- anti-abuse-wg - mailman.ripe.net

Anti-Abuse WG Draft RIPE 78 Agenda
by Brian Nisbet 17 Apr '19

17 Apr '19

Colleagues, Here is the draft agenda for RIPE 78. Our meeting will be taking place at 09:00 GMT on Thursday 23rd May. If you have any additional items for the agenda, please contact aa-wg-chair(a)ripe.net as soon as possible. A. Administrative Matters * Welcome * Scribe, Jabber, Stenography * Microphone Etiquette * Approve Minutes from RIPE 77 * Finalise agenda B. Update * B1. Recent List Discussion C. Policies - *C.1. RIPE NCC Update on 2017-02, Angela Dall'Ara - RIPE NCC *C.2. Policy Proposal 2019-03 - BGP Hijacking is a RIPE Policy Violation, Carlos Friacas, FCT | FCCN & Jordi Palet Martinez, The IPv6 Company D. Interactions - E. Presentation - * E1. The Curious Case of Fake UK LIRs - Gaith Taha X. A.O.B. Z. Agenda for RIPE 79 Thanks, Brian Co-Chair, RIPE AA-WG Brian Nisbet Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

2 1

AS56630... questions, questions, questions
by Ronald F. Guilmette 16 Apr '19

16 Apr '19

As I pointed out here yesterday, several blocks currently being routed by AS56630 have reverse DNS set for them that makes it altogether apparent, to anyone with experience in these things, that the blocks are in use by snowshoe spammers: https://bgp.he.net/net/185.104.193.0/24#_dns https://bgp.he.net/net/185.104.194.0/24#_dns https://bgp.he.net/net/130.0.88.0/22#_dns https://bgp.he.net/net/194.29.52.0/22#_dns https://bgp.he.net/net/194.156.96.0/22#_dns https://bgp.he.net/net/213.183.47.0/24#_dns (The reverse DNS settings on that last block are actually just some stale leftovers that have never been changed since 2017-07. And the domain names shown are all long dead, and the spammer in question most probably vacated the premises ages ago.) Perhaps not coincidentally, all of these blocks have had new route objects created for them in the RIPE data base within just the past six months or so. The first group above belongs to a company that is located in the country of Georgia. The second group above belongs to a company or individual located in Germany, and that has its/his own ASN, i.e. AS15701, which is actively announcing several routes as we speak. The third group above belongs to a set of organizations in Iran. I have so far not been able to get responses via mail from any of these organizations, even though I have not sent all of them inquiries, asking them if they have authorized AS56630 to route their blocks for them. (I suspect that they have not.) I have however received today a respones to my follow-up inquiry which I sent via email to "Melbicom Abuse" <abuse(a)melbicom.net> yesterday. In that response, whoeevr is behind that role account finally did agree that AS56630 was improperly allowing route announcements for the reserved ASN AS65000 to leak due to an error on their end, and that corrective action has been taken. That answers one of the two questions I asked to people who are running AS56630. The other question I asked is whether or not AS56630 had LOAs for the blocks it is routing on behalf of Iranians and Georgians. This is the relevant part of the response that I received today from <abuse(a)melbicom.net>: "Regarding your 2nd question, we do not request LOA, we rely on RIPE database authorisation features. If customer looks suspect, we dig deeper and perform additional checks." Can someone please explain to me what this person means when he/she/it says that melbicom.net "relies on RIPE database authorisation features" ? What could that possibly mean? Regardless of whetever <abuse(a)melbicom.net> intended that statement to mean, it appears that melbicom.net itself created matching route objects for several of the spammer snowshoe blocks mentioned above... routes for blocks that they themselves clearly do not own. And these route objects were all created within the last 6 months or so. Here is an example: =========================================================================== route: 194.29.52.0/22 origin: AS56630 mnt-by: MELBICOM-MNT created: 2018-08-30T10:04:39Z last-modified: 2018-08-30T10:04:39Z source: RIPE =========================================================================== So, this leads me to a question: Wasn'gt there supposed to have been a change, in both policy and procedure, that allegedly took place some time ago now, where the Powers That Be were no longer going to allow route objects to be placed into the data base unless and until positive and affirmative consent was obtained from the purported IP address block registrants? Was that actually implemented? If so, then how is the identity of the "actual" registrant of any given IP address block being validated or verified under this new regime? Is it possible to fool the system by wearing a set of fake plastic fingerprints? Regards, rfg

