- anti-abuse-wg - mailman.ripe.net

Re: [anti-abuse-wg] Enabling community self-help?
by Joe St Sauver 29 Mar '12

29 Mar '12

Suresh commented: #Eh. The term itself originated because capone set up a chain of laundries #which earned him lots of profits, to account for all the money he was #raking in from bootleg booze If folks want to understand the topic of modern money laundering, by far the best publicly available treatment of this topic that I've seen is the 2005 US Money Laundering Threat Assessment, 81 pages, available online at http://www.treasury.gov/resource-center/terrorist-illicit-finance/Documents… Regards, Joe

1 0

Enough is enoug
by info＠dhn.li 29 Mar '12

29 Mar '12

Dear sirs, i need help on people that every day try to hack our server for example this is just for to days log from fail2ban i made maximum try count 4 and 600 sec. than thay try later 600 sec again non stop please take control who they are and why they try endles, least 6 months our server IP 85.10.198.87 2012-03-08 11:40:24,591 fail2ban.actions: WARNING [ssh] Ban 61.188.179.27 2012-03-08 11:50:25,251 fail2ban.actions: WARNING [ssh] Unban 61.188.179.27 2012-03-08 12:24:17,438 fail2ban.actions: WARNING [ssh] Ban 175.45.42.26 2012-03-08 12:34:18,155 fail2ban.actions: WARNING [ssh] Unban 175.45.42.26 2012-03-08 16:05:56,897 fail2ban.actions: WARNING [ssh] Ban 80.13.90.126 2012-03-08 16:15:56,881 fail2ban.actions: WARNING [ssh] Unban 80.13.90.126 2012-03-08 16:18:51,182 fail2ban.actions: WARNING [ssh] Ban 80.13.90.126 2012-03-08 16:28:51,845 fail2ban.actions: WARNING [ssh] Unban 80.13.90.126 2012-03-08 16:31:53,052 fail2ban.actions: WARNING [ssh] Ban 80.13.90.126 2012-03-08 16:41:53,736 fail2ban.actions: WARNING [ssh] Unban 80.13.90.126 2012-03-08 16:44:58,987 fail2ban.actions: WARNING [ssh] Ban 80.13.90.126 2012-03-08 16:48:46,242 fail2ban.actions: WARNING [ssh] Ban 123.200.5.67 2012-03-08 16:54:59,662 fail2ban.actions: WARNING [ssh] Unban 80.13.90.126 2012-03-08 16:58:46,919 fail2ban.actions: WARNING [ssh] Unban 123.200.5.67 2012-03-08 17:07:23,488 fail2ban.actions: WARNING [ssh] Ban 80.13.90.126 2012-03-08 17:17:24,140 fail2ban.actions: WARNING [ssh] Unban 80.13.90.126 2012-03-08 17:19:59,319 fail2ban.actions: WARNING [ssh] Ban 80.13.90.126 2012-03-08 17:29:59,976 fail2ban.actions: WARNING [ssh] Unban 80.13.90.126 2012-03-08 17:36:36,416 fail2ban.actions: WARNING [ssh] Ban 80.13.90.126 2012-03-08 17:44:06,913 fail2ban.actions: WARNING [ssh] Ban 108.15.99.40 2012-03-08 17:46:37,111 fail2ban.actions: WARNING [ssh] Unban 80.13.90.126 2012-03-08 17:54:07,614 fail2ban.actions: WARNING [ssh] Unban 108.15.99.40 2012-03-08 18:14:54,932 fail2ban.actions: WARNING [ssh] Ban 80.13.90.126 2012-03-08 18:24:55,634 fail2ban.actions: WARNING [ssh] Unban 80.13.90.126 2012-03-08 18:32:08,092 fail2ban.actions: WARNING [ssh] Ban 175.45.42.26 2012-03-08 18:41:24,809 fail2ban.actions: WARNING [ssh] Ban 80.13.90.126 2012-03-08 18:42:08,870 fail2ban.actions: WARNING [ssh] Unban 175.45.42.26 2012-03-08 18:51:25,466 fail2ban.actions: WARNING [ssh] Unban 80.13.90.126 2012-03-08 22:45:58,511 fail2ban.actions: WARNING [ssh] Ban 113.108.103.11 2012-03-08 22:55:59,386 fail2ban.actions: WARNING [ssh] Unban 113.108.103.11 2012-03-09 01:03:14,565 fail2ban.actions: WARNING [ssh] Ban 175.45.42.26 2012-03-09 01:13:15,311 fail2ban.actions: WARNING [ssh] Unban 175.45.42.26

