- anti-abuse-wg - mailman.ripe.net

Re: [anti-abuse-wg] update on netsecdb project
by Brian Nisbet 08 Apr '10

08 Apr '10

Frank, I have assumed, hopefully correctly, that you meant this mail to go to the list again, so I have copied my reply there. "Dipl-Inform. Frank Gadegast" wrote the following on 06/04/2010 16:03: > > Hello Brian, > >>> How can not anybody have an idea, how to solve the problem ? >> >> Many people have many ideas, not all of them work. There remains no >> silver bullet. And any recommendation made still needs to be adopted. > > I just discribed one arround launch time. > RIPE should urged all members to stop spam originating from their networks. You did not describe a silver bullet. The RIPE community has urged their members to stop spam and abuse for years, RIPE-409 says it quite plainly, this has been the repeated advice. There are potential ways of enforcing this, but please do not claim that what has been discussed so far today will suddenly stop network abuse. >>> Usally there are to many ideas resulting in at least something to do. >> >> And many things have been discussed, and often solutions suggested. It > > Not on the list. And the minutes of each meeting are posted to the list. So far no discussion has come out of them. >> is up to people to implement those suggestions or to make proposals to >> the RIPE community and perhaps ask the NCC to undertake a task. In >> addition, as we discussed in Lisbon and as we will be discussing again >> in Prague, the two chairs of the WG have been working with the NCC and >> international law enforcement to look at ways of furthering cooperation > > goverments ? > this will make all worse and slower ... The aim is to get governments and LEAs onside, to examine policies and procedures at RIR level and to avoid the making of necessary legislation and to keep the bottom up consensus approach. However there is no way that governments will not be involved, the idea is to take their input and show them we, as a community, are acting. >> and putting procedures in place that can more directly tackle network >> abuse. However this is, as you must appreciate, not a simple or fast task. >> >>>> we hope, in May, to chair another productive meeting. >>> >>> What will be discussed there ? >>> Agenda ? >> >> We're trying to finalise the agenda at the moment, but the work that is >> taking place with the NCC, the RIPE community and the LEAs will be > > Well, please post it to the list, so that it can be discussed before > its finalized. I will post an agenda, but I'm not sure what discussion there is likely to be as my two calls for agenda items have, so far, met with one single response. Equally, the agenda of any WG is reasonably mutable and on occasion has been finalised an hour or so before the meeting, so there will be plenty of time for discussion. >> playing a major part. I hope to have a first draft by the end of this >> week. Obviously if any proposals are brought to the WG before the >> meeting on Thursday 6th, discussion time for them will be allocated on >> the agenda. > > All this should happen all on the list, not everybody can attend meetings. Apologies, I should have been clearer. As has been stated elsewhere and, I believe, on this list, while policy proposals will, undoubtedly, be discussed at meetings, the primary place to discuss policy is the WG mailing list and there is no intention or plan to purely discuss things at meetings. Brian.

10 17

Re: [anti-abuse-wg] update on netsecdb project
by Frank Gadegast 07 Apr '10

07 Apr '10

> > HI, Frank! Hi, > Feel your frustration. But do a quick google search on FUSSP. April fools day if over ... > Anyway, your solution would impose costs on others (i.e. RIPE, other ISPs), Sure, but they can easily be shared with the same method that RIPE uses for the member fees, big ISPs pay more, small ones less. In fact it will be simple some costs at RIPE. And who cares what a spamming provider will have to invest to get his customers cleaned ? Im somehow getting the idea, that those people on this list that are always AGAINST any idea ARE these providers, that are too lazy to control their spambotted customers. Could that be the final reason why we do not find a solution ? I added some more statistics to our own blacklist. Then I will run the ASes of everyboy on this list Im aware off through this statistics next month and gonna post the results to this list, lets see ... Maybe everybody on this list running a blacklist or statistics about spam he receives should do this too. > and would be easily abused to destroy an ISP you don't like. How that ? By sending fake reports to RIPE clearing address ? I recommended that the ISP has to categorize the report himself like you can do on spamcop too, he can simply select "no spam from us" and thats it. And RIPE can control the behaviour of the ISP easily with some simple statistics ... The system should work fuzzy-like, only the really bad ones get punished and the ones with little problems get away. And RIPE can easily reject reports coming from the same IPs all the time ... or the ISP under a fake attack can talk to RIPE about it, that problem isnt really hard to solve. Kind regards, Frank -- PHADE Software - PowerWeb http://www.powerweb.de Inh. Dipl.-Inform. Frank Gadegast mailto:frank@powerweb.de Schinkelstrasse 17 fon: +49 33200 52920 14558 Nuthetal OT Rehbruecke, Germany fax: +49 33200 52921 ====================================================================== Public PGP Key available for frank(a)powerweb.de > > > -- > Esa Laitinen > Tel. +41 76 200 2870 > skype/yahoo: reunaesa > > --000e0cd1145cbf98e60483a02e56 > Content-Type: text/html; charset=ISO-8859-1 > > HI, Frank! Feel your frustration. But do a quick google search on FUSSP. Anyway, your solution would impose costs on others (i.e. RIPE, other ISPs), and would be easily abused to destroy an ISP you don't like. > -- Esa Laitinen Tel. +41 76 200 2870 skype/yahoo: reunaesa > > --000e0cd1145cbf98e60483a02e56-- >

