- anti-abuse-wg - mailman.ripe.net

2019-03 Review Phase (Resource Hijacking is a RIPE Policy Violation)
by Marco Schmidt 10 Sep '19

10 Sep '19

Dear colleagues, Policy proposal 2019-03, "Resource Hijacking is a RIPE Policy Violation" is now in the Review Phase. The goal of this proposal is to define that BGP hijacking is not accepted as normal practice within the RIPE NCC service region. The proposal has been updated following the last round of discussion and is now at version v2.0. Some of the changes made to version v1.0 include: - Includes procedural steps for reporting and evaluation of potential hijacks - Provides guidelines for external experts - Adjusted title The RIPE NCC has prepared an impact analysis on this latest proposal version to support the community’s discussion. You can find the full proposal and impact analysis at: https://www.ripe.net/participate/policies/proposals/2019-03 https://www.ripe.net/participate/policies/proposals/2019-03#impact-analysis And the draft documents at: https://www.ripe.net/participate/policies/proposals/2019-03/draft As per the RIPE Policy Development Process (PDP), the purpose of this four week Review Phase is to continue discussion of the proposal, taking the impact analysis into consideration, and to review the full draft RIPE Policy Document. At the end of the Review Phase, the Working Group (WG) Chairs will determine whether the WG has reached rough consensus. It is therefore important to provide your opinion, even if it is simply a restatement of your input from the previous phase. We encourage you to read the proposal, impact analysis and draft document and send any comments to <anti-abuse-wg(a)ripe.net> before 4 October 2019. Kind regards, Marco Schmidt Policy Officer RIPE NCC

14 30

Re: [anti-abuse-wg] 2019-03 Review Phase (Resource Hijacking is a RIPE Policy Violation)
by Alex de Joode 09 Sep '19

09 Sep '19

Dropping it might be the best thing: The document does not clearly state what the procedure is (binding arbitrage? (the decision leads to a conclusion that might have an effect on the status of the LIR involved? (with anonymous 'experts' who act as 'judges' ? (a legal no-no))). The proposal does not rule out the "hijacker" going to civil court if they might lose their LIR status (and IP space), if not RIPE will just incur extra costs. (going to civil court is impossible to rule out, anyways). Do the contacts the LIR has with RIPE need to be amended for this to function ? (What if the LIRs refuse to sign the new contract, due to this introduced risk) -- IDGARA | Alex de Joode | +31651108221 On Thu, 05-09-2019 21h 46min, Alex de Joode <adejoode(a)idgara.nl> wrote: > Dropping it might be the best thing: > The document does not clearly state what the procedure is (binding arbitrage? (the decision leads to a conclusion that might have an effect on the status of the LIR involved? (with anonymous 'experts' who act as 'judges' ? (a legal no-no))). > The proposal does not rule out the "hijacker" going to civil court if they might lose their LIR status (and IP space), if not RIPE will just incur extra costs. (going to civil court is impossible to rule out, anyways). Do the contacts the LIR has with RIPE need to be amended for this to function ? (What if the LIRs refuse to sign the new contract, due to this introduced risk) > -- IDGARA | Alex de Joode | +31651108221 > On Thu, 05-09-2019 20h 56min, Erik Bais <erik(a)bais.name> wrote: > > I fully agree with Nick. > > Drop it like its hot ... > > Erik Bais > > > Op 5 sep. 2019 om 18:15 heeft Nick Hilliard "><nick(a)foobar.org> het volgende geschreven: > > > > I'd like to suggest to the chairs that this proposal be formally dropped. > >

2 1

RIPE79 Agenda Creation!
by Brian Nisbet 09 Sep '19

09 Sep '19

Colleagues, As you're hopefully aware the next RIPE meeting, and so the next meeting of the AA-WG, is just a month away! The AA-WG will be meeting on Thursday 17th October at 09:00 CEST. We have been somewhat remiss in soliciting items for the agenda, so please email aa-wg-chair(a)ripe.net with any items you would like to raise, work you believe the WG should be doing or presentations that may be of interest to us all. Thanks, Brian Co-Chair, RIPE AA-WG Brian Nisbet Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

1 0

Cogent & FDCServers: Knowingly aiding and abetting fraud and theft?
by Ronald F. Guilmette 06 Sep '19

