- anti-abuse-wg - mailman.ripe.net

False address in database
by O. Kolesnikov 08 Dec '09

08 Dec '09

IP 89.248.175.0 - 89.248.175.127 Fake registration. No such company, no such place in Moscow (Chistie Prudi 22/1). (No "Chistie Prudi" street in "Moscow Russia"; Chistie Prudi - the name of ponds in old part of Moscow, here only 2 ponds, not 22 ;)) proper street is named "Chistoprudny boulevard". It just about "Thames 22/1, London GB".) In addition 89.248.175.0-24 = "Route object" for Ecatel (AS29073) hosting provider (ecatel.net) - known as hoster for spambots and malware. This provider, registered in Great Britain, used datacenter in Amsterdam, has no office (real address, but nobody from this company was found here), no phone, no website. Obviously, this false registration is used for the purpose of camouflaging of illegal activity on this provider. OK.

1 0

RIPE 59 WG Minutes
by Brian Nisbet 04 Nov '09

04 Nov '09

Afternoon, Thanks to the lovely people in the NCC here are the draft minutes for the WG Session in Lisbon. Please let me know if you have any comments or objections: RIPE 59 Meeting Lisbon Anti-Abuse Working Group Thursday, 8 October 2009, 16:00 Chair: Brian Nisbet Scribe: Pedro Vaz, RIPE NCC Jabber: Gerardo Viviers, RIPE NCC A. Administrative Matters The Working Group (WG) Chair, Brian Nisbet, welcomed the attendees and explained that the WG Co-Chair, Richard Cox, was unable to attend. He announced an extra presentation that was not included in the initial agenda: "Phishing Lock" Ian Meikle, Nominet presented The minutes from RIPE 58 were approved without any comments. B2. Recent List Discussion - Abuse contacts, Sanctions etc. Brian asked if there was someone in the audience who had any opinion about about methods of contacting ISPs about abuse and if the audience could contribute any suggestions on how to handle it. Marco Hogewoning (xs4all) mentioned that there has been an increase in people trying to contact, for example, admin contacts in the organisation attribute in the Database. He added that it all comes down to educating people. He suggested that tutorials on how to use the RIPE Database to get to the correct contacts are created. They could be made available on RIPE Labs. He also added that there seemed to have been better common sense but this has been slipping away lately. Pavel Kácha (CESNET) said that he sees this from both sides. He stands on the side that generates the email and that side that reaches the abuse box. He pointed out a problem that they often run into, which is that the contact mailboxes are often not valid so they have to escalate and use other means. Brian asked Pavel what his default action was. Pavel replied that it is to use the right box. Brian asked on what level checking can be done on the validity of anti-abuse contacts in the database and what kind of sanctions could be applied if these are not valid. Marco said that these kind of checks were very difficult to perform, took a lot of work and might not even be valid. This is the same with the sanctions to be applied. Wilfred Woeber (Vienna University) said that he saw a couple of developments. He mentioned that it's now fashionable to install automatic tools which perform intrusion detection. An individual complaint is created every time a new case is verified. The problem is that this could be become another sort of spam and could even be used as a way to perform a 'denial of service' attack, if you get it from many sources at the same time. Wilfred added that some parties claim that the right way to go is to retrieve the responsible party for some resources up the tree, and then send them an individual notification. He said however, that his own experience tells him that no one really sees this as the way to go. He asked the community if anyone agrees that this is the right method. Lance Wright (Chocolate Redhead) stated that people spam because they make money with it. He mentioned that he worked with a number of companies that use a community-based system, where if someone marks a piece of spam, then everyone else in the community will know it. This makes it possible to detect spam and send it back to where it came from. It deals with spam on the financial level and ends up demotivating spammers and this will end up leaving the community members alone. He added that in the UK this community consists of about 150,000-170,000 users. Marco asked how the system knows where the mails are sent from because normally these emails use fake envelopes. Lance answered that it is proprietary information but that that if Marco would sign a Non-Disclosure Agreement he would be glad to discuss it offline. Brian