2 1

Re: update on netsecdb project
by Dr. Alexander K. Seewald 06 Apr '10

06 Apr '10

IMHO just having blacklists based on IP addresses is not enough: * rapidly increasing mobile internet (which has dynamic IPs unless one keeps a connection open indefinitely - hardly ever the case) * tendency to reuse one bot for an ever decreasing number of spam messages - so blacklist are and always getting to be less helpful. We did an analysis of a commen DNSBL and found that only 3% of active bots could be found there at the timepoint when they were active. Roughly the same number (6%) can be got when comparing with originating IPs from incoming spam. If spam volume is sinking - and it definitely does at least for me - this has nothing to do with any countermeasures but is probably just a delayed effect from the economic crisis. Let's not delude ourselves here. Actually, our paper on automating botnet tracking was downloaded quite often (we got a mail from Computers & Security / Elsevier that it was among the top 25 downloaded paper in Q4/2009 - whatever that means ;-) so there seems to be a lot of interest in tracking bots with more intelligent techniques. My opinion was and still is that we need to automate detection and tracking techniques and not necessarily rely on old obsolete filtering techniques (although they can be helpful in some cases). But I see the limits of RIPE to make such an approach happen and frankly I don't see any other supranational organization that can pull that off. So here's to hoping the spammers die out from the current crisis and we can switch off all our spamfilters... Best, Alex -- Dr. Alexander K. Seewald Seewald Solutions www.seewald.at Tel. +43(664)1106886 Fax. +43(1)2533033/2764

3 3

Re: [anti-abuse-wg] update on netsecdb project
by Brian Nisbet 06 Apr '10

06 Apr '10

Frank, As discussed, I have copied my reply to the list. >> There has been an amount of discussion on this topic in both AA and DB >> working groups over the last few years but no concensus has been reached. >> >> At the meeting in Lisbon it was agreed between DB and AA that as no >> further comments had been made, the matter was to be closed. This does >> not, obviously, mean that it can't be raised again and both WGs would be >> most interested in any proposals you may have. > > This is simply weird. > How can anybody not agree what Spam is ? Many people agree what spam is, others disagree, the RIPE community is made up of many different people, but I'm not sure why a definition is important to this conversation? The matter was closed in Lisbon because no proposal had been produced since the last time one was asked for onlist. If there is now to be a proposal, then discussion will restart. > How can not anybody have an idea, how to solve the problem ? Many people have many ideas, not all of them work. There remains no silver bullet. And any recommendation made still needs to be adopted. > Usally there are to many ideas resulting in at least something to do. And many things have been discussed, and often solutions suggested. It is up to people to implement those suggestions or to make proposals to the RIPE community and perhaps ask the NCC to undertake a task. In addition, as we discussed in Lisbon and as we will be discussing again in Prague, the two chairs of the WG have been working with the NCC and international law enforcement to look at ways of furthering cooperation and putting procedures in place that can more directly tackle network abuse. However this is, as you must appreciate, not a simple or fast task. >> In this policy Tobias Knecht (tk(a)abusix.org) has stated that if he is >> successful in APNIC he plans to propose something similar in the RIPE >> region. I would suspect he is the best person to talk to about >> collaboration. > > I am already talking to him. Good stuff. > But as you know: he will need support from everybody to bring > this proposal also to RIPE. So it would be really nice if people on this > list dont strike him down because of politeness and instead support > what hes doing. Tobias and abusix have produced a number of different opinions in a very short period of time in operation, or at least in wide circulation. There is no mandate on how the members of any WG should treat the proposals of others, save to give them an honest and fair reading and treat everyone with respect. How the proposal is greeted will depend on how it is presented, but obviously the chairs will do what they can to allow for that fair hearing. >> we hope, in May, to chair another productive meeting. > > What will be discussed there ? > Agenda ? We're trying to finalise the agenda at the moment, but the work that is taking place with the NCC, the RIPE community and the LEAs will be playing a major part. I hope to have a first draft by the end of this week. Obviously if any proposals are brought to the WG before the meeting on Thursday 6th, discussion time for them will be allocated on the agenda. Brian.

