- anti-abuse-wg - mailman.ripe.net

Re: [anti-abuse-wg] Fwd: Re: botnet controllers
by Serge Droz 11 Jul '20

11 Jul '20

Hello @Moderators Can you please suspend this participant? I take offense at this. We may disagree on issues and opinions. However I feel there is no space for name calling. Best regards Serge On 09.07.20 15:16, Elad Cohen wrote: > Michele how more bigger asshole you can be to be the puppet of spamhaus > so you will be able monetize your connections with them to more $$$ > > You are a loser and you are a disgraceful businessman and you are a > disgrace to the whole internet community > ------------------------------------------------------------------------ > *From:* anti-abuse-wg <anti-abuse-wg-bounces(a)ripe.net> on behalf of > Michele Neylon - Blacknight <michele(a)blacknight.com> > *Sent:* Thursday, July 9, 2020 4:02 PM > *To:* Serge Droz <serge.droz(a)first.org>; anti-abuse-wg(a)ripe.net > <anti-abuse-wg(a)ripe.net> > *Subject:* Re: [anti-abuse-wg] Fwd: Re: botnet controllers > > +1 on all points > > That someone who won't even disclose who they are has the gall to demand > that Spamhaus or anyone else should is hilarious and disturbing. > > > > -- > Mr Michele Neylon > > Blacknight Solutions > > Hosting, Colocation & Domains > > https://www.blacknight.com > https://blacknight.blog / > > http://ceo.hosting/ > > Intl. +353 (0) 59 9183072 > > Direct Dial: +353 (0)59 9183090 > > ------------------------------- > > Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park, > Sleaty Road, Graiguecullen, Carlow, R93 X265,Ireland Company No.: 370845 > > On 09/07/2020, 07:30, "anti-abuse-wg on behalf of Serge Droz via > anti-abuse-wg" <anti-abuse-wg-bounces(a)ripe.net on behalf of > anti-abuse-wg(a)ripe.net> wrote: > > Hi Info > > Maybe one of the reasons some Non-logging VPNs end up on blacklist sis > that the Non-Looging phrase is just an excuse to not go after misuse. > The rights to privacy and free speech do not mean anything goes. > > You can fight abuse without violating privacy. But of course that's not > for free, you need abuse people that investigate and they cost money. > Sadly, many of these VPNs frankly just don't care, using the lame excuse > that they are protecting fundamental rights, when in fact they are just > don't care or take responsibility. > > I don't agree with everything Spamhaus does, but I find them responsible > and and always found a way way to talk to them. > > I was reluctant writing this, because I'm not sure this discussion will > lead anywhere. It's one of these where opinions seem to already have > been formed. > > But you start accusing people of posting anonymously. I totally agree > this is bad, but then, who are you, info(a)fos-vpn.org? > > You don't seem to offer a name yourself. I find this a bit hypocritical. > > Best > Serge > > > On 08.07.20 20:46, info(a)fos-vpn.org wrote: > > All I would like from Spamhaus is to stop publishing fake SBL > records in > > order to discredit us and to use that to put pressure both upon us and > > our upstreams. > > Non-logging VPN services are as legal within the EU as Exit Nodes > of the > > Tor Network (which have massive abuse entries in various data bases, > > especially the larger ones) and public WiFi Hotspots, which can be > used > > for abusive activities, too. > > > > I don't know who "PP" is (probably the same person which posts > under the > > nickname "Petras Simeon" on Twitter and on various boards), but he > > contacted us and our upstream providers without telling his name, just > > using this email address: phishphucker(a)storey.ovh and sending us the > > list of SBL entries which he also posted here. > > Don't know if he's working for Spamhaus or not, but before attacking > > others publicly, people should reveal their true identity, > anything else > > would be sneaky in my opinion. > > > > -- > Dr. Serge Droz > Chair of the FIRST Board of Directors > https://www.first.org > > -- Dr. Serge Droz Chair of the FIRST Board of Directors https://www.first.org

11 18

New on RIPE Labs: Help to Understand Secure Email Around the Globe
by Mirjam Kuehne 10 Jul '20