10 19

weird ERX networks ?
by Frank Gadegast 27 Mar '12

27 Mar '12

Hi, we receive Spam from some networks we cannot find any whois record for. An example: 62.61.196.0 (we found about 1000 networks like this) ARINs whois says, its RIPE RIPEs whois says, its AFRINIC LACNIC also says, its AFRINIC but AFRINICs whois says, its "world-wide" ... So, where is this really allocated too and where can we we find a whois record for those networks ? Unallocated, but still in use from somebody ? Anybody an idea ? Here are the whois records: ARIN: NetRange: 62.0.0.0 - 62.255.255.255 CIDR: 62.0.0.0/8 OriginAS: NetName: RIPE-C3 NetHandle: NET-62-0-0-0-1 RIPE: inetnum: 62.61.192.0 - 62.61.255.255 org: ORG-AFNC1-RIPE netname: AFRINIC-NET-TRANSFERRED-20050223 descr: This network has been transferred to AFRINIC remarks: These IP addresses are assigned in the AFRINIC region. AFRINIC: inetnum: 0.0.0.0 - 255.255.255.255 netname: IANA-BLK descr: The whole IPv4 address space country: EU # Country is really world wide org: ORG-IANA1-AFRINIC Kind regards, Frank -- MOTD: "have you enabled SSL on a website or mailbox today ?" -- PHADE Software - PowerWeb http://www.powerweb.de Inh. Dipl.-Inform. Frank Gadegast mailto:frank@powerweb.de Schinkelstrasse 17 fon: +49 33200 52920 14558 Nuthetal OT Rehbruecke, Germany fax: +49 33200 52921 ======================================================================

6 7

Draft Agenda: RIPE 64 AA-WG Meeting
by Brian Nisbet 20 Mar '12

20 Mar '12

Colleagues, This is the first draft agenda for the AA-WG meeting at RIPE 64. The meeting will take place at 11:00 CEST on Thursday 19th April. There is still some room on the agenda if anyone would like to bring any items to the attention of the WG. Please let me know if this is the case - aa-wg-chairs(a)ripe.net A. Administrative Matters * Welcome * Scribe, Jabber, Stenography * Microphone Etiquette * Approve Minutes from RIPE 63 * Finalise agenda B. Update * B1. Recent List Discussion * B2. CleanIT Project C. Policies * RIPE Policy 2011-06 D. Interactions * D1. Working Groups * D3. RIPE NCC Gov/LEA Interactions Update X. A.O.B. Z. Agenda for RIPE 65

