- anti-abuse-wg - mailman.ripe.net

Draft Minutes - RIPE 63
by Brian Nisbet 04 Jul '11

04 Jul '11

Colleagues, These are the draft minutes from RIPE 53, apologies for the delay, the lovely folk from the NCC had them a while ago, I was just slow in reviewing them and passing them on. As always, please let me know if you have any comments or corrections: RIPE Anti-Abuse Working Group: Draft Minutes – RIPE 62 Thursday, 4 May 2011 14:00-15:30 Co-Chairs: Brian Nisbet and Tobias Knecht Scribe: Fergal Cunningham Chat Monitor: Sandra Brás A. Administrative Matters –Welcome Working Group co-Chair Brian Nisbet welcomed attendees. He thanked the scribe, chat monitor and stenographer, and he asked that those asking questions clearly state their name and affiliation. –Approve Minutes from RIPE 61 Brian noted that there were some initial comments and the minutes were updated accordingly. He asked if there were any further comments. There were none and Brian deemed the minutes from RIPE 61 to be formally approved. –New Working Group Co-Chair Tobias Knecht was formally approved as the new Anti-Abuse Working Group co-Chair. Brian said that Tobias would help to resurrect the best common practice document process. Brian said two documents would be produced – an administrative document and a technical document. –Finalise agenda There were no additions to the agenda. B. Update B1. Recent List Discussion Brian noted that there was a lot of discussion in the past few months. He said the Abuse Contact Task Force was addressing some issues and some were being addressed by the ripe-517 Closure and Deregistration document. He proposed that the working group not delve into those issues at that time. B2. Admin Tools for Blackhole Administration - Ingvar Mattsson, Google The presentation is available at: http://ripe62.ripe.net/presentations/155-blackholeslides.pdf David Freedman from Claranet said this approach was to be commended. He said he had a similar in-house tool and if anyone wanted to know more about that he could show them afterwards. He said the main problem is if prefixes are not reaped and remain in blackholing. He said the support team needs to be aware of what’s going on and it must be done in an intelligent way. Ignvar asked if it was more pleasant to use blackholing and David said it was. B3. Arbor 2010 Infrastructure Security Report - Darren Anstee, Arbor Networks The presentation is available at: http://ripe62.ripe.net/presentations/88-Darren-Anstee-AA-RIPE-2011-DDoS_Tre… Ian Meikle, RIPE Measurement, Analysis and Tools (MAT) Working Group co-Chair, noted that Darren would talk about the ATLAS initiative at the MAT Working Group session. Wout de Natris, Chair of the Cybercrime Working Party, asked if the rise of DDoS attacks was down to criminal or political reasons. Darren said he was not sure. He thought there might be a fair mixture of both, but he said people could look and draw their own conclusions. Wout said he attended a meeting on botnets, where it was noted that attacks from mobile devices were not a problem yet. He asked if this was becoming a problem. Darren said more attack traffic was coming from mobile devices. He said Symantec have seen a growth in malware targeted at smart devices and it is probably only a matter time before we see attacks coming from smart devices. Wout asked if Darren had tips for developing countries. Darren said diagnostic ACLs and flow tools could be used if these countries did not want to use commercial products to detect DDoS attacks. Daniel Karrenberg, Chief Scientist at the RIPE NCC, asked if on the Port 53 attacks there was any differentiation on whether the attack traffic was queries or responses. Darren said there was not. Daniel asked for more details, saying it would be interesting to see how the relative proportion was reflected in the attacks. He said he suspected a fair amount of reflection was going on. Darren said he would be asking what people wanted to see from the Atlas initiative, and he said this is one area they would be looking at. Paul Germano, Google, asked if the data received was just megabits per second and Darren said this was indeed the case. C. Policies –Abuse Contact Management Task Force Brian said that the three proposals (2010-08, 2010-09 and 2010-10) that were presented at RIPE 61 were withdrawn and that the Abuse Contact Management Task Force was formed to look at the issues or concerns in the three proposals. Brian gave an update from the task force, which is available at: http://ripe62.ripe.net/presentations/175-acm_tf_ripe62.ppt Brian asked if there were any questions. There were no questions, and Brian took this to be approval to continue with the work of the task force. D. Interactions D1. Working Groups Brian said the Database Working Group was the one the Anti-Abuse Working Group interacted with the most. He said that the main interaction with that group currently was concerned with the work of the Abuse Contact Management Task Force. D2. Cybercrime Working Party Update - Wout de Natris (No presentation was uploaded) Wout de Natris, Chair of the Cybercrime Working Party (CCWP), described the meetings he attended and presented at on behalf of the CCWP. He said that the main area the CCWP was looking into was training law enforcement agencies (LEAs) on the use of tools and databases that would help them in their work. He said a template for information requests would be created to send requests to the RIPE NCC. He said a list of LEA contacts would enable LEA officials to easily contact each other and share experiences. He said LEAs would look at coming up with a list of topics that they would want to discuss with the RIPE community. Wout asked the RIPE community what it would like to discuss with LEAs. He said people should bring issues to the CCWP if they wanted clarification from LEAs. Wout concluded by noting that the CCWP was making progress, and he reiterated that the process was a two-way street. He said LEAs could use the group to bring forward their concerns and the RIPE community could do likewise. Frank Salanitri, APNIC, said APNIC’s IRT object contact address received up to 30,000 abuse mails and that it was impossible to check these on an individual basis. He suggested they might be used for IP reputation services. He said, potentially, they could show the most abused allocations and the countries the abuse came from. He said this information could be logged in a database that could be made available to researchers. Wout asked if APNIC had contacted the Australian and New Zealand active anti-spam LEAs. Pablo Hinojosa, APNIC Public Affairs Officer, said APNIC was corresponding with these groups and was actively looking for ways to increase cooperation. D3. RIPE NCC Government/LEA Interactions Update Brian said a number of things have happened to give encouragement to RIPE and the RIPE NCC’s interactions with LEAs. He said the engagement of LEAs with the RIPE community has increased, and they have shown a greater understanding of the issues at hand. He said LEAs recognised the need to keep a good registry database. Brian said LEAs were happy with RIPE Policy Proposal 2010-06 on registration of IPv6 in the RIPE Database. He said the RIPE NCC procedural document, ripe-517, on closure and deregistration of LIRs was a positive step because it reduces the ability to abuse mechanisms there. Brian added that they also talked about what is likely to happen following the exhaustion of the IPv4 address pool. He said interaction with both LEAs and government agencies would continue. Brian noted that there are issues being discussed on the RIPE Address Policy Working Group mailing list that the Anti-Abuse Working Group should look at. He said the RPKI discussion should be of particular note and he asked everyone to pay close attention to these issues. X. AOB There was no other business to attend to. Brian asked for items for RIPE 63. He noted that Tobias would talk about the best common practice documents at RIPE 63 and he promised to have those documents posted to the mailing list. Brian thanked the attendees and said he looked forward to the next meeting in Vienna. Recordings of all presentations and discussion in the RIPE Anti-Abuse Working Group session at RIPE 62 are available at: http://ripe62.ripe.net/archives#Thursday