10 Jul '20

Dear colleagues, Olamide Omolola and Tobias Fiebig are studying the degree to which email systems are configured securely. And they need your help: they want to receive emails from as many different mail providers around the world as possible. You can find more details in this RIPE Labs article: https://labs.ripe.net/Members/mirjam/help-to-understand-secure-email-around… Kind regards, Mirjam Kühne RIPE Labs Editor

1 0

Fwd: Re: botnet controllers
by info＠fos-vpn.org 09 Jul '20

09 Jul '20

All I would like from Spamhaus is to stop publishing fake SBL records in order to discredit us and to use that to put pressure both upon us and our upstreams. Non-logging VPN services are as legal within the EU as Exit Nodes of the Tor Network (which have massive abuse entries in various data bases, especially the larger ones) and public WiFi Hotspots, which can be used for abusive activities, too. I don't know who "PP" is (probably the same person which posts under the nickname "Petras Simeon" on Twitter and on various boards), but he contacted us and our upstream providers without telling his name, just using this email address: phishphucker(a)storey.ovh and sending us the list of SBL entries which he also posted here. Don't know if he's working for Spamhaus or not, but before attacking others publicly, people should reveal their true identity, anything else would be sneaky in my opinion.

8 8

Helping EU identify BGP Hijacking as a risk
by CSIRT.UMINHO Marco Teixeira 09 Jul '20

09 Jul '20

Hello fellow members, I will take the chance to also thank Angel for bringing this to our attention. It seems "regulation" is coming... I wonder if "BGP Hijacking" poses a risk to "the safety and rights of users or the rights of companies to compete in a fair market". I guess so, and I urge all that feel the same, to participate in this public consultation: hXXps://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/12417-Digital-Services-Act-deepening-the-Internal-Market-and-clarifying-responsibilities-for-digital-services/public-consultation Wouldn't it be great if transit providers registered in the EU, or selling to EU companies, were obliged (regulated) to implement RPKI? Maybe we could even have the EU "add a routing regulator role to the RIPE NCC"! :) Regards, Marco De: anti-abuse-wg <anti-abuse-wg-bounces(a)ripe.net> Em nome de Brian Nisbet Enviada: 9 de julho de 2020 10:16 Para: Angel Fernandez Pineda <anfernandez(a)grupogodo.com>; anti-abuse-wg(a)ripe.net Assunto: Re: [anti-abuse-wg] Fwd: Re: botnet controllers Angel, Thank you for this, a very useful prompt! Brian Brian Nisbet Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 mailto:brian.nisbet@heanet.ie http://www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270 ________________________________________ From: anti-abuse-wg <mailto:anti-abuse-wg-bounces@ripe.net> on behalf of Angel Fernandez Pineda <mailto:anfernandez@grupogodo.com> Sent: Thursday 9 July 2020 08:16 To: mailto:anti-abuse-wg@ripe.net <mailto:anti-abuse-wg@ripe.net> Subject: Re: [anti-abuse-wg] Fwd: Re: botnet controllers CAUTION[External]: This email originated from outside of the organisation. Do not click on links or open the attachments unless you recognise the sender and know the content is safe. Hi, I would like to make a recommendation to all of you. The EU has opened a consultation on the Digital Service Act, a future regulation that aims to review the role of digital platforms and technoly intermediaries and establish regulations to protect the rights of users and companies that operate online wherever is required. Of course, the role of ISPs or organizations like RIPE NCC can be subject to asses. The aim of the European Commission with the consultation is to identify situations that put at risk the safety and rights of users or the rights of companies to compete in a fair market. To those of you who know that this discussion, repeated so many times in this WG, will not reach to anything, I would like to invite you to dedicate a little of your time to answering the consultation. You will find it at: https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fec.europa… Best, ángel Grupo Godó de Comunicación ________________________________________ De: anti-abuse-wg <mailto:anti-abuse-wg-bounces@ripe.net> en nombre de Serge Droz via anti-abuse-wg <mailto:anti-abuse-wg@ripe.net> Enviado: jueves, 9 de julio de 2020 8:29 Para: mailto:anti-abuse-wg@ripe.net <mailto:anti-abuse-wg@ripe.net> Asunto: Re: [anti-abuse-wg] Fwd: Re: botnet controllers Hi Info Maybe one of the reasons some Non-logging VPNs end up on blacklist sis that the Non-Looging phrase is just an excuse to not go after misuse. The rights to privacy and free speech do not mean anything goes. You can fight abuse without violating privacy. But of course that's not for free, you need abuse people that investigate and they cost money. Sadly, many of these VPNs frankly just don't care, using the lame excuse that they are protecting fundamental rights, when in fact they are just don't care or take responsibility. I don't agree with everything Spamhaus does, but I find them responsible and and always found a way way to talk to them. I was reluctant writing this, because I'm not sure this discussion will lead anywhere. It's one of these where opinions seem to already have been formed. But you start accusing people of posting anonymously. I totally agree this is bad, but then, who are you, mailto:info@fos-vpn.org? You don't seem to offer a name yourself. I find this a bit hypocritical. Best Serge On 08.07.20 20:46, mailto:info@fos-vpn.org wrote: > All I would like from Spamhaus is to stop publishing fake SBL records in > order to discredit us and to use that to put pressure both upon us and > our upstreams. > Non-logging VPN services are as legal within the EU as Exit Nodes of the > Tor Network (which have massive abuse entries in various data bases, > especially the larger ones) and public WiFi Hotspots, which can be used > for abusive activities, too. > > I don't know who "PP" is (probably the same person which posts under the > nickname "Petras Simeon" on Twitter and on various boards), but he > contacted us and our upstream providers without telling his name, just > using this email address: mailto:phishphucker@storey.ovh and sending us the > list of SBL entries which he also posted here. > Don't know if he's working for Spamhaus or not, but before attacking > others publicly, people should reveal their true identity, anything else > would be sneaky in my opinion. > -- Dr. Serge Droz Chair of the FIRST Board of Directors https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.first…