06 Sep '19

Few of you here probably know about this, but nearly a week ago now an article appeared in South Africa's largest and most popular online tech publication, MyBroadband.co.za. It detailed many, but certainly not all of the results of my multi-month investigation of a massive and ongoing fraud involving the theft of large numbers of large (generally /16 or larger) abandoned legacy blocks, taken from the AFRINIC region and beyond: https://mybroadband.co.za/news/internet/318205-the-big-south-african-ip-add… For various editorial reasons, the article that was published actually downplayed the magnitude of the of the thefts quite dramatically. The totality of the IPv4 space that has been stolen or squatted, primarily but not exclusively, from South African companies and South African national goverment agencies and departments is actually at least 5x bigger than what was reported in the MyBroadband.co.za article. The overwhelming majority of this stolen and squatted IPv4 space has been helpfully routed by Cogent (AS174), to their customer, FDCServers of Chicago, and then on to the prefered destinations of a certain Mr. Elad Cohen of Israel, and his company Netstyle Atarim, Ltd. (I have saved traceroutes up the wazoo that prove the involvement of FDCServers, in particular, in all of this.) Mr. Cohen has been exceptionally prolific in his IPv4 theft and squatting activities, basically grabbing everything that wasn't nailed down, both within the AFRINIC region and also within the APNIC region. In order to try to legitimize all of these thefts and squats, Mr. Cohen created quite a sizable number of fradulent route: objects within the Merit/RADB data base which, as most here should already know, has essentially zero authentication of any kind before it allows J. Random Luser to add pretty much any any route: object he wants to the RADB. Here's a full listing of all of Mr. Cohen's RADB route: objects as they existed as recently as August 17th: https://pastebin.com/raw/ZNgNuvtt And here is the short summary version showing just all of the prefixes/CIDRs that Mr. Cohen was effectively claiming rights and/or title to as of that same date: https://pastebin.com/raw/4LTaCg5R Plese do note the numerous blocks of size /16 or greater. The bottom line is that this one tiny little Israeli company was effectively claiming rights to a total of no fewer than 1,015,808 IPv4 addresses as of August 17th, 2019. (Not too shabby for one lone guy who teaches programming classes as a side job!) Vitrually all of the space is "legacy" IPv4 space, and generally consists of blocks having sizes of /16 or larger. Some of Mr. Cohen claims in his RADB entries are as humorous as they are pathetically fradulent. For example, Mr. Cohen has effectively claimed rights to 139.44.0.0/16 which unambiguously belongs to the Port Authority of the City of Melbourne, Australia. But hell! That's merely city property! Mr. Cohen's limitless appetite for other people's IPv4 space is more vividly on display in his claims to ownerhip over the 168.198.0.0/16 block, which actually belongs to the Department of Finance of the Australian national government. And I haven't even mentioned yet another of Mr. Cohen volumous IPv4 acqusitions, the 165.25.0.0/16 block, which he did not see fit to create an RADB entry for, but which he's been squatting on for for quite some time now, quite clearly with the aid and assistance of both Cogent and FDCServers. That one belongs to th City of Cape Town, South Africa. That city's engineers have been struggling to regain control of their block back from Cogent, from FDCServers, and from Mr. Cohen for some time now. I know because I've personally spoken to them about it. Cogent, in its infinite wisdom, is continuing to fight the city for control over property that clearly and righfully belongs to the