1 0

Spam sent over IPv6 - See results on RIPE Labs
by Mirjam Kuehne 06 Apr '10

06 Apr '10

Dear colleagues, Sorry this comes a little late to this list. Last week we published some data about spam we receive over IPv6. Find the method and the results on RIPE Labs: http://labs.ripe.net/content/spam-over-ipv6 We will continue to measure this. If you have any comments or suggestions, please let us know. You can leave comments in the forum listed at the end of the article or send mail directly to me. Kind Regards, Mirjam Kühne RIPE NCC

1 0

RIPE 60 Agenda Items Reminder.
by Brian Nisbet 31 Mar '10

31 Mar '10

Afternoon, As we're now just over a month away from RIPE 60 in Prague, I'd like to remind you all that there is still agenda space for the WG session on Thursday 6th May at 16:00. As always we are interested in policy proposals, discussion points, presentations on new anti-abuse policies or methods and a wide range of other possible agenda items. Thanks, Brian.

1 0

RIPE 60 Agenda Items/Presentations
by Brian Nisbet 10 Mar '10

10 Mar '10

Colleagues, As we rapidly approach RIPE 60 now would be a wonderful time to propose material for the WG session, taking place on Thursday 6th May at 16:00. As always we are interested in policy proposals, discussion points, presentations on new anti-abuse policies or methods and a wide range of other possible agenda items. Richard and I look forward to seeing as many of you in Prague as possible! Regards, Brian.

1 0

Invalid abuse contact - reported to RIPE (fwd)
by Peter Hakanson 16 Dec '09

16 Dec '09

---------- Forwarded message ---------- Date: Wed, 16 Dec 2009 09:09:25 -0600 From: Alfred Moshurchak <alfredm(a)sasktel.net> To: tangoit(a)tango.lu, ops(a)ripe.net Cc: vpiocel(a)tango.lu, anti-abuse-wg(a)ripe.net Subject: [anti-abuse-wg] Invalid abuse contact - reported to RIPE The original message was received at Wed, 16 Dec 2009 08:27:06 -0600 from gluon [127.0.0.1] This seems to be a tele2 company, try mailing staff(a)swip.net as they has done a proper job. peter h ----- The following addresses had permanent fatal errors ----- <abuse(a)tele2.lu> (reason: 550 5.1.1 <abuse(a)tele2.lu>: Recipient address rejected: User unknown) ----- Transcript of session follows ----- ... while talking to mail.tango.lu.: >>> DATA <<< 550 5.1.1 <abuse(a)tele2.lu>: Recipient address rejected: User unknown 550 5.1.1 <abuse(a)tele2.lu>... User unknown <<< 554 5.5.1 Error: no valid recipients 212.66.87.232 = [ ] (Asked whois.ripe.net:43 about 212.66.87.232) inetnum: 212.66.64.0 - 212.66.95.255 netname: LU-TANGOMOBILE-19990118 descr: Tango Mobile S.A. country: LU org: ORG-TMS6-RIPE admin-c: tvdw14-ripe tech-c: VP612-RIPE status: ALLOCATED PA mnt-by: RIPE-NCC-HM-MNT mnt-lower: TANGO-MNT mnt-routes: TANGO-MNT mnt-domains: TANGO-MNT source: RIPE Filtered organisation: ORG-TMS6-RIPE org-name: Tango Mobile S.A. org-type: LIR descr: tango-mnt address: Tango Mobile S.A. Route de Luxembourg 177 L-8077 Bertrange Luxembourg phone: 35227777101 fax-no: 35227777333 e-mail: tangoit(a)tango.lu admin-c: tvdw14-ripe admin-c: vp612-ripe mnt-ref: mnt-tango mnt-ref: RIPE-NCC-HM-MNT mnt-ref: TANGO-MNT mnt-by: RIPE-NCC-HM-MNT source: RIPE Filtered person: Tanguy van de Walle address: Tango Mobile S.A. address: rue de Luxembourg 177 address: 8077 Bertrange address: Luxembourg phone: 35227777445 nic-hdl: TvdW14-RIPE source: RIPE Filtered person: Vincent Piocel address: Tango Mobile SA address: 177 rue de Luxembourg address: L-8077 Bertrange address: Luxembourg mnt-by: tango-mnt e-mail: vpiocel(a)tango.lu phone: 352 27 777 440 fax-no: 352 27 777 333 nic-hdl: VP612-RIPE source: RIPE Filtered route: 212.66.64.0/19 descr: Tele2 Luxembourg descr: TELE2 / SWIPNET descr: In case of improper use originating from our network please mail abuse(a)tele2.lu origin: AS9045 mnt-by: TELE2EUROPE-MNT mnt-routes: AS1257-MNT source: RIPE Filtered