1 0

Fwd: Re: botnet controllers
by info＠fos-vpn.org 08 Jul '20

08 Jul '20

Please allow me to comment on this on behalf of the VPN services affected by the accusations: https://www.ripe.net/participate/mail/forum/anti-abuse-wg/PDRhZGNmYmVmLTNmM… When you run a VPN service it simply lies in the nature of things that some miscreants buy accounts which lead to various types of complaints. Our principle is not to serve the bad, but the good! We checked all SBL listings in the past and found out that most of them were simply invalid. Our removal requests were all ignored by Spamhaus, refusing any communication with us. The problem with Spamhaus is that they can do whatever they want and nearly everyone follows them. After starting legal actions in the UK against them based on their wrong accusations they moved their headquarters to Andorra, using the address of a hospital located there. Earlier on a person we know very well tried the same in Switzerland and found out that they are not even registered there; they just rented some offices from Regus in Geneva. Unlike other services such as BitNinja or Blocklist, Spamhaus has no real imprint on its website. All those names such as Thomas Morrison, Pete Dawes or Vincent Hanna are fake identities. Except a few insiders nobody knows who's behind that company, which claims to be nonprofit. It is true that VPN services which don't log any user activities attract people with bad intentions and believe me: We are not happy about that either...but we have to live with that. To us it seemed that it became a real passion of Mr. Steve Linford to destroy non-logging VPN providers; providers which are needed in countries like Iran or China to protect the freedom of speech (we have a lot of customers there). More than 90 per cent of all VPN providers don't allow any Port Forwarding, but closing all Ports would be a kind of censorship in our opinion. We do have our ToS which don't allow any misuse of our service, but we have no control over the actions of our users whatsoever. I know that most of you won't be satisfied with that answer, but this is how we see things from our perspective.