City of Cape Town, even as we speak: https://drive.google.com/file/d/1ytRj1CtuVhDa0eGu4BT-oEz593y5EwJa/view When asked for LOAs attesting to his legitimate authority to route at least a few of these blocks, Mr. Cohen has produced blatantly forged documents, many of which appeared in the MyBroadband.co.za story. And when I say "blatant" that's a gross understatement. Any half-way decent forger would consider these documents an embarrasment. The documents all bear identical signatures, and identical and vaguely official looking stamps, and purport to actually be sales reciepts attesting to the alleged purchases, by Mr. Cohen's offshore Seychelles Islands shell company, Afri Holdings, Ltd., of various /16 blocks from a mysterious company called Afrivestment, Ltd., which may actually exist in some faraway galaxy, or in Mr. Cohen's active imagination, but which both Google and OpenCorporates.com seem to agree exists exactly noplace on this planet. Here are the manufactured LOAs supplied by Mr. Cohen: https://drive.google.com/file/d/1hVjmR6u0ANltuXtZ-Kng8io-EGFyevTR/view https://drive.google.com/file/d/1x_44_H5hkcFLhEwpkwfFoR5PJUyXHzxJ/view https://drive.google.com/file/d/1yQyqn4q_f3bt-wDVoN1FzbXf1k58DXtK/view Recently, Cohen started to move some, but not all, of his stolen and squatted IPv4 blocks off of Cogent/FDCServers and onto a friendly little bullet-proof hosting company in the Netherlands named IP Volume, Inc. (AS202425) and/or to its several sister networks, e.g. AS204655 - Novogara Ltd., all of which, coincidently, just happen to be owned by the exact same pair of Dutch gentlemen who previously owned the notorious Ecatel, follwed by the notorious Quasi Networks. (IP Volume, Inc. appears to have intherited all or nearly all of its legitimately assigned IP space from its predecessor entities, Ecatel and Quasi Networks.) Despite these relocations, many of Mr. Cohen's stolen and squatted blocks are still helpfully being routed to Mr. Cohen's preferred desitnations by his good friends at Cogent and FDCServers, even as we speak. The current set of such routes that Cogent is maintaining, at the moment, apparently on behalf of their customer, Mr. Cohen, consists of the prefixes listed here: https://pastebin.com/raw/EA3xJVLF When I noticed two days ago that all of these routes were still up I was deeply confused. Did both Cogent and FDCServrs not get the memo?? Do they not know yet that Cohen is stealing stuff, left, right, and sideways? Did nobody even tell them about the MyBroadband.co.za article which was published this past Sunday? I decided that it was incumbant upon me to find out. Thus, more that 48 hours ago now I sent the following polite but firm inquiry to Cogent, and a separate nearly identical one directly to the CEO of FDCServers, Mr. Petr Kral (petr(at)fdcservers.net). https://pastebin.com/raw/ztipqE96 A full forty eight hours later, I have received no reply whatsoever from either Cogent or FDCServers, not even a "Go pound sand" type of response. More importantly, most of the stolen IPv4 space that I called out, very specifically, to both Cogent and FDCservers two+ days ago now is still being routed by Cogent/FDCservers to their fun-loving and, I'm sure, promptly paying customer, Mr. Cohen. If neither Cogent nor FDCServers still do not know now that Mr. Cohen is a crook, and that he has glommed onto quite a lot of stolen and squatted IPv4 space... which they have been helpfully routing for him, no doubt in exchange for some handsome payments... then I am foreced to say that it appears to be a reasonable conclusion that it must be because neither Cogent nor FDCServers really wants to know what sort of a character Cohen is, or what he has been up to, specifically with their ongoing and material assistance. But you all be the judges. What does it look like to you? Regards, rfg