2 2

[SUPPORT #SRI-136-19233]: [ncc-announce] First iPad Winner: RIPE NCC Membership and Stakeholder Survey 2011
by Gert Doering 31 May '11

31 May '11

Hi, On Tue, May 31, 2011 at 08:40:21AM +0200, Per Heldal wrote: > Please configure your Kayoko system so that it doesn't send automated > responses to mailinglist messages. Over in the address policy WG, we just unsubscribe everyone who sends back autoreplies to mailing list articles. Works wonders. Gert Doering -- APWG chair -- did you enable IPv6 on something today...? SpaceNet AG Vorstand: Sebastian v. Bomhard Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 (89) 32356-444 USt-IdNr.: DE813185279 Ticket Details --------------------------------- Ticket ID: SRI-136-19233 Department: Support Type: Issue Status: Open Priority: Medium Support Center: http://support.netlogics.nl/index.php?/default_import

2 1

[SUPPORT #SRI-136-19233]: [ncc-announce] First iPad Winner: RIPE NCC Membership and Stakeholder Survey 2011
by rodolfo.garciapenas＠telefonic a.es 31 May '11

31 May '11

Per, is a M2M conversation, do not interrupt it ;-) Per Heldal <support@netlo gics.nl> Para Enviado por: db-wg(a)ripe.net db-wg-admin@ri cc pe.net Asunto [db-wg] [SUPPORT 31/05/2011 #SRI-136-19233]: 09:59 [ncc-announce] First iPad Winner: RIPE NCC Membership and Stakeholder Survey 2011 Por favor, Clasificación responda a support@net logics.nl Hi there! Please configure your Kayoko system so that it doesn't send automated responses to mailinglist messages. //per On 30/05/11 16:29, Support Netlogics wrote: > Axel Pawlik, > > Thank you for contacting us. This is an automated response confirming the receipt of your ticket. One of our agents will get back to you as soon as possible. For your records, the details of the ticket are listed below. When replying, please make sure that the ticket ID is kept in the subject line to ensure that your replies are tracked appropriately. > > Ticket ID: SRI-136-19233 > Subject: [ncc-announce] First iPad Winner: RIPE NCC Membership and Stakeholder Survey 2011 > Department: Support > Type: Issue > Status: Open > Priority: Medium > > You can check the status of or reply to this ticket online at: http://support.netlogics.nl/index.php?/default_import/Tickets/Ticket/View/S… > > Kind regards, > > PE NetLogics BV > > ------------------------------------------------------ > Support Center: http://support.netlogics.nl/index.php?/default_import Ticket Details Ticket ID: SRI-136-19233 Department: Support Type: Issue Status: Open Priority: Medium Support Center: http://support.netlogics.nl/index.php?/default_import Ticket Details --------------------------------- Ticket ID: SRI-136-19233 Department: Support Type: Issue Status: Open Priority: Medium Support Center: http://support.netlogics.nl/index.php?/default_import

1 0

[SUPPORT #SRI-136-19233]: [ncc-announce] First iPad Winner: RIPE NCC Membership and Stakeholder Survey 2011
by Gert Doering 31 May '11