4 5

Fwd: Re: botnet controllers
by info＠fos-vpn.org 08 Jul '20

08 Jul '20

@Jordi Palet Martinez: If Spamhaus would just list IP addresses we wouldn't mind that. The reality is different though. We brought a /24 prefix to a certain hosting provider which I don't want to name here and a few weeks after that Spamhaus listed the other clean prefixes of that company (which have no direct connection to our IPs) on SBL. The result was that all other customers were unable to sent any emails. The company had to refund them, resulting in a financial damage of more than 7000 Euros. There is no way to prevent this, because right after legal actions were taken in the United Kingdom by one of our upstream partners they moved their companys' headquarters to Andorra, which is outside the EU. Spamhaus is no legal entity, but they behave like one. They can do that because during recent years they gained an enormous power: Most email providers take their lists without any question, so if they want they can destroy an entire hosting provider, and if you want to take legal actions against them you need to find a law firm which is active in Andorra. Why don't they reveal their identities like BitNinja does in its imprint? Then all parties could present their evidence in court.

2 1

[Fwd: Re: Fwd: Re: botnet controllers]
by Alex de Joode 08 Jul '20

08 Jul '20

Jordi, Transparency and accountability are key for services that act like a combined privatised police, court and penal force. Unfortunately Spamhaus does not deliver in that department. While the service certainly has merit, they sometimes feels warranted to enforce policies that hurt legal and valid business models like unmanaged hosting and cloud services, vpn's or tor-exits just to name a few. Judge, Jury and Executioner are 3 distinct roles in western democraties, this is for a reason. As a lot of organisations use Spamhaus, this means they have a fudiciary obligation to have clearand targetted policies, a speedy and transparant complaints procedure and they need to provide some form of arbitrage, just to ensure personal issues and preferences are not a factor. To describe Spamhaus usage as "It is up to each individual or organization to use them or not." fundamentally mislabels their position in the abuse handling ecosystem. (it is a bit like arguing we have a working abuse@ mail address, but do not handle abuse at all) -- IDGARA | Alex de Joode | alex(a)idgara.nl | +31651108221 | Skype:adejoode On Wed, 08-07-2020 15h 08min, JORDI PALET MARTINEZ via anti-abuse-wg <anti-abuse-wg(a)ripe.net> wrote: > In a couple of occasions (many years ago), some of the IPs under my responsibility, were listed at spamhaus. I contacted them and got delisted, no problem. Of course, after that I took measures so my IP addresses are never involved even by accident, in any "bad" activity: it is my duty. > > My conclusion is that it offers a good service, which I can use or not, it is my decision. > > I think services such as spamhaus are good, and I don't know if legally they need to be "registered". I could, as a natural person, so no need for registration if is not a business (no incomes), make this kind of service, for free, and for privacy reasons, and understanding that I may be damaging high-level criminal activities, seek my personal and family protection by not disclosing my real data. > > I don't think there is nothing wrong about that, because I'm not "forcing" anyone to trust my service or use it, or anything similar. It is up to each individual or organization to use them or not. > > If ISP a, b, and c, are abusing my network in any way, and I decide to create a public web page to list them, if I can keep the demonstration of that, there is no court that can tell me "you're doing something illegal". I'm just telling the world "those guys have abused my network, you can use it to filter them to avoid having the same trouble", and I can do that I an anonymous way. > > That said, I think it is a bad excuse to say that there is no login to protect freedom of speech. You can do login but not provide that data to "bad" governments. Only if your own country LEA ask for it, because there was a criminal activity on that connection you will need to provide the data. This is the same for *any* other service. I can't agree that VPN's are a different thing. > > Note that I'm not trying to say if this or that service is good or bad, but to say that rules are made for all. > > Regards, > Jordi > @jordipalet >

2 1

Draft Minutes - AA-WG @ RIPE80
by Brian Nisbet 07 Jul '20

07 Jul '20

Colleagues, Please find attached the draft minutes from our working group session at RIPE 80. Could you let the Co-Chairs know, by Friday 17th July, if there are any errors or omissions? Thanks, Brian Co-Chair, RIPE AA-WG Brian Nisbet Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

4 4

Measurement study on understanding global email configuration quality
by Tobias Fiebig 07 Jul '20