1 0

Re: [anti-abuse-wg] Mysteries of the Internet: AS65000
by Suresh Ramasubramanian 15 Apr '19

15 Apr '19

On 15/04/19, 9:26 AM, "anti-abuse-wg on behalf of ac" <anti-abuse-wg-bounces(a)ripe.net on behalf of ac(a)main.me> wrote: > Sorry for top posting, but I fail to see how any of this is abuse related? Given that it is RFG raising this, I think it is a pretty safe bet that this ASN is associated with some abusive activity that he has seen.

6 7

Mysteries of the Internet: AS65000
by Ronald F. Guilmette 15 Apr '19

15 Apr '19

As I believe I have made abundantly clear, I am in favor of the proposal 2019-03, and more generally, I am supportive of the notion that order is preferable to chaos, particularly when it comes to routing on the Internet. The reasons for this preference of mine are so manifest that they do not even warrant recitation here. My hope is that I have made Carlos and Jordi aware, via my postings here, of at least some of the particular points on which we may differ, and which I would like to see changed in the next draft of 2019-03. There is one important point of disagreement on which I have not yet spoken however, and that is Carlos' belief, which may or may not be shared also by Jordi, that I personally qualify as an "expert" (for purposes of 2019-03) simply because I have, in some small number of instances, become aware of what have appeared to be quite deliberate and malevolent hijackings. I need to state for the record that this is just wrong. I am NOT an "expert" with regard to Internet routing, either legitimate or otherwise. I do not run a network. Nor have I ever done so, with the only exception being my own tiny little network here at home . I do not own any equipment that speaks BGP, nor have I ever done so. I am just a simple end-luser who has been mad as hell about spammers for about the past 20 years, and who has simply educated himself, as best as he could, to follow clues and to try to figure how what the spammers are doing and how they are doing it. In this process, I have been required to learn a small bit about routing along the way, but that does not in any sense qualify me as an "expert" in the area of Internet routing. In fact, there are and have been, up to and including the present day, things that I see happening on the Internet that make absolutely no sense to me whatsoever, and that I cannot for the life of me explain. I have just seen one such thing today, and I would like to ask those on this list who actually -are- qualified experts to please explain it to me, because all I see here is a mystery wrapped inside of a riddle and stuffed inside of an enigma. Here is what I am hoping some actual expert can explain to me: https://bgp.he.net/AS65000#_asinfo https://bgp.he.net/AS65000#_prefixes https://bgp.he.net/AS65000#_prefixes6 https://bgp.he.net/AS65000#_peers https://bgp.he.net/AS65000#_peers6 I will save all further comment until someone offers me some kind of an explanation of this apparently strange stuff. For now, I will only add that whereas bgp.he.net is showing there as being a total of 66 IPv4 prefixes announced by this (reserved) ASN, the data I am getting from RIPEstat is indicating a much smaller number of IPv4 announcements (35). Either way, I am unable to fathom how and why a reserved ASN should be announcing -anything- at -any- place or point where anybody on the outside can see it. (And at least some of those blocks -can- be successfully tracerout'd to from where I am sitting here in California, so this is by no means a merely local phenomenon.) The only other thing I feel compelled to say, or ask right now, is just this: Who should I be notifying if there is an issue with this ASN? It has no WHOIS reords, and thus, no contacts... no email addresses, no phone numbers, no snail-mail addresses. Nothing... ... and yet this thing has, according to bgp.he.net, no fewer than 27 IPv4 peers and another 2 for IPv6 only! I await an explanation from some actual expert. For myself, I can only say that none of this makes a damn bit of sense to me. But I am willing and eager to be educated. Regards, rfg P.S. If I have seems self-effacing about the limits of my knowledge above, that was entirely intentional and deliberate. Upon looking at this case of AS65000, I was convinced rather quickly that something is horribly wrong here. But trying to figure out who should be held accountable for this mess is, I confess, utterly beyond me.