31 May '11

Hi, > From: Gert Doering <support(a)netlogics.nl> one night, I'd really like to meet the person who thought that ticket systems should be allowed to re-mail incoming mails to "every mail address that ever came near this ticket" *WITH A FORGED FROM: HEADER* in a dark alley... I am not support(a)netlogics.nl, and I take offense in seeing my mails being redistributed to *different* lists, with a faked header, HTML body added, and my name left on top of it. Gert Doering -- APWG chair -- did you enable IPv6 on something today...? SpaceNet AG Vorstand: Sebastian v. Bomhard Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 (89) 32356-444 USt-IdNr.: DE813185279 Ticket Details --------------------------------- Ticket ID: SRI-136-19233 Department: Support Type: Issue Status: Open Priority: Medium Support Center: http://support.netlogics.nl/index.php?/default_import

1 0

First iPad Winner: RIPE NCC Membership and Stakeholder Survey 2011
by Axel Pawlik 30 May '11

30 May '11

[Apologies for duplicate emails] Dear colleagues, You still have time to take part in the RIPE NCC Membership and Stakeholder Survey 2011. The survey can be found at: https://www.ripe.net/survey2011 ================= First iPad Winner ================= Congratulations to James Blessing, who was chosen at random by the Oxford Internet Institute (OII) as the winner of the "early bird" prize. The RIPE NCC will give four more iPads to respondents chosen at random by the OII. The prize winners will be drawn from all respondents who complete the survey by the closing date of 10 June. ========== The Survey ========== The results of this survey will be crucial for the RIPE NCC in determining its strategy for the years ahead. Analysis of the survey results will be conducted by the OII, and all identifying information will be removed before the data is given to the RIPE NCC. For the first time, the survey is open to all stakeholders in the RIPE community in addition to RIPE NCC members. We aim to receive 1,000 responses by 10 June, so we encourage you to take 10-15 minutes to complete the survey. We look forward to receiving your input. Best regards, Axel Pawlik Managing Director RIPE NCC

1 0

2010-08 Policy Proposal Withdrawn (Abuse Contact Information)
by Emilio Madaio 10 May '11

10 May '11

Dear Colleagues, The proposal 2010-08, "Abuse Contact Information", has been withdrawn. It is now archived and can be found at: http://www.ripe.net/ripe/policies/proposals/2010-08 Reason for withdrawal: a task force is working to solve the implementation issues pointed out by the proposal discussion. The possible policy consequences will be considered with a new proposal in the future. Regards Emilio Madaio Policy Development Officer RIPE NCC

1 0

inetnum: 212.86.64.0 - 212.86.79.255
by Reza Farzan 10 May '11

10 May '11

Hello, Thank you for accepting me as a new member. Based on my research, I noticed that [inetnum: 212.86.64.0 - 212.86.79.255] does not have any valid contact e-mail listed. The two contact e-mail addresses that appear both have changed: changed: shakeri(a)gmail.com 20100605 changed: mohammadhaeri(a)gmail.com 20100521 Would it be possible to ask this network to provide valid contact e-mail address(s)? Please advise me. Thank you, Reza Farzan rezaf(a)mindspring.com _____ No virus found in this message. Checked by AVG - www.avg.com Version: 10.0.1325 / Virus Database: 1500/3626 - Release Date: 05/09/11

6 6

[Ticket#2011050910000015] brute force attack detect from your network
by Abuse CloudHost IT 09 May '11

09 May '11

Hello, We have establishes brute force attack detect from your network! IP Address: "213.109.29.142" Date start: "May 9 03:38:49" Date stop: "May 9 04:01:11" IP Address "213.109.29.142" added to the blacklist. -- Dmitrijs Agijevics Cloud Hosting IT Tālrunis: +371 66 66 29 69 E-pasts: info(a)cloudhosting.lv [1]http://www.cloudhosting.lv -- [1] http://www.cloudhosting.lv

5 4

Draft Agenda, RIPE 62
by Brian Nisbet 14 Apr '11

14 Apr '11

Colleagues, This is the draft agenda for the meeting in Amsterdam. If anyone has anything they'd like to add, it's not too late, but time is tight! Anti-Abuse Working Group Agenda - RIPE 62 A. Administrative Matters * Welcome * Scribe, Jabber, Stenography * Microphone Etiquette * Approve Minutes from RIPE 61 * New WG Co-Chair * Finalise agenda B. Update * B1. Recent List Discussion * B2. Admin Tools for Blackhole Administration - Ingvar Mattsson * B3. Arbor 2010 Infrastructure Security Report - Darren Anstee, Arbor Networks C. Policies * Abuse Contact Management TF D. Interactions * D1. Working Groups * D2. CCWP Update - Wout de Natris * D3. RIPE NCC Gov/LEA Interactions Update X. A.O.B. Z. Agenda for RIPE 63; Plenary Presentations

1 0

Re: [anti-abuse-wg] Proposed New Working Group Co-Chair
by alireza 07 Apr '11

07 Apr '11

1 0