07 Jul '20

Dear all, I am a researcher at TU Delft in the Netherlands, looking into Network Security, Protocol Adoption and human factors. My student Olamide is looking into how well _sending_ email setups are maintained around the globe. For this, we need many people, ideally from 'smaller' providers, i.e., with non gmail/hotmail/yahoo addresses, to send us emails. Please consider participating in this study, and sharing it in your networks. To help us, please follow the instructions at: https://www.email-security-scans.org/ Important caveat: If your mailer validates recipient addresses before accepting mails for delivery, you might be unable to send to destination addresses that are (a) only resolvable via IPv6 only, or (b) Have broken DNSSEC, which we use to test DNSSEC validation. If this is the case, please just remove the 1-3 offending addresses from the To: header. Please also note that our test setups will test whether the host delivering mails to us is an open relay. Also note that you may receive bounces from your mailserver for some of the destination addresses, e.g., if mails cannot be delivered via IPv6, or if your mail-setup validates DANE records for our DANE test domain. We do _not_ need a copy of those bounces. In case you want to get results for a domain you operate or use early, please just drop me an email from the same domain and delivering servers after you participated, and I will share the data with you. :-) Met vriendelijke groet, Dr.-Ing. Tobias Fiebig, Assistant Professor / Universitair Docent Department Engineering Systems and Services Informatie- en Communicatie Technologie (ICT) TU Delft / Dept. ESS Faculty of Technology, Policy and Management (TBM) Building 31 Jaffalaan 5 - room B3.170 2628 BX Delft P.O.Box 5015 2600 GA Delft, The Netherlands T +31 (0)15 27 85700 E t.fiebig(a)tudelft.nl Present: Monday t/m Friday