2 1

AA-WG RIPE 63 Minutes
by Brian Nisbet 23 Feb '12

23 Feb '12

Colleagues, Here are the minutes from the AA-WG meeting at RIPE 63. If you have any questions, objections or corrections, please let me know. Draft RIPE Anti-Abuse Working Group Minutes – RIPE 63 Tuesday, 1 November 2011, 16:00-17:30, Vienna Co-Chairs: Brian Nisbet and Tobias Knecht Scribe: Fergal Cunningham Chat Monitor: Ingrid Wijte A: Administrative Matters Welcome The Anti-Abuse Working Group Co-Chair Brian Nisbet opened the session and welcomed the attendees. He thanked the scribe, chat monitor and stenographers and then introduced his co-chair, Tobias Knecht. Approve Minutes from RIPE 62 Brian noted that there was an initial comment on the draft minutes from RIPE 62. He said some small amendments were made and the minutes were then approved. Finalise agenda There were no additions to the agenda. B. Update B1: Recent List Discussion Brian noted there was a lot of recent list discussion, not all of it constructive. He said reporting abuse to the RIPE NCC was a main issue and that it would be addressed later in this session with a presentation from the RIPE NCC. B2: Passive DNS – Joao Damas, ISC Joao Damas from ISC gave a presentation on passive DNS. The presentation is available at: http://ripe63.ripe.net/presentations/64-PassiveDNS-ISC-RIPE63.pdf Aaron Kaplan, CERT.at, said there were passive DNS installations in Estonia, Austria and Luxembourg. He said there was effort between them to have a common query interface for passive DNS databases and he asked Joao if he would be interested in participating. Joao said that sounded like a good idea and he would ask his colleague to contact Aaron. Aaron asked if Joao thought about the data collection as being sensitive from a data protection point of view. He thought there was no easy answer for this. Joao agreed and said he also had no answer for that. He said most of the queries so far were from people they know so there hasn’t so far been a need to perform much verification. B3. RIPE NCC Abuse Contact Procedures Laura Cobley, Customer Services Manager at the RIPE NCC, gave a presentation on the procedures used to report abuse to the RIPE NCC. Her presentation is available at: http://ripe63.ripe.net/presentations/112-lauracobley.pdf Michele Neylon, Blacknight, asked where he could find the webform to report abuse and how to report abuse in the absence of the webform. Laura said the webform was a proposal and was not available yet, and people could send their reports to abuse(a)ripe.net. She added that she would ensure this information would be available on the RIPE NCC website. Peter Koch, DENIC, asked if the RIPE NCC would scrutinise the person making the report. Laura said there would be scrutiny of the reporter but that anyone could make a report. She said there could be an email verification check used in combination with the webform. Peter asked if, in that case, people could make reports with an anonymised name as long as they had a valid email address. Laura said there were no plans to keep track of identities but that there did need to be a way to communicate with the reporter. Sascha Luck, Cork Internet Exchange, asked if it would be better to have the webform available from the LIR Portal to prevent such things as DDoS attacks. Laura said this would limit it to only RIPE NCC members. Brian agreed with this and said he would not want it to be available only to members. Kaveh Ranjbar, Database Manager at the RIPE NCC, said that there is a list of email contacts, including abuse(a)ripe.net, on the RIPE NCC website. He said there is also a simple webform for contact the RIPE NCC although this does not contain all the options presented by Laura. Wilfried Woeber, Vienna Univerity/ACOnet, said he did not object to webforms but said there should be some safeguards to ensure that the identity of the person is verifiable and that the complaints are genuine. Wilfried added that many people used email and ticketing systems and it would be a good idea to consider this. Tobias Knecht, Abusix, said that there are email formats that can be set up to hold the same information as a webform and can be partly automated. He said he would send Laura information on these formats. Laura thanked Tobias and noted that the format has not been finalised so it would be good to get that information from Tobias. Brian asked what would happen to abuse(a)ripe.net when the webform became available. Laura said that the address is used for a range of issues and that it would remain available. Brian asked when the webform might become available. Laura said she did not have an exact date yet and the RIPE NCC was still gathering feedback. She said she hoped to be able to establish a production timeline soon after the RIPE 63 Meeting. B4. Hosters v Malware: Tools & Best Practice Michele Neylon, Blacknight, gave a presentation on tools and best practices from a hosting provider’s point of view. The presentation is available at: http://ripe63.ripe.net/presentations/70-blacknight-ripe-vienna.pdf During the presentation, Michele asked for a show of hands on the following questions: • Who is involved with hosting in some way? • Who provides dial-up or DSL-type services? • Who deals with abuse reports on a daily basis? • Are you taking proactive measures to deal with the abuse reports? Several people raised their hands for all these questions. There were no questions for Michele from the floor. C. Policies C1: Abuse Contact Management Task Force Brian said the Abuse Contact Management Task Force was formed after the RIPE 61 Meeting. He said there were a number of policies proposed there and the task force was formed with the intention of combining common issues from a number of those policies. He noted that the task force concentrated on abuse contact management issues. Tobias gave an update on the work of the task force. He said they were close to making a proposal that addresses most of the issues seen. He said the proposal would include a request for an abuse-c contact in RIPE Database objects that is like the admin-c contact. He said the task force wants to ensure that everything is done in a way that makes life easy for maintainers. He said he hoped that the proposal could be published well in advance of the RIPE 64 Meeting. Brian said he didn’t want to have a discussion on the proposal until it was issued. He said that Policy Proposal 2011-06 would pass through the Policy Development Process and hopefully consensus would be reached. He said they would then determine whether the task force should continue or be discontinued. He said information on the task force is published on the Anti-Abuse Working Group webpages. He said the task force would work on the proposal together with the RIPE Database Working Group. He concluded by asking that people give a clear opinion on the proposal on the Anti-Abuse mailing list when it is posted. D. Interactions D1. Working Groups Brian said there would be interaction with the RIPE Database Working Group, as noted in agenda point C1. D3. RIPE NCC Gov/LEA Interactions Update Brian noted that legal enforcement agencies (LEAs) and governments are becoming more aware of how people are using the Internet. He said the RIPE NCC has done an excellent job of getting LEAs around table and there has been a noticeably more collegiate atmosphere between representatives of LEAs and the Internet community of late. He said LEAs have not been as visible lately because they better understanding of the work of the RIPE community and are concentrating on other things at the moment. Brian said he went to Europol with Jochem de Ruig and Marco Hogewoning from the RIPE NCC to talk about security issues. They have started to look at training investigators on IPv6 issues. He said there was also a Cyber Crime Working Party (CCWP) meeting in Paris the week before the RIPE 63 Meeting. Brian said RIPE community representatives would go to the SOCA meeting in London in March 2012 to maintain that relationship. He also noted that governments have some ideas on web filtering but they are trying to steer them in the right direction where possible. Aaron Kaplan, CERT.at, asked if anyone thought about collecting statistics from each country on IRT object entries. Wilfried Woeber, RIPE Database Working Group Co-Chair, he thought the Anti-Abuse Policy Proposal should be set in motion first to see what then happens. Brian reiterated that the proposal would go into the PDP as soon as possible. Michele Neylon, Blacknight, said that a problem LEAs had was that registrars were slow to have something official available for the LEAs. He recommended that this group learn from that lesson. Sasha Luck, Cork Internet Exchange, asked if the content of the discussion with LEAs would be published anywhere. Brian said that the discussions are usually confidential but it was agreed with that people involved with the CCWP could report back to their communities on the issues were discussed. Wilfried said that he has seen LEAs become more involved with Internet number resource issues. He said the Internet community should work with them as much as possible. Tobias said that he wanted a RIPE Policy in place as soon as possible for those very reasons. X. A.O.B. There was no other business to attend to. Z. Agenda for RIPE 64 Brian said the working group tries to have a good mix of technical and anti-abuse-related discussions. He concluded that if people wanted different areas discussed or if they wanted to present at RIPE 64, they should contact one of the working group chairs. Brian thanked everyone for attending and closed the session at 17:28 (UTC +1).