agreed with Marco on the point that he doesn't know of any way to test if an abuse contact is valid or not. He posed the question of whether it is appropriate for people to search for admin or billing contacts if the abuse contact is not valid. And, if people, by default, already consider the abuse contact less likely to be valid they go immediately in search of admin or billing contacts. Lance said that it depended on the spam. If the spammer is a company trying to sell you something, you'd go back to them. The one offering the technology won't take any responsibility. Marco acknowledged that more or less everybody in the room kind of like behaves himself and looks for abuse contacts, and only when these are not valid, does he go to the admin contacts. However he said that these complaints also become a form of spam and might end up being filtered. He put the question to the audience: where would someone go next if everyone just starts filtering admin contacts? Brian asked if anyone thought that the right way to go is to get to the highest point of registration and handle things there, or contact the most accurate object, which was what's right in his opinion. Marco said that maybe this question should be asked in the plenary when there is a bigger audience. Brian posed a new question for people who operate an abuse desk: would they prefer a complaint email per incident would they would rather receive single emails, single points. Pavel replied absolutely not. Brian thought that individual emails would be preferable. Pavel said that he would prefer a method where complaints are aggregated in some way. He pointed out the fact that if a complaint was generated for each and every spam, then by definition, you would be generating spam as well. He added that this creates collateral damage. Brian thanked the WG for the comments. B3. Dutch ISPs Antibotnet Action Marco Hogewoning, XS4ALL http://www.ripe.net/ripe/meetings/ripe-59/presentations/hogewoning-ISP-botn… There were no questions. B4. Phishing Lock Ian Meikle, Nominet http://www.ripe.net/ripe/meetings/ripe-59/presentations/meikle-phishing-loc… There were no questions. C. Technical Measures C1. RIPE NCC Tools for Anti-Abuse Emile Aben, RIPE NCC http://www.ripe.net/ripe/meetings/ripe-59/presentations/aben-rex.pdf Shane Kerr (ISC) asked if anyone had approached him with concerns that this information is published in such an easy to get format would make them look bad. For example, someone with a network with lots of blacklisted entries. Emile answered no and added that this all publicly available information anyways. Shane said that this was like saying that DNS is public so he could do everything he wants with it, which is not strictly true. He added that he could discuss this offline afterwards. Brian said that if people did not like, it would just be a pity for them. Shane agreed but added that if he would have been an LIR with bad information published about it, he would have been annoyed. He said however, that he's glad that this is being done and that he was just asking if these issues have come up. Emile said that this is why it's on RIPE Labs. It's a prototype and not a production service. If serious issues arise it could be removed from the site. Brian said that it's a nice tool to get historical information from net blocks. D. Interactions D1. Working Groups Database Working Group: irt objects. No comments have been made, so this point was closed D2. Law Enforcement Interaction Brian brought up the topic of registry closures. He asked the attendees if it was clear what the RIPE NCC can and cannot do regarding root resources at the moment. There were no comments from the audience. He also asked if it was clear enough that if the community thought that the RIPE NCC should be able do something about this, it would have to be raised at policy level. He said that the Anti Abuse Working Group would be the most likely place for this to be done. There were no comments from the audience. Brian mentioned a set of meetings and talks with people from governments and law enforcement agencies where it's explained to them how the RIPE community and the RIPE NCC operate, and how they can be involved in the process. He asked the audience if there was anything that they thought could be brought to these meetings. There were no comments from the audience. E. Documents E1. BCP Documentation - irt object/abuse contact recommendations Brian said that this is not finished yet but it will be completed. X. A.O.B. There was no other business. Z. Agenda for RIPE 60 - Plenary Presentations Brian thanked the attendees and closed the Working Group session at 17:15.