1 0

Re: [anti-abuse-wg] Fwd: Re: botnet controllers
by PP 25 Jun '20

25 Jun '20

Firstly, reporting it to the LEO does not cause the resources to be de-registered. Secondly, your example regarding IPv6 is another reason why this approach is not sufficient: there are 340,282,366,920,938,000,000,000,000,000,000,000,000 possible IPv6 addresses. It should be that the resources are only allocated to legitimate established corporations. Phone numbers aren't wholly allocated to anyone who asks, they remain controlled by a reputable phone company. Why should IP addresses be different? On 25/06/2020 4:50 pm, Shane Kerr wrote: > Dear Phish Phucker, > > The RIPE NCC is a not-for-profit, membership-based organization based > in the Netherlands. They are responsible for allocating Internet > number resources (IP addresses and AS numbers) in their region. Their > policies are set by RIPE, which is just anyone who joins the RIPE > mailing lists and participates in the policy discussions. > > I'm not sure what policy can be introduced. Historically RIPE > participants have been reluctant to make any value judgements about > what IP resources can and cannot be used for. Currently as long as you > are truthful about your organization's registration information you > have fulfilled the requirements. > > In a sense this should be enough. The information is available for > anyone who cares about protecting their users from spam originating > there. Spamhaus lists the organization, and I am pretty sure that most > e-mail providers either block their IP addresses because of that - or > have their own abuse tracking which identifies them. It's not > perfect... I had to change VPS provider because my previous VPS > provider kept having its IPv6 addresses blocked by Spamhaus and > neither my provider nor Spamhaus would explain why (my provider > claimed to have never received any complains, and Spamhaus never > explains anything). But it seems to be good enough for most people. > > If an organization is breaking a law, then the correct action is to > report them to the law-enforcement organization (LEO) that feels like > it is in their jurisdiction. Again, since the member is required by > the RIPE NCC to have correct information about the person or > organization that has been allocated resources, the LEO can follow-up. > > It's hardly an ideal situation, but difficult to see how to improve it > given the general anti-regulation philosophy of most Internet providers. > > Cheers, > > -- > Shane > > On 25/06/2020 08.03, PP wrote: >> So who at RIPE is responsible for allocating this resource, and what >> policy can be introduced to prevent the allocation of IP address >> resources to irresponsible organizations like this one? >> >> SpamHaus have it listed as the worlds number one source of spam: >> >> https://www.spamhaus.org/statistics/networks/ >> >> >> >> On 25/06/2020 2:10 pm, Tõnu Tammer via anti-abuse-wg wrote: >>> >>> We've had similar experience with this VPN provider. >>> >>> He claims not being able to track malicious actor is for the benefit >>> of free speech but when malware is used to attack people who express >>> free speech he did not understand that his service is not >>> contributing towards free speech but hinders it. >>> >>> Tonu >>> CERT-EE >>> >>> On 25.06.2020 04:15, PP wrote: >>>> >>>> Botnet controllers on VPN provider that refuses to act: >>>> >>>> >>>> organisation: ORG-SL751-RIPE >>>> org-name: Freedom Of Speech VPN >>>> org-type: OTHER >>>> address: P.O. Box 9173 >>>> address: Victoria >>>> address: Mahe Island >>>> address: Seychelles >>>> e-mail: info(a)FOS-VPN.org >>>> abuse-c: SL12644-RIPE >>>> mnt-ref: FOS-VPN-MNT >>>> mnt-by: FOS-VPN-MNT >>>> created: 2018-07-13T05:33:45Z >>>> last-modified: 2020-02-28T12:37:39Z >>>> source: RIPE >>>> >>>> >>>> >>>> >>>> -------- Forwarded Message -------- >>>> Subject: Re: botnet controllers >>>> Date: Wed, 24 Jun 2020 21:49:21 +0200 >>>> From: info(a)ghlc.biz >>>> To: PP <phishphucker(a)storey.ovh> >>>> >>>> >>>> >>>> On 2020-06-24 13:03, PP wrote: >>>> Hello! >>>> >>>> >>>> Please note that all mentioned IPs belong to non-logging VPN services. >>>> >>>> No user logs are kept. >>>> >>>> >>>> Sincerely yours >>>> >>>> David Craig >>>> >>>> >>>>> SBL488704 >>>>> 185.140.53.75/32 >>>>> ghlc.biz >>>>> 23-Jun-2020 05:26 GMT >>>>> Malware botnet controller @185.140.53.75 >>>>> https://www.spamhaus.org/sbl/query/SBL488704 >>>>> >>>>> >>>>> SBL488686 >>>>> 91.193.75.58/32 >>>>> ghlc.biz >>>>> 22-Jun-2020 18:39 GMT >>>>> NanoCore botnet controller @91.193.75.58 >>>>> https://www.spamhaus.org/sbl/query/SBL488686 >>>>> >>>>> >>>>> SBL488548 >>>>> 185.244.30.201/32 >>>>> ghlc.biz >>>>> 19-Jun-2020 13:21 GMT >>>>> QuasarRAT botnet controller @185.244.30.201 >>>>> https://www.spamhaus.org/sbl/query/SBL488548 >>>>> >>>>> >>>>> SBL488006 >>>>> 185.140.53.162/32 >>>>> ghlc.biz >>>>> 18-Jun-2020 10:11 GMT >>>>> NanoCore botnet controller @185.140.53.162 >>>>> https://www.spamhaus.org/sbl/query/SBL488006 >>>>> >>>>> >>>>> SBL487900 >>>>> 185.140.53.229/32 >>>>> ghlc.biz >>>>> 16-Jun-2020 13:28 GMT >>>>> NanoCore botnet controller @185.140.53.229 >>>>> https://www.spamhaus.org/sbl/query/SBL487900 >>>>> >>>>> >>>>> SBL487899 >>>>> 185.244.30.113/32 >>>>> ghlc.biz >>>>> 16-Jun-2020 12:59 GMT >>>>> RemcosRAT botnet controller @185.244.30.113 >>>>> https://www.spamhaus.org/sbl/query/SBL487899 >>>>> >>>>> >>>>> SBL487893 >>>>> 185.140.53.236/32 >>>>> ghlc.biz >>>>> 16-Jun-2020 12:07 GMT >>>>> NanoCore botnet controller @185.140.53.236 >>>>> https://www.spamhaus.org/sbl/query/SBL487893 >>>>> >>>>> >>>>> SBL487886 >>>>> 185.165.153.45/32 >>>>> ghlc.biz >>>>> 16-Jun-2020 10:26 GMT >>>>> NanoCore botnet controller @185.165.153.45 >>>>> >>>>> https://www.spamhaus.org/sbl/query/SBL487886 >

3 5