2 1

RIPE 64 Agenda Items
by Brian Nisbet 23 Feb '12

23 Feb '12

Colleagues, It is now just under two months to the next RIPE meeting in Ljubljana, Slovenia. RIPE 64 will be held from the 16th - 20th April 2012. Currently the AA-WG meeting should take place at 11:00 CET on Thursday April 19th. We are currently seeking agenda items for the working group session in any area relating to network abuse, law enforcement or associated matters and anything else you may feel is of interest to the group. Please mail any proposals to aa-wg-chairs(a)ripe.net, preferably before the 9th of March. Thanks, Brian.

1 0

no traffic? banned?
by U.Mutlu 20 Feb '12

20 Feb '12

I have got no new posting in this list since 2/2. Is here really no traffic anymore, or have I maybe been removed/banned from the list? :-)

2 1

Can they really demand on customer data?
by Lu Heng 02 Feb '12

02 Feb '12

Hi colleagues: I have notice an interesting part of the DCMA claim, most them looks like "Nike also demands that you provide the names, postal addresses, e-mail addresses, and telephone numbers of the registrants of XXX". But the important thing is, doesn't that conflict with privacy laws, can they really demand private data without court order? How do you think about it? -- -- Kind regards. Lu This transmission is intended solely for the addressee(s) shown above. It may contain information that is privileged, confidential or otherwise protected from disclosure. Any review, dissemination or use of this transmission or its contents by persons other than the intended addressee(s) is strictly prohibited. If you have received this transmission in error, please notify this office immediately and e-mail the original at the sender's address above by replying to this message and including the text of the transmission received.