1 0

Re: [anti-abuse-wg] [Misc] Research project on blacklists
by Sebastian Wiesinger 19 Jul '19

19 Jul '19

* ac <ac(a)main.me> [2019-07-18 08:29]: > It is about: "evaluating and improving the accuracy of blacklists." > > The entire post is arrogant, obnoxious, offensive and inaccurate and is > an oxymoron. Tbh the only mails I get this vibe from in this thread are yours. Could you tune it down a bit? There is no reason to be this aggressive. It seems this is legitimate research and if you do not agree with it don't take the survey. Regards Sebastian -- GPG Key: 0x58A2D94A93A0B9CE (F4F6 B1A3 866B 26E9 450A 9D82 58A2 D94A 93A0 B9CE) 'Are you Death?' ... IT'S THE SCYTHE, ISN'T IT? PEOPLE ALWAYS NOTICE THE SCYTHE. -- Terry Pratchett, The Fifth Elephant

5 7

Re: [anti-abuse-wg] Reminder: Mailing List Code of Conduct
by Brian Nisbet 19 Jul '19

19 Jul '19

Andre, Thank you for your apology. We seem to live in an increasingly complex world and the trade-offs between convenient and open/free have never seemed quite so... difficult... to me at least. Should you feel you can return to us at some point and engage in a continually constructive manner, you would be welcome. Brian Co-Chair, RIPE AA-WG Brian Nisbet Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270 > -----Original Message----- > From: anti-abuse-wg <anti-abuse-wg-bounces(a)ripe.net> On Behalf Of ac > Sent: Friday 19 July 2019 06:34 > To: Brian Nisbet <brian.nisbet(a)heanet.ie> > Cc: anti-abuse-wg(a)ripe.net > Subject: Re: [anti-abuse-wg] Reminder: Mailing List Code of Conduct > > > Hi, > > I apologise for my recent poor behavior and my use of profanity (specifically > the word "bullshit") - I have grown much less tolerant of large tech and as > society is losing this war anyway, it is causing me enormous amounts of > stress. When innocent things happen that contribute negatively to the > advancement of a free and open society and play into the hands of the > dominating players, I lose my cool... > > This is not cool and not fair to you and I am sorry :( > > I do understand that my behavior does not serve my cause and I am not a > nice enough person to simply be myself on this list, so my choices are to be > someone else or to leave. > > So long and thanks for all the fish, > > Andre > > On Thu, 18 Jul 2019 16:44:45 +0000 > Brian Nisbet <brian.nisbet(a)heanet.ie> wrote: > > > Colleagues, > > > > Because we wish to be very open on this, the Co-Chairs would like to > > remind everyone of the RIPE Mailing List/RIPE Forum Code of Conduct. > > > > https://www.ripe.net/participate/mail/ripe-mailing-list-ripe-forum-cod > > e-of-conduct > > > > There is plenty of room for debate, discussion and even arguments on > > this list and in this community. What there isn't room for is > > attacking people, for shutting down arguments with ad hominem attacks > > and for choosing to be rude rather than taking the opportunity to > > educate. All of this is a balance, but sadly here discussion is > > unbalanced more frequently than it should be. > > > > We have a great wish to see that useful discussion continue and > > flourish. > > > > Where the Co-Chairs feel that there are issues, we will contact the > > relevant parties personally to discuss and take whatever action is > > deemed necessary after those discussions. > > > > Thanks, > > > > Brian > > Co-Chair, RIPE AA-WG > > > > Brian Nisbet > > Service Operations Manager > > HEAnet CLG, Ireland's National Education and Research Network 1st > > Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland > > +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie > > Registered in Ireland, No. 275301. CRA No. 20036270 > > > > >

1 0

Reminder: Mailing List Code of Conduct
by Brian Nisbet 19 Jul '19

19 Jul '19

Colleagues, Because we wish to be very open on this, the Co-Chairs would like to remind everyone of the RIPE Mailing List/RIPE Forum Code of Conduct. https://www.ripe.net/participate/mail/ripe-mailing-list-ripe-forum-code-of-… There is plenty of room for debate, discussion and even arguments on this list and in this community. What there isn't room for is attacking people, for shutting down arguments with ad hominem attacks and for choosing to be rude rather than taking the opportunity to educate. All of this is a balance, but sadly here discussion is unbalanced more frequently than it should be. We have a great wish to see that useful discussion continue and flourish. Where the Co-Chairs feel that there are issues, we will contact the relevant parties personally to discuss and take whatever action is deemed necessary after those discussions. Thanks, Brian Co-Chair, RIPE AA-WG Brian Nisbet Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

2 1

Re: [anti-abuse-wg] Research project on blacklists
by Karl-Josef Ziegler 18 Jul '19

18 Jul '19

The person seems to be real: https://erg.berkeley.edu/people/hossain-anushah/

1 0

Re: [anti-abuse-wg] [Misc] Research project on blacklists
by Barry Greene 18 Jul '19

18 Jul '19

Not a joke. Just a researcher exploring ways to quantify and measure. Always important to have the academic doing the due diligence on our operational assumptions. > On Jul 17, 2019, at 07:40, ac <ac(a)main.me> wrote: > > > This is a joke email, right? > > Is it the 1st of April already? :) > > Andre > > On Wed, 17 Jul 2019 13:42:21 +0200 > Anushah Hossain <anushah(a)icsi.berkeley.edu> wrote: > >> Hi everyone, >> >> I'm a researcher at UC Berkeley and the International Computer Science >> Institute. My colleagues and I are working on evaluating and >> improving the accuracy of blacklists. As part of this work, we'd like >> to hear from you about the blacklists you currently use, what you >> perceive as their strengths and weaknesses, and any thoughts you have >> on how they might be improved. >> >> We've prepared an anonymous survey where you can share your views: >> https://berkeley.qualtrics.com/jfe/form/SV_200mg5hnQiAOgUl >> >> If you have five to ten minutes free today to fill it out, I would >> greatly appreciate your help! Thank you, and please don't hesitate to >> respond to me with comments or questions. >> >> (Apologies if you receive this message twice - trying to minimize >> cross-posting while still reaching a broad audience) >> >> Best, >> Anushah >> > >