1 0

Antispam measures
by Chimel Chimel 24 Oct '09

24 Oct '09

Hi, I am not sure this mailing list is still active, the latest archived mail dates back from over a year ago. I have 3 questions for this mailing list: 1) Does RIPE or other registrars impose antispam fighting measures or a code of conduct to the ISPs or telcos it allocates IP ranges to? For instance, do these registrar customers specifically sign an agreement never to post spam themselves. Do they also sign an agreement to terminate IP sub-allocation or contract with their own customers who are using their IP addresses to post spam? 2) If there is such measures, how does RIPE enforce them? 3) What does RIPE intends to do about Ukrtelecom, who is alone responsible for hundreds of thousands of daily spam posts in discussion forums and BBSs? According to the people in stopforumspam.com, every single post emanating from ukrtelecom is spam, there is not a single genuine user from that telco. How can RIPE allocate hundreds of separate IP ranges to this single telco, especially if it is only a support for spam, not a telco at all. When querying the RIPE database for ukrtelecom, it returns 300 IP ranges, but that's only because the web site is limited to 300 answers. I'd like to see the whole list in order to ban it all from my forum, even if it means banning genuine users from Ukraine. And of course, when I say ukrtelecom is a spammer site, I really means it is a mafia site that makes millions of dollars every month in illegal activities, selling dangerous fake medicines such as viagra or tamiflu. In these times of IP addresses shortening, it would make a lot more IPs available if the registrars would cancel IP allocation from the customers who break the antispam rules. Thanks, Chimel. By the way, a BBS seems to be a more adequate way than a mailing list to handle this kind of discussion. Just my 2 cents. _________________________________________________________________ A la recherche de bons plans pour une rentrée pas chère ? Bing ! Trouvez ! http://www.bing.com/search?q=bons+plans+rentr%C3%A9e&form=MVDE6

12 19

Fwd: [anti-abuse-wg] Antispam measures
by peter håkanson 21 Oct '09

21 Oct '09

Begin forwarded message: > From: peter håkanson <peter(a)hk.ipsec.se> > Date: October 21, 2009 11:33:51 AM GMT+02:00 > To: Florian Weimer <fweimer(a)bfk.de> > Subject: Re: [anti-abuse-wg] Antispam measures > content-type: text/plain; charset=iso-8859-1; format=flowed; delsp=yes > mime-version: 1.0 (Apple Message framework v1076) > x-universally-unique-identifier: fcad27c0-c289-49cd-80b3-1b91332e229d > in-reply-to: <82vdi9uo14.fsf(a)mid.bfk.de> > content-transfer-encoding: quoted-printable > x-smtp-server: bore.hk.ipsec.se > message-id: <5036E015-CC9D-4D2E-AD84-FB340601B07F(a)hk.ipsec.se> > references: <COL117-W30F981CC6FF1583F0A2A20D2C00(a)phx.gbl> <82vdi9uo14.fsf(a)mid.bfk.de > > > > > On Oct 21, 2009, at 10:52 AM, Florian Weimer wrote: > >> * Chimel Chimel: >> >>> 1) Does RIPE or other registrars impose antispam fighting measures >>> or a code of conduct to the ISPs or telcos it allocates IP ranges >>> to? >> >> No, not that I know. >> >>> For instance, do these registrar customers specifically sign an >>> agreement never to post spam themselves. Do they also sign an >>> agreement to terminate IP sub-allocation or contract with their own >>> customers who are using their IP addresses to post spam? >> >> No, surely not. That would be poor service. You don't want to lose >> your IP resources just because your infrastructure has been >> compromised. 8-( > > On the contrary, a real risk of loosing their allocation might be > a good motivation to run their shop accordingly. As of today some > providers don't care ( and will benefit from spammers). > > Just like alkohol-serving firms ( bars etc) if they don't run ther bar > according to local rules they will loose the permits. > We don't allow sleazy hospitals either. Why should we permit > sleazy ISP's to poison our vital infrastructure ?? > >> >>> 2) If there is such measures, how does RIPE enforce them? >> >> There is no enforcement. >> >>> 3) What does RIPE intends to do about Ukrtelecom, who is alone >>> responsible for hundreds of thousands of daily spam posts in >>> discussion forums and BBSs? >> >> Well ... >> >>> According to the people in stopforumspam.com, every single post >>> emanating from ukrtelecom is spam, there is not a single genuine >>> user from that telco. >> >> ... so you should be lucky that it's so easy to filter that type of >> spam. If you shut down netblocks, the badness just spreads far and >> wide and gets more difficult to track. >> >> Of course, if the activity is indeed illegal, it should be stopped. >> One problem we face is that a lot of questionable practices (DNS >> poisoning, injecting pop-ups with ads, installing software on PCs >> without informed consent) are also carried out by obviously >> legitimate >> businesses, so it's often difficult to convince a prosecutor that >> it's >> illegal. >> >> On top of that, many legal scholars claim that in the EU, once you >> say >> the magic word, "telco", you are no longer responsible for the >> traffic >> you handle, much like anyone could seek asylum in Germany (until we >> got rid of this constitutional guarantee in the 90s, which was rather >> disappointing because nothing expresses your national wealth better >> than an almost unconditional willingness to share it). This blanket >> liability exemption is the root of the problem, and it is pretty much >> unique to the telco sector, at least in its generality. It has to >> go. > > We don't have to resort to legal discussions here , if RIPE supplies > goods > under some conditions, any breakage of that condition is enought > to terminate the contract. It's a deal between business partners. >> >>> I'd like to see the whole list in order to ban it all from my forum, >>> even if it means banning genuine users from Ukraine. >> >> The relevant parts of the RIPE database is available from >> ftp.ripe.net. In the past, I've generated anti-abuse ACLs from mnt- >> by >> handles, which was surprisingly effective. Using BGP might help as >> well. >> >> -- >> Florian Weimer <fweimer(a)bfk.de> >> BFK edv-consulting GmbH http://www.bfk.de/ >> Kriegsstraße 100 tel: +49-721-96201-1 >> D-76133 Karlsruhe fax: +49-721-96201-99 >> >> >> > > > ====================================================== > Peter Håkanson Phone +46707328101 Fax +4631223190 > IPSec sverige Email peter(a)ipsec.se > "Safe by design" Address Bror Nilssons gata 16 > Lundbystrand > S-417 55 Gothenburg Sweden > > > ====================================================== Peter Håkanson Phone +46707328101 Fax +4631223190 IPSec sverige Email peter(a)ipsec.se "Safe by design" Address Bror Nilssons gata 16 Lundbystrand S-417 55 Gothenburg Sweden

