- anti-abuse-wg - mailman.ripe.net

Re: [anti-abuse-wg] Introducing the RIPE NCC Report Form
by Leo Vegoda 12 Apr '12

12 Apr '12

Hi Frank, This message is copied to the list, as requested. Frank Gadegast wrote: [...] > Lets ask me one thing (simply because you have an iconn email address): > is ICANN forcing the RIRs to have a public whois database by CONTRACT > and are the registries forced to have up-to-date and validated data in it ? > > Could you please point that out on the list ? I do not believe there is currently a contract between ICANN and the NRO or individual RIRs. In 2007, ICANN and the NRO agreed an exchange of letters. In ICANN's letter to the NRO it stated that it seeks "to further enhance our relationship for the mutual benefit of our organizations and respective communities. For that matter we wish and will seek to establish an appropriate legal arrangement within one (1) year from the date of this letter." I do not believe that arrangement has been established. You can find the announcement about the exchange of letters on the ICANN web site, here: http://www.icann.org/en/news/announcements/announcement-09nov07-en.htm The letters themselves are published on the correspondence pages but that announcement places them in a single page, which is more convenient to read. I expect the "Review of the ASO" document, which is currently in the second half of the public comment period, will have a fuller description of the relationship between the NRO and ICANN: http://www.icann.org/en/news/public-comment/aso-review-16mar12-en.htm Kind regards, Leo Vegoda

1 0

Re: [anti-abuse-wg] Introducing the RIPE NCC Report Form
by Joe St Sauver 12 Apr '12

12 Apr '12

Florian commented: #I looked at "Incorrect contact information in the RIPE Database", and #"I confirm that I have reported the incorrect information to all of #the contacts listed in the relevant object" is a required checkbox. # #This seems to require that complainants try postal addresses, phone #and fax numbers before reporting errors in email addresses. Is this #really your goal? Isn't this a step backwards? I agree. >From my POV, each data element should be treated independently. The existence of a valid FAX number, for example, should not offset or eliminate the importance (or the reportability) of working to correct an invalid/non-deliverable email address. Similarly, having found an invalid field in the whois, the reporter's "responsibility" should be considered discharged upon their identifying and reporting that data to RIPE. They should not be expected to exhaust all potential contact methods, or to make multiple attempts to the broken contact channel, or to hypothetically attempt to visit the listed address in person, :-), just in order to be eligible to report a problem with data of record. The goal should be correcting potentially bad data, not making it hard to report bad data or shifting work back upon public spirited community volunteers. Regards, Joe

5 6

Re: [anti-abuse-wg] current business practices
by Frank Gadegast 11 Apr '12

11 Apr '12

V >> subpoena by deleting the wrong AS object from the database > >> ;o) > > > > Heh. ACK on the role. But I was thinking towards urging the ISP itself to take action (once you HAVE contacted them) on the abuse complaints. That's where the pressure of a lea agency can come in handy, if such a regulator is available. > > Well, the only possibility would be the police. They do care here in Germany are kind of technical disadvanced :o( There is some organizations this ISP is a member of (like the ECO), and they have also a abuse clearing board, but that one isnt really useful because it never did anything against their members ... And why should they do something, they are not responsible for the resources ... Kind regards, Frank > > Pepijn > > +++++++++++++++++++++++++++++++++++++++++++++ > > Disclaimer > > Dit e-mailbericht kan vertrouwelijke informatie bevatten of informatie die is beschermd door een beroepsgeheim. > > Indien dit bericht niet voor u is bestemd, wijzen wij u erop dat elke vorm van verspreiding, vermenigvuldiging > > of ander gebruik ervan niet is toegestaan. > > Indien dit bericht blijkbaar bij vergissing bij u terecht is gekomen, verzoeken wij u ons daarvan > > direct op de hoogte te stellen via tel.nr 070 315 3500 of e-mail mailto:mail@opta.nl en het bericht te vernietigen. > > Dit e-mailbericht is uitsluitend gecontroleerd op virussen. > > OPTA aanvaardt geen enkele aansprakelijkheid voor de feitelijke inhoud en juistheid van dit bericht en er kunnen > > geen rechten aan worden ontleend. > > > > > > This e-mail message may contain confidential information or information protected by professional privilege. > > If it is not intended for you, you should be aware that any distribution, copying or other form of use of > > this message is not permitted. > > If it has apparently reached you by mistake, we urge you to notify us by phone +31 70 315 3500 > > or e-mail mailto:mail@opta.nl and destroy the message immediately. > > This e-mail message has only been checked for viruses. > > The accuracy, relevance, timeliness or completeness of the information provided cannot be guaranteed. > > OPTA expressly disclaims any responsibility in relation to the information in this e-mail message. > > No rights can be derived from this message. > > > > > -- Mit freundlichen Gruessen, -- MOTD: "have you enabled SSL on a website or mailbox today ?" -- PHADE Software - PowerWeb http://www.powerweb.de Inh. Dipl.-Inform. Frank Gadegast mailto:frank@powerweb.de Schinkelstrasse 17 fon: +49 33200 52920 14558 Nuthetal OT Rehbruecke, Germany fax: +49 33200 52921 ======================================================================