5 8

Re: [anti-abuse-wg] Mysteries of the Internet: AS65000
by Suresh Ramasubramanian 15 Apr '19

15 Apr '19

Let us put it this way. There might be several simultaneous leaks of this same private asn because multiple country netblocks are being announced. Or this is actually malicious. I have no way to tell without checking what abuse is coming from there. I'm sure RFG is researching that part of it, and won't ask him about it till he's ready to disclose. On 15/04/19, 10:02 AM, "anti-abuse-wg on behalf of ac" <anti-abuse-wg-bounces(a)ripe.net on behalf of ac(a)main.me> wrote: On Mon, 15 Apr 2019 09:40:35 +0530 Suresh Ramasubramanian <ops.lists(a)gmail.com> wrote: > On 15/04/19, 9:26 AM, "anti-abuse-wg on behalf of ac" > <anti-abuse-wg-bounces(a)ripe.net on behalf of ac(a)main.me> wrote: > > Sorry for top posting, but I fail to see how any of this is > > abuse related? > > Given that it is RFG raising this, I think it is a pretty safe bet > that this ASN is associated with some abusive activity that he has > seen. > Okay, but this is not yet clear? pvt asn is leaked often (and sometimes voluminous) - so is common/frequent and in itself means nothing, if this is that, - but as this affects that network, there is no abuse? or I am missing something?

1 0

Re: [anti-abuse-wg] Mysteries of the Internet: AS65000
by Ángel González Berdasco 15 Apr '19

15 Apr '19

Well, someone is announcing those prefixes as linked to AS65000. If he itself was using AS65000 internally with those prefixes, and that leaked to their public interface, it would be a false positive, but lacking some agreement between the receiver and their peer involving AS65000, imho those entries were used internally by some party, which then inadvertently shared them to peers that didn't filter it, etc. With the end result that such entries could made these prefixes unreachable. Here, one side will be the owners of those ip ranges, but there's not an owner of the AS as such. Who should be complaining that they are 'advettising their AS' incorrectly? What if a prefix was 10.0.0.0/8 ? Would IANA need to state that it didn't allow AS x to advertise a private range? Maybe that step should be skipped for reserved ranges. Most likely, this case is a self-inflicted damage, though. Best regards

2 1

Re: [anti-abuse-wg] telia.lt: Ignoring abuse complaints (?)
by Fi Shing 13 Apr '19

13 Apr '19

2 1

Re: [anti-abuse-wg] Defining routing abuse
by Doug Madory 13 Apr '19

13 Apr '19

> Should that also be treated as a policy violation? This is clearly intentional. I believe what’s described in the Qrator article could be a leaking route optimizer (like Noction) not a new hijack type. Doug Madory Director of Internet Analysis, Oracle @internetintel Hanover, NH +1 603-676-5067

3 5

Defining routing abuse
by Töma Gavrichenkov 12 Apr '19

12 Apr '19

Peace, This is to continue the discussion around 2019-03. Here's our today's article about the ways some operators do traffic engineering: https://radar.qrator.net/blog/new-hijack-attack-in-the-wild Should that also be treated as a policy violation? This is clearly intentional. -- Töma

3 3

2019-03
by Fernando EA. Reis 12 Apr '19

12 Apr '19

I support 2019-03. Regards, Fernando Reis CCCTII - Center for the Coordination of Communications, Information Technology and Innovation Regional Directorate for Public Works and Communications | Azores Government Rua de São Joaquim, n° 1, 9500-112 Ponta Delgada T: +351 296 206 556 | M: +351 911 966 248 | @: fernando.ea.reis(a)azores.gov.pt<mailto:fernando.ea.reis@azores.gov.pt>

1 0