4 3

no whois record for another crappy ISP
by U.Mutlu 01 Feb '12

01 Feb '12

Hi, does anybody know why there is no whois record for the so-called ISP named "jazztel.es" ? It just says: "This TLD has no whois server" How is such possible?

6 12

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 5, Issue 7 Re: What is Personal information?
by Wout de Natris 30 Jan '12

30 Jan '12

All, The Dutch DPA does not, by way of policy, respond to requests to look into policies upfront. No exceptions allowed. This is how the policy was explained to me last year by the DPA. So even if RIPE NCC wants to have a ruling this way, she will not get one. So it's of no use to keep discussing this part here. The DPA may look into complaints though. In this it should not matter where a complaint comes from. Whether or not she does, is at her discretion. So if you've filed a complaint, you need to go through that channel and follow it up with a call, e.g. There's nothing that this WG could do to alter this. Regards, Wout de Natris - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - De Natris Consult Raaphorst 33 Tel: +31 648388813 2352 KJ Leiderdorp Skype: wout.de.natris denatrisconsult(a)hotmail.nl http://www.denatrisconsult.nl Blog http://woutdenatris.wordpress.com > Message: 1 > Date: Tue, 17 Jan 2012 08:20:06 -0500 > From: "russ(a)consumer.net" <russ(a)consumer.net> > Subject: Re: [anti-abuse-wg] What is Personal information? > To: "anti-abuse-wg(a)ripe.net" <anti-abuse-wg(a)ripe.net> > Message-ID: <4F157586.5030108(a)consumer.net> > Content-Type: text/plain; charset=UTF-8; format=flowed > > >In other words, Russ could probably approach the Dutch privacy > regulator with a query, cc RIPE NCC legal, and then accept whatever > ruling applies? I seriously doubt if anybody on this list >other than > the three parties above is qualified to comment definitely on this > issue. So - Russ, please take it offlist, and do come back to let us > know what ruling you get. I personally would be >interested in what you > learn. > > > >Under Dutch (and European) privacy directives, any information that > can uniquely distinguish a natural person (ie. NOT 'a business'...) is > to be considered 'personal information'. So, an IP >address CAN be > personal information, if the data collector can link it to a person > without too much hassle. Think webshops who log your IP at logon, they > can connect that to your account >data, so in *that* case an IP address > is logged by the shop is indeed considered 'personal information' and > must be protected by the shop accordingly. In your case with RIPE, your > IP address is >probably not considered 'personal information'. IANAL. > Check out http://en.wikipedia.org/wiki/Data_Protection_Directive. > > > The same reasoning that says RIPE database information is "personal > information" can be applied to IP addresses (in some cases). > If the IP is registered you would get those contacts by running a whois > (or doing a reverse lookup would identify a domain which > can bee looked up). It seems to me if the RIPE database entries are > "personal information" then so it the IP address associated > with that record. Even if is is personal information the issue is then > whether they gave permission to have it posted in a public database. > > If the RIPE NCC legal department had an answer it would have been put on > the public reports and/or they would answer the inquiries > put forth my me and others. I have sent an inquiry to the Dutch > privacy office but, while these offices sound good in theory, > they are usually a bureaucratic nightmare. Since I dot live within the > region I think it is unlikely I would get an answer. If the process > is legitimate I would have thought RIPE would have gone to the office > for a ruling before they changed the access policy. the fact is > RIPE won't supply their legal department's analysis and they won't > respond to my request to have the Dutch privacy office review the > matter. There would be a much better chance of getting a ruling if RIPE > would ask them ... but they don't seem to want to do that > so I can only speculate why they would not want to do the obvious thing. > > Thank You > > > >

13 35