1 0

Re: [anti-abuse-wg] current business practices
by Frank Gadegast 11 Apr '12

11 Apr '12

Vissers, Pepijn wrote: > Hi Frank, Hi, > > > > Interesting story. Here in NL, we act as LEA towards an ISP if the abuse we see is related to spam and/or malware (because that is our (OPTA) function as telco regulator). In most cases, abuse reports from a law enforcement agency tend to be picked up with a little more urgency so the strategy is quite effective. > > > > If the ISP is non-cooperative, we might choose to apply a little more pressure by a subpoena of some kind. Usually applying such pressure results in a positively correlated attitude towards handling said abuse tickets. The strategy is derived from the theory of 'responsive regulation' by Braithwait. > > > > Do you have such a regulator (with investigative capabilities) who you could team up with in DE? Surely not. Its the role of RIPE NCC (too my understanding) to keep their database up-to-date. subpoena by deleting the wrong AS object from the database ;o) Pretty simple ... Kind regards, Frank > > > > Kind regards, > > Pepijn > > > >> -----Oorspronkelijk bericht----- > >> Van: anti-abuse-wg-bounces(a)ripe.net [mailto:anti-abuse-wg- > >> bounces(a)ripe.net] Namens Frank Gadegast > >> Verzonden: woensdag 11 april 2012 15:18 > >> Aan: anti-abuse-wg(a)ripe.net > >> Onderwerp: Re: [anti-abuse-wg] current business practices > >> > >> Laura Cobley wrote: > >>> Dear Florian and all, > >> > >> Hi, > >> > >> (some details from our current experiences with RIPE NCC and accuracy > >> of the RIPE objects) > >> > >> we currently have one case where a really big German cablenet ISP is > >> having exacly one abuse-eMail address for their tech-c, abuse-mailbox > >> and admin-c, for all their objects. > >> > >> And this one email has a domain, what does not belong to the ISP > >> anymore, since November 2011, its currently owned by a domain grabber, > >> because the ISP deleted the domain on purpose (on behalf of a change in > >> the company name years ago). > >> There is no other working contact information (phone lets you end up at > >> their hotline where they have absolutly no idea about abuse), snail > >> mail is no option, fax number is not supplied. > >> > >> We tried mailing there peering contact, their normal customer email > >> from their website, filled their online feedback form and then opened a > >> normal ticket at RIPE NCC, were just told to open another ticket at > >> RIPE NCC and invested about 5 hours already describing the problem at > >> RIPE NCC. > >> Simply no chance, RIPE NCC is responding to tickets on a daily basis, > >> even during business hours (jesus, we will respond in about 5 minutes > >> if something serious like that will happen to our networks). > >> The interest at the RIPE NCC to fix database problems does not seem to > >> have any priority. > >> > >> Ah, I forgot: > >> the maillist server mamba.ripe.net has technical problems during the > >> last 3 weeks, we opened tickets for that as well and even got a > >> response once, still not fixed, the maillist server is probably not > >> reacheable for 90% of the members ... whoever will receives this could > >> please make a telnet mamba.ripe.net 25 from some IPs he own (best would > >> be not using his or her usual IP, if he or she likes, lets see how big > >> that problem really is, thats why I have to mail the most active people > >> directly). > >> > >> -------- > >> Little update: seems like RIPE NCC changed the maillist server to > >> postgirl.ripe.net and that one works. > >> Looks like they had to change this in a hurry, because the old server > >> did hang in the nameserver caches quite long (great, that I have to > >> find that out myself, instead that > >> somebody from the RIPE NCC is simply telling me that or posting > >> to the list). > >> -------- > >> Sorry, if nearly the same email comes twice now ... have to test it. > >> > >> So: abuse does not have priority in a lot of peoples heads those days, > >> even when they tell you that daily ... > >> > >> (we have about 100 abuse incidents with that ISP monthly and the ISP > >> even resides in the same country than we are, but its still, if they > >> reside on the other side of the moon, maybe I should demonstrate > >> if front of the office building with a big sign saying: > >> "you dont have a working abuse appartment") > >> > >> > >> Kind regards, Frank > >>> > >>> Over time, contact information in the RIPE Database can become > >>> outdated due to staffing changes, oversight and lack of knowledge on > >>> the part of the maintainer. Bringing the irregularity directly to the > >>> attention of this maintainer can be the quickest way to get it fixed. > >>> > >>> If you subsequently experience difficulties with this, we can help > >> you > >>> to get in touch with the maintainer by forwarding your report to the > >>> person responsible for the Internet number resource registration. > >>> Handling reports is a normal part of our operations within the RIPE > >>> NCC and the report form makes it easier to get in touch with us. > >>> > >>> We ask you to include information such as mail delivery failure > >>> notices and copies of emails with headers, which clearly show the > >>> problem and the subsequent difficulties you are having. These help to > >>> substantiate the report. Our aim is to work together with you to > >>> further improve the quality of the data in the Internet number > >> resource registry. > >>> > >>> Best regards, > >>> > >>> Laura Cobley > >>> RIPE NCC > >>> > >>> On 4/6/12 8:45 PM, Florian Weimer wrote: > >>>> * Laura Cobley: > >>>> > >>>>> Using this form, you can now easily report various issues, > >> including > >>>>> abnormalities in Internet number resource registrations, to us for > >>>>> further investigation. > >>>> > >>>> I looked at "Incorrect contact information in the RIPE Database", > >> and > >>>> "I confirm that I have reported the incorrect information to all of > >>>> the contacts listed in the relevant object" is a required checkbox. > >>>> > >>>> This seems to require that complainants try postal addresses, phone > >>>> and fax numbers before reporting errors in email addresses. Is this > >>>> really your goal? Isn't this a step backwards? > >>>> > >>> > >>> > >>> > >> > >> > >> -- > >> > >> Mit freundlichen Gruessen, > >> -- > >> MOTD: "have you enabled SSL on a website or mailbox today ?" > >> -- > >> PHADE Software - PowerWeb http://www.powerweb.de > >> Inh. Dipl.-Inform. Frank Gadegast mailto:frank@powerweb.de > >> Schinkelstrasse 17 fon: +49 33200 52920 > >> 14558 Nuthetal OT Rehbruecke, Germany fax: +49 33200 52921 > >> ====================================================================== > >> > >> > > > > +++++++++++++++++++++++++++++++++++++++++++++ > > Disclaimer > > Dit e-mailbericht kan vertrouwelijke informatie bevatten of informatie die is beschermd door een beroepsgeheim. > > Indien dit bericht niet voor u is bestemd, wijzen wij u erop dat elke vorm van verspreiding, vermenigvuldiging > > of ander gebruik ervan niet is toegestaan. > > Indien dit bericht blijkbaar bij vergissing bij u terecht is gekomen, verzoeken wij u ons daarvan > > direct op de hoogte te stellen via tel.nr 070 315 3500 of e-mail mailto:mail@opta.nl en het bericht te vernietigen. > > Dit e-mailbericht is uitsluitend gecontroleerd op virussen. > > OPTA aanvaardt geen enkele aansprakelijkheid voor de feitelijke inhoud en juistheid van dit bericht en er kunnen > > geen rechten aan worden ontleend. > > > > > > This e-mail message may contain confidential information or information protected by professional privilege. > > If it is not intended for you, you should be aware that any distribution, copying or other form of use of > > this message is not permitted. > > If it has apparently reached you by mistake, we urge you to notify us by phone +31 70 315 3500 > > or e-mail mailto:mail@opta.nl and destroy the message immediately. > > This e-mail message has only been checked for viruses. > > The accuracy, relevance, timeliness or completeness of the information provided cannot be guaranteed. > > OPTA expressly disclaims any responsibility in relation to the information in this e-mail message. > > No rights can be derived from this message. > > > > > -- Mit freundlichen Gruessen, -- MOTD: "have you enabled SSL on a website or mailbox today ?" -- PHADE Software - PowerWeb http://www.powerweb.de Inh. Dipl.-Inform. Frank Gadegast mailto:frank@powerweb.de Schinkelstrasse 17 fon: +49 33200 52920 14558 Nuthetal OT Rehbruecke, Germany fax: +49 33200 52921 ======================================================================

