- anti-abuse-wg - mailman.ripe.net

Google & Cisco
by ac 05 Jul '18

05 Jul '18

Hello All, As we all know, Google and Microsoft dominates email relay in many places and they are getting even larger with each passing year. They are not getting larger because they are offering great email service but because they are ever more aggressive and sometimes under handed and do not behave decently or in an ethical way. if the present trends continue, there will be almost no email relay that does not operate through either Microsoft or Google. Interesting thing that all of us (and Microsoft) should take careful note of is that Google has done a deal with Cisco (Talos SpamCop) whereby reports about abuse (including spear phish, spam, scams, etc) - are no longer sent to Google (abuse(a)google.com) but directly to the relay ipv4/ipv6 abuse ISP contact. When there is no ipv4/ipv6 abuse contact the complaints are discarded and in a minority of cases, still go to abuse(a)google.com Microsoft of course has two attack vectors. One the 'custom' protocols of their exchange servers and the other is that they mix legit email and spear phish, payday loan scams from the same servers. Google has now also started doing the same thing. Before Google used to be more responsive to abuse complaints and there were fewer actual criminal activity relayed by Google. So, it is becoming more frequent and common to find spear phish attack on a client, from Google and Microsoft and this motivates clients to move services to Microsoft or Google. I do not think that there is much an abuse wg can discuss around this, as there is not much or anything that any of us can actually do about the present situation as both Google and Microsoft has simply become too large and year on year they are getting larger. Any comments?

1 0

RIPE 77 CfP and AA-WG Agenda
by Brian Nisbet 04 Jul '18

04 Jul '18

Colleagues, As I'm hoping you're all aware the RIPE 77 Call for Presentations is now open: https://ripe77.ripe.net/submit-topic/cfp/ At the same time I would ask you to consider if you may have anything to bring to the Working Group in October, whether that is a new policy, process, point of information or more general presentation. If so, please do email Tobias and I and we can discuss it! Thanks, Brian Co-Chair, RIPE AA-WG Brian Nisbet Network Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

1 0

New on RIPE Labs: Mini series on network security (by Kathleen Moriarty)
by Mirjam Kuehne 14 Jun '18

14 Jun '18

Dear colleagues, We published a mini series on network security on RIPE Labs, contributed by Kathleen Moriarty: 1. Network Monitoring is Dead… What Now? TLS, QUIC and Beyond https://labs.ripe.net/Members/kathleen_moriarty/network-monitoring-is-dead-… 2. They Are Looking At WHAT? Service Provider Monitoring https://labs.ripe.net/Members/kathleen_moriarty/they-are-looking-at-what-se… 3. What Are My Options? Session Encryption Protocols Looking Forward https://labs.ripe.net/Members/kathleen_moriarty/what-are-my-options-session… You can find the full series here: https://labs.ripe.net/Members/kathleen_moriarty Kind regards, Mirjam Kühne RIPE NCC

1 0

Draft Minutes - AA-WG Session at RIPE76
by Brian Nisbet 05 Jun '18

05 Jun '18

Colleagues, Thanks again for a great session at our recent meeting in Marseille. Here are the draft minutes as prepared by the NCC. Could you please read them and comment with any corrections that are required? Anti-Abuse Working Group RIPE 76 17 May 2018, 11:00-12:30 WG co-Chairs: Brian Nisbet, Tobias Knecht Scribe: Emile Aben Status: Draft A. Administrative Matters The video archive is online at: https://ripe76.ripe.net/archives/video/109 The chairs welcomed the room, and addressed the administrative matters. B. Update B1. Working Group Chair Selection Brian Nisbet was selected for another term as co-chair for this working group. The video archive is online at: https://ripe76.ripe.net/archives/video/111 B1. Recent List Discussion The video archive is online at: https://ripe76.ripe.net/archives/video/112 C. Policies Brian summarised the discussions on the mailing list. C1. 2017-02 Regular abuse-c Validation - Herve Clement (Orange), Sara Marcolla (Europol) The video archive is available at: https://ripe76.ripe.net/archives/video/113 There were no questions C1. 2017-02 Regular abuse-c Validation, Marco Schmidt (RIPE NCC) The video archive is available at: https://ripe76.ripe.net/archives/video/113 Alexander Isavnin (Internet Protection Society) asked for exact numbers and lacking these suggested to postpone decision. Brian rejected this suggestion. Julien Escario (Altinea) asked for more serious validations checks. Brian said this was discussed already. Jordi Palet Martinez (The IPv6 Company) considered starting a new policy proposal discussion, after this proposal reaching consensus, based on the proposal he submitted to other RIRs. Piotr Strzyżewsk (Silesian University of Technology, Computer Centre) asked about legacy resource holders. Marco said legacy address space will not be part of this. Piotr said email checking is tricky and used the example of putting abuse(a)ripe.net on arbitrary resources. Brian said this was discussed on the mailing list. Piotr said they will not know how much money this will cost. Marco said that if 25% is incorrect, it will cause frustration to a lot of people. Peter Koch (DENIC) asked for guarantees of the RIPE NCC's interpretation of the text and it not changing its mind. Marco said the guarantee is in that things must be within the policy framework. Peter Koch said the text allows for much harsher interpretation, and was not convinced this is good policy making. Brian said that the RIPE NCC's interpretation at this point is as set as it can be. Ruediger Volk (Deutsche Telekom) unravelled the discussion in three parts: 1) A technical question on how to validate email addresses, and he saw no obstacle on validating all contacts that are relevant 2) Consequences for incorrect email addresses 3) Fixing incorrect email addresses Ruediger said fixing and checking emails could be considered a Database WG task, and was afraid that this work created the illusion of achievement. Tobias Knecht (Abuseix) said 10-25% sounds a correct number for invalid mailboxes and he would be happy to write a proposal with Ruediger. Tobias added that the RIPE NCC is charged with running a clean and valid registry and legacy checking would also be no problem. Brian summarised that no new information was brought to the discussion, and the proposal was still open for a few more days. D. Interactions D1. Global Abuse Community Updates Tobias Knecht - Abuseix The video archive is available at: https://ripe76.ripe.net/archives/video/117 Ruediger asked about the schema language, and answered that JSON doesn't have a schema language. Ruediger suggested creating a list of tools for creating data in this format. Tobias said that keeping the JSON as simple as possible as abuse handling is in essence simple. Ruediger said was interested