3 3

Re: [anti-abuse-wg] [Misc] Research project on blacklists
by Fi Shing 18 Jul '19

18 Jul '19

The only organisation that is in a prime position to implement any meaningful blacklist is a RIR like RIPE itself. Anything less than RIR level blacklisting is what is known as "whac a mole" https://en.wikipedia.org/wiki/Whac-A-Mole But, as it comes down to time and money, the likes of which even google and facebook etc are not motivated to part with in terms of accountability, organisations like RIPE, APNIC, ICANN etc. All of them, without exception, refuse to engage in responsible practices. They are happy to take money to issue resources, but taking them away is equated to sacrilege. In an ideal world, the employees of RIPE etc should be arrested in jailed for aiding and abetting crime. --------- Original Message --------- Subject: Re: [anti-abuse-wg] [Misc] Research project on blacklists From: "ac" <ac(a)main.me> Date: 7/18/19 3:20 pm To: anti-abuse-wg(a)ripe.net Oh. Lets look more at this then. "UC Berkeley" - USA "International Computer Science Institute" "evaluating and improving the accuracy of blacklists." "including a web link, which is tracked and cross tracked" "an anonymous survey" Dude, let us be frank: On this list we discuss abuse, in the open and directly. People on this list has "skills" and can all be anonymous on this list, if they wish to, in fact, many are. (I do not and I am not private) We are talking about email blacklists? right? as the routing blacklists do not bother the evil tech monopolies! It is a fact that the spam from the top ten USA tech companies are the most challenging abuse on the planet - as this type of abuse, is the hardest to combat. - Twitter does not even accept abuse complaints. Facebook does not care and Google mixes spam with ham all the time to defeat email blacklists Why not study the reasons for the percentage increase in the use of inspection/tracking/non private/invasive anti abuse technologies in use by the largest email and dominant players, Google and Microsoft, of ipv6 and the reason why these huge tech players HAVE to push for ipv6 email servers relay to ensure their future dominance of email relay? Instead of "My colleagues and I are working on evaluating and improving the accuracy of blacklists" As, imnsho, that is absolute USA bullshit. and is not even possible. I would go sofar as to state that such research is not intended to "improve" anything but to cement the monopolies we fight daily and is on the EVIL side of the fight. Andre On Wed, 17 Jul 2019 10:01:16 -0700 Barry Greene <barryrgreene(a)gmail.com> wrote: > Not a joke. > > Just a researcher exploring ways to quantify and measure. Always > important to have the academic doing the due diligence on our > operational assumptions. > > > On Jul 17, 2019, at 07:40, ac <ac(a)main.me> wrote: > > > > > > This is a joke email, right? > > > > Is it the 1st of April already? :) > > > > Andre > > > > On Wed, 17 Jul 2019 13:42:21 +0200 > > Anushah Hossain <anushah(a)icsi.berkeley.edu> wrote: > > > >> Hi everyone, > >> > >> I'm a researcher at UC Berkeley and the International Computer > >> Science Institute. My colleagues and I are working on evaluating > >> and improving the accuracy of blacklists. As part of this work, > >> we'd like to hear from you about the blacklists you currently use, > >> what you perceive as their strengths and weaknesses, and any > >> thoughts you have on how they might be improved. > >> > >> We've prepared an anonymous survey where you can share your views: > >> > >> If you have five to ten minutes free today to fill it out, I would > >> greatly appreciate your help! Thank you, and please don't hesitate > >> to respond to me with comments or questions. > >> > >> (Apologies if you receive this message twice - trying to minimize > >> cross-posting while still reaching a broad audience) > >> > >> Best, > >> Anushah > >> > > > >

1 0