1 0

Enabling community self-help?
by Shane Kerr 08 Apr '12

08 Apr '12

All, warning: crazy idea time Does it seem like a good idea to provide a way to attach "user comments" to network information? Background... Some people want someone to force ISP's to take responsibility for fixing abuse originating in their networks. The natural place for this enforcement appears to them to be the RIPE NCC (*). Contrariwise, the RIPE NCC is unable to unwilling to change its role from a fundamentally administrative to one that involves setting network usage policies. This involves risks in terms of anti-trust regulators, need to carefully define the limits of control, and setting up what amounts to a industry legal system (with both judges and police). Plus it is hard to get the RIPE NCC membership to support mechanisms which cost them money and limit their freedoms. On the 3rd hand, some people in the RIPE community (including me) also feel that it is very, very difficult to define what the required actions would be in the case of reported abuse. This reporting mechanism itself might indeed be a source of abuse (rivalries between companies could be fought by each accusing the other of hosting criminal activity). Crazy Idea... Lets crowd-source it. Maybe it makes sense to make something like a web forum for each allocated resource, or perhaps for the organization responsible for each. It could be something like a blog article with the contact and other information about each resource, and then a way to post comments about it. So, you might see that ISP ShaNet has working e-mail for abuse, but nobody ever sees any action beyond automated response. Such reports could be useful for people who *can* investigate and do something, such as law enforcement or regulators. A few decades of Internet forums have given us best practices in terms of policing forums for spam and abuse, for evaluating user trustworthiness and helpfulness, and for evaluating the value of individual comments or replies (+1). I think something like this would be within the realm of things that the RIPE NCC could provide. We could link to these pages from the WHOIS results (or go straight there for web queries perhaps). There are lots of web sites which publish consumer evaluations of various companies and products, so this really is not so different. -- Shane (*) Well, normally confused with RIPE (or Ripe). But the RIPE NCC is what they mean.

10 30

Re: [anti-abuse-wg] 2011-06 New Policy Proposal (Abuse Contact Management in the RIPE NCC Database)
by Gilles Massen 30 Mar '12

30 Mar '12

Hello, This policy proposal seems a bit incomplete to, as it fails to address the problem statement from the summary. >From the summary: "...it is not clear whether to use the "abuse-mailbox:" attribute, the "remark:" attribute or an irt object.". What is supposed to happen to IRT objects, or data from them? For existing records: at the very least it should be explicit which tags should no longer be used or would be deprecated / removed in order to give clear guidance. Another point: if the general idea of the policy is acceptable, wouldn't it be nice to have 2 abuse mailboxes: one for humans, one for bots? Best, Gilles -- Fondation RESTENA - DNS-LU 6, rue Coudenhove-Kalergi L-1359 Luxembourg tel: (+352) 424409 fax: (+352) 422473

25 73

List Behaviour & Tone
by Brian Nisbet 30 Mar '12

30 Mar '12

Folks, Can I please remind you that there is no place on this list for ad hominem attacks. There has been a veering today towards very impolite behaviour and it hasn't been all that long since I'd last sent a mail about this. If you have a disagreement with someone, please express it in a polite and reasoned manner, as the vast majority of people here do. Brian.

1 0

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 7, Issue 18
by Karl-Josef Ziegler 30 Mar '12

30 Mar '12

> You seem to require something else. Maybe, some sort of 'Criminal Records Bureau check'? Best regards, - Karl-Josef Ziegler

1 0

Contact for 91.211.88.29
by Everett, Alex D 30 Mar '12

30 Mar '12

All: I joined this group as some percentage of the time (30% or so) I am unable to contact an organization to report abuse. I feel that if we see a problem, it behooves us to reach out and let others know. I know that when my organization is hosting malicious content, we want to know. What prompted me to join was this issue occurring multiple times, sending emails to abuse(a)ripe.net, and no resolution. The latest example was from March 15th, for a web server serving malware at 91.211.88.29. Does anyone have any way to contact this organization other than the email addresses below (which fail)? To: "noc(a)bigus-net.com" <noc(a)bigus-net.com> Cc: "constructelectro(a)mail.ru" <constructelectro(a)mail.ru> Subject: Abuse from 91.211.88.29 Sincerely, Alex Everett, CISSP, CCNA University of North Carolina Chapel Hill, NC, USA

4 6

Re: [anti-abuse-wg] National PSDN "UZPAK"
by Joe St Sauver 29 Mar '12

29 Mar '12

Fearghas commented: #You miss the point - there are many different kinds of commercial organisation #structures that are not Limited/PLC/Limited by Guarantee companies that can #hold LIR assets and be members. Why should I be a Limited/PLC/Limited by #Guarantee company just to hold LIR membership or an ASN/PA/PI/etc space ? There is precedent for the legal organization of an entity to be scrutinized as part of the process of trusting that entity. One example that comes to mind is the vetting that takes place for Extended Validation SSL certificates under norms established by the Certificate and Browser Forum, see: http://www.cabforum.org/vetting.html Or consider requests for proposal that may require prequalification of potential bidders as responsible bidders able to actually undertake and complete the work that's being bid -- again, that sort of vetting is often far easier for a corporation than for a sole proprietorship or a partnership, etc. Public corporations have important properties that typically include transparency, verifiability, and accountability, although obviously we can all find counter examples from recent practice in any given economy :-; Regards, Joe

2 1