1 0

Fwd: [anti-abuse-wg] Antispam measures
by peter håkanson 21 Oct '09

21 Oct '09

Begin forwarded message: > From: peter håkanson <peter(a)hk.ipsec.se> > Date: October 21, 2009 10:22:13 AM GMT+02:00 > To: Chimel Chimel <chimel31(a)live.fr> > Subject: Re: [anti-abuse-wg] Antispam measures > > > On Oct 20, 2009, at 11:10 PM, Chimel Chimel wrote: > >> Hi, >> >> I am not sure this mailing list is still active, the latest >> archived mail dates back from over a year ago. > > yes, the list is sprodically active, however the working group has > given up > with spam and calls itself 'anti-abuse' these days. > >> I have 3 questions for this mailing list: >> >> 1) Does RIPE or other registrars impose antispam fighting measures >> or a code of conduct to the ISPs or telcos it allocates IP ranges to? >> For instance, do these registrar customers specifically sign an >> agreement never to post spam themselves. Do they also sign an >> agreement to terminate IP sub-allocation or contract with their own >> customers who are using their IP addresses to post spam? >> >> 2) If there is such measures, how does RIPE enforce them? >> >> 3) What does RIPE intends to do about Ukrtelecom, who is alone >> responsible for hundreds of thousands of daily spam posts in >> discussion forums and BBSs? >> According to the people in stopforumspam.com, every single post >> emanating from ukrtelecom is spam, there is not a single genuine >> user from that telco. >> How can RIPE allocate hundreds of separate IP ranges to this single >> telco, especially if it is only a support for spam, not a telco at >> all. >> When querying the RIPE database for ukrtelecom, it returns 300 IP >> ranges, but that's only because the web site is limited to 300 >> answers. >> I'd like to see the whole list in order to ban it all from my >> forum, even if it means banning genuine users from Ukraine. >> And of course, when I say ukrtelecom is a spammer site, I really >> means it is a mafia site that makes millions of dollars every month >> in illegal activities, selling dangerous fake medicines such as >> viagra or tamiflu. >> In these times of IP addresses shortening, it would make a lot more >> IPs available if the registrars would cancel IP allocation from the >> customers who break the antispam rules. > > Amen ! > > In the meantime, block the offending ranges. This will make the ip's > isolated. A number > of blocklists is available that keeps current records of offending > ranges. > >> >> Thanks, >> Chimel. >> >> By the way, a BBS seems to be a more adequate way than a mailing >> list to handle this kind of discussion. Just my 2 cents. >> >> Gratuit : Hotmail plus rapide avec Internet Explorer 8 ! Cliquez >> ici ! > > > ====================================================== > Peter Håkanson Phone +46707328101 Fax +4631223190 > IPSec sverige Email peter(a)ipsec.se > "Safe by design" Address Bror Nilssons gata 16 > Lundbystrand > S-417 55 Gothenburg Sweden > > > ====================================================== Peter Håkanson Phone +46707328101 Fax +4631223190 IPSec sverige Email peter(a)ipsec.se "Safe by design" Address Bror Nilssons gata 16 Lundbystrand S-417 55 Gothenburg Sweden