1 0

Invalid abuse contact - reported to RIPE
by Alfred Moshurchak 16 Dec '09

16 Dec '09

The original message was received at Wed, 16 Dec 2009 08:27:06 -0600 from gluon [127.0.0.1] ----- The following addresses had permanent fatal errors ----- <abuse(a)tele2.lu> (reason: 550 5.1.1 <abuse(a)tele2.lu>: Recipient address rejected: User unknown) ----- Transcript of session follows ----- ... while talking to mail.tango.lu.: >>> DATA <<< 550 5.1.1 <abuse(a)tele2.lu>: Recipient address rejected: User unknown 550 5.1.1 <abuse(a)tele2.lu>... User unknown <<< 554 5.5.1 Error: no valid recipients 212.66.87.232 = [ ] (Asked whois.ripe.net:43 about 212.66.87.232) inetnum: 212.66.64.0 - 212.66.95.255 netname: LU-TANGOMOBILE-19990118 descr: Tango Mobile S.A. country: LU org: ORG-TMS6-RIPE admin-c: tvdw14-ripe tech-c: VP612-RIPE status: ALLOCATED PA mnt-by: RIPE-NCC-HM-MNT mnt-lower: TANGO-MNT mnt-routes: TANGO-MNT mnt-domains: TANGO-MNT source: RIPE Filtered organisation: ORG-TMS6-RIPE org-name: Tango Mobile S.A. org-type: LIR descr: tango-mnt address: Tango Mobile S.A. Route de Luxembourg 177 L-8077 Bertrange Luxembourg phone: 35227777101 fax-no: 35227777333 e-mail: tangoit(a)tango.lu admin-c: tvdw14-ripe admin-c: vp612-ripe mnt-ref: mnt-tango mnt-ref: RIPE-NCC-HM-MNT mnt-ref: TANGO-MNT mnt-by: RIPE-NCC-HM-MNT source: RIPE Filtered person: Tanguy van de Walle address: Tango Mobile S.A. address: rue de Luxembourg 177 address: 8077 Bertrange address: Luxembourg phone: 35227777445 nic-hdl: TvdW14-RIPE source: RIPE Filtered person: Vincent Piocel address: Tango Mobile SA address: 177 rue de Luxembourg address: L-8077 Bertrange address: Luxembourg mnt-by: tango-mnt e-mail: vpiocel(a)tango.lu phone: 352 27 777 440 fax-no: 352 27 777 333 nic-hdl: VP612-RIPE source: RIPE Filtered route: 212.66.64.0/19 descr: Tele2 Luxembourg descr: TELE2 / SWIPNET descr: In case of improper use originating from our network please mail abuse(a)tele2.lu origin: AS9045 mnt-by: TELE2EUROPE-MNT mnt-routes: AS1257-MNT source: RIPE Filtered

1 0

Reporting email abuse
by Choice Hosting Support 14 Dec '09

14 Dec '09

Hello Support Our hosting servers seem to be receiving bank phishing spam mail from one of your IP addresses. Could you please look into this? We have included the headers of one of these mails below. If you have any questions, please feel free to contact us. Kind Regards Stephen Waters www.ChoiceHosting.co.za Tel. 0878 058 729 Email: support(a)choicehosting.co.za Return-path: <internet(a)absa.co.za> Envelope-to: support(a)choicehosting.co.za Delivery-date: Mon, 14 Dec 2009 07:16:33 +0200 Received: from mx.bsslaw.net ([194.154.196.196]) by host.choiceserver1.com with esmtp (Exim 4.69) (envelope-from <internet(a)absa.co.za>) id 1NK3IK-0007rG-Fv for support(a)choicehosting.co.za; Mon, 14 Dec 2009 07:16:29 +0200 Received: from MAIL-SERVER.BSSLAW.local (Not Verified[192.168.10.1]) by mx.bsslaw.net with MailMarshal (v6,7,2,8378) id <B4b25ca050000>; Mon, 14 Dec 2009 06:15:49 +0100 Received: from User ([41.28.112.10]) by MAIL-SERVER.BSSLAW.local with Microsoft SMTPSVC(6.0.3790.3959); Mon, 14 Dec 2009 06:15:48 +0100 From: "ABSA ONLINE"<internet(a)absa.co.za> Subject: {Spam?} {Disarmed} ACCOUNT NOTIFICATION Date: Mon, 14 Dec 2009 05:16:12 -0000 MIME-Version: 1.0 Content-Type: text/html; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Bcc: Message-ID: <NODE01PXCFbN4TZyabY000001c6(a)MAIL-SERVER.BSSLAW.local> X-OriginalArrivalTime: 14 Dec 2009 05:15:48.0833 (UTC) FILETIME=[7F60F510:01CA7C7C] X-Choicehosting-MailScanner-Information: Please contact the ISP for more information X-Choicehosting-MailScanner-ID: 1NK3IK-0007rG-Fv X-Choicehosting-MailScanner: Found to be clean X-Choicehosting-MailScanner-SpamCheck: spam, SpamAssassin (not cached, score=11.434, required 5, FORGED_MUA_OUTLOOK 4.20, FORGED_OUTLOOK_HTML 0.00, FORGED_OUTLOOK_TAGS 0.00, HTML_IMAGE_ONLY_28 1.52, HTML_MESSAGE 0.00, MIME_HTML_ONLY 1.67, MISSING_HEADERS 1.58, SPF_SOFTFAIL 0.65, SUBJ_ALL_CAPS 1.81) X-Choicehosting-MailScanner-SpamScore: sssssssssss X-Choicehosting-MailScanner-From: internet(a)absa.co.za -----Original Message----- From: ABSA ONLINE [mailto:internet@absa.co.za] Sent: 14 December 2009 07:16 Subject: {Spam?} {Disarmed} ACCOUNT NOTIFICATION Absa Bank Group<http://www.absa.co.za/absacoza/images/homepage/logo_btm.gif> function checkForm() { var valid = false; if (document.form01.sq.value == '') { alert("Please type the word(s) you wish to search for."); } else { valid = true; } return valid; } INTRODUCING: Absa New Secure Server We have been warning customers to upgrade to our new server. Fraudsters have devised a new method of defrauding customers. With this new fraud scheme they use the traditional method of identity theft (phishing), Hacking into customers online banking, to avoid phishing and identity theft we advice you login to our secure server Go straight to your Absa for procedures to follow: Click Here to continue <http://marionlodge.sproductions.co.za/catalog/pub/get_ready/absa.htm> Absa Bank will not be responsible for loss of funds to hackers as a result of failure to comply with this important new directives. We are committed to serving you better. Bank and stay safe online.Security Management Absa Bank Group Please do not reply to this e-mail. Mail sent to this address cannot be answered. For assistance, log in to your absa Online account and choose the "Help" link on any page. absa bank Email ID # 1009

2 1