the receiving company. I would argue that it is this bean counter attitute that has itself given rise to most of the abuse on the Internet, i.e. in the time since the broad commercialization of the net in the mid 1990's. If you view receiving, understanding, and acting upon notifications of bad behavior occuring on your network as nothing other than a non-profit-generating cost sink, then you are entirely less likely to ever actually *do* anything about such reports. And when you don't, the word goes out among the bad guy communities on the Internet, and your network ends up being the source of ever more network abuse. This is just the (Darwinian) way things are. Opportunistic leeches abound. If given safe homes, they and their activities proliferate. I generally expend a good deal of time and effort writing up any abuse report I send. (Note that I say "report" not "complaint".) There are plenty of ways that various networks have dreamed up to avoid reading these "complaints", i.e. because they don't immediately or obviously generate any instantaneous revenue or profits for the receipient networks. The simplest method to avoid spending any non-profit-generating company man hours on reading abuse reports is just to alias abuse@network to /dev/null. If Virgin feels that reading incoming e-mail reports is not worth their time, then I respectfully suggest that they simply enter devnull(a)example.com into the abuse contact e-mail address fields for all of their relevant RIPE database records. This will be maximally efficient for all concerned. (There really is no more efficient way for Virgin to process all of their incoming "complaints". And since they _are_ clearly concerned about the efficiency of this process, that would seem to be ttheir best solution.) Regards, rfg

3 3

Re: [anti-abuse-wg] Abuse-C attributes - required e-mail address contact method.
by Thorsten 14 Mar '15

14 Mar '15

> Am 14.03.2015 um 07:35 schrieb andre(a)ox.co.za: > > On Fri, 13 Mar 2015 17:03:25 +0100 > Gert Doering <gert(a)space.net> wrote: >> On Fri, Mar 13, 2015 at 03:18:17PM +0000, Gist, Jonathan wrote: >>> The RIPE policy around the abuse-c attribute requires the presence >>> of an e-mail address, which is asked to be used by subscribers >>> wishing to report abuse incidents. This contact method is resource >>> intensive and Virgin Media would like to propose a change to the >>> policy to remove the requirement for an e-mail address contact >>> field. >>> Virgin Media would like to specify virginmedia.com/netreport (a >>> web-form that feeds an abuse case management system) I would support an *additional field* for „abuse-webform“ in the abuse-c attributes, to ensure that *manual reports* contain everything what is needed for an ISP to act on, beside the "abuse-mailbox“ for automated (e.g. X-ARF complaints). But not in the fashion that it is getting the „single point of contact“. >> I would not support such a change, at least not without a *well >> defined* format for such web forms. For companies like us, reporting out thousands of abuse-reports (phishing sites, malware complaints, etc.) per day, webforms are making it impossible to report abuse. >> On the reporting side of abuse, it is just way too much work to >> figure out how particular ISPs expect to receive abuse reports, >> offloading half the work of abuse handling to the reporter. >> (I report quite a lot of abuse, but I refuse to do anything but >> e-mail, because it is just too much work for me - it's your >> customers, they are giving *you* money, their abuse should not cost >> *me* extra time). Exactly! Rgds, Thorsten

1 0

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 41, Issue 2
by Karl-Josef Ziegler 13 Mar '15

13 Mar '15

> Virgin Media would like to specify virginmedia.com/netreport (a > web-form that feeds an abuse case management system) in the abuse > attribute to ensure that we are able to properly manage and > prioritise abuse complaints. If we have the web-form listed as the > abuse contact we are able to maximise appropriate abuse handling > measures to prevent misuse of our network and thereby ensure an > optimum experience for all complainants. I also don't support this proposal because filling (maybe also a different form for each ISP) webforms correctly is a tedious work and only transfers parts of the workload from abuse desk to the reporter. But the reporter is not responsible for the abuse; responsibility lies with the ISP so the workload must be done there. Best regards, - Karl-Josef Ziegler

1 0