1 0

AA-WG Draft Agenda - RIPE 59
by Brian Nisbet 25 Sep '09

25 Sep '09

Colleagues, Apologies for the delay, but here is the draft agenda for the meeting at 16:00 on Thursday 8th October. A. Administrative Matters * Welcome * Finalise agenda * Approve minutes from RIPE 58 B Update * B1. Fast-Flux Legitmacy & Network Abuse Update - Richard Cox * B2. Recent List Discussion - Abuse contacts, Sanctions etc. C. Technical Measures * C1. RIPE NCC Tools for Anti-Abuse - Mark Dranse, RIPE NCC D. Interactions * D1. Working Groups - Database Working Group, IRT objects. * D2. Law Enforcement Interaction E. Documents E1. BCP Documentation - IRT object/abuse contact recommendations X. A.O.B. Z. Agenda for RIPE 60; Plenary Presentations Regards, Brian.

1 0

Further Call for Agenda Items
by Brian Nisbet 10 Sep '09

10 Sep '09

Afternoon, There is still some space left on the agenda for the WG meeting in Lisbon. The meeting plan can be found here: http://www.ripe.net/ripe/meetings/ripe-59/meeting-plan.html The Anti-Abuse WG meeting will be taking place on Thursday at 16:00. If you have anything you'd like to discuss or present, please let me know as soon as you can. Regards, Brian.

1 0

RIPE 59: Call for Agenda Items
by Brian Nisbet 19 Aug '09

19 Aug '09

Afternoon, As you will have seen, the meeting plan for RIPE 59 in Lisbon has been published here: http://www.ripe.net/ripe/meetings/ripe-59/meeting-plan.html The Anti-Abuse WG meeting will be taking place on Thursday at 16:00. If you have any think you think would be of benefit to the WG to discuss, any policy proposals you would like to air (although, of course, any such things will need to go through the PDP) or anything of the like, please let Richard or I know. Thanks, Brian.

1 0

blacklisted IPs
by Danijel Kovacic 17 Aug '09

17 Aug '09

Hi, We have a problem with allocated address range to CARNet (Croatian Academic and Research Network) which RIPE have assigned to us a few months ago. The range is 82.132.0.0 /17. Some of the world wide companies keep old records about IP addresses in their databases so that makes problems to our users. The problem is that our new IP range was in use in some company in Teheran, Iran so many of the companies have that range on their "black lists". For example, our users who have address 82.132.x.x are not allowed to use Pay Pal or download Google Earth ("Google Pack is not available in your county".) Please, can anyone advice us what we can do concerning this problem. x-ncc-regid: <hr.carnet> Regards, Danijel Kovacic CARNet, Croatia

2 2

RE: [anti-abuse-wg] blacklisted IPs
by Thor Kottelin 14 Aug '09

14 Aug '09

> Date: Fri, 14 Aug 2009 08:16:38 +0200 > From: Danijel Kovacic <danijel.kovacic(a)carnet.hr> > To: anti-abuse-wg(a)ripe.net > CC: "ripe(a)carnet.hr" <ripe(a)carnet.hr> > Some of the world wide companies keep old records about IP > addresses in > their databases so that makes problems to our users. > > The problem is that our new IP range was in use in some company in > Teheran, Iran so many of the companies have that range on their > "black > lists". For example, our users who have address 82.132.x.x are not > allowed to use Pay Pal or download Google Earth ("Google Pack is > not > available in your county".) Various services exist that attempt to map IP addresses to countries. Your problem is a good example of why that is not as good an idea as it may seem at first glance. Perhaps you could find out which services are causing the most trouble and have them update your information so that you will not need to contact each of their users separately. -- Thor Kottelin http://www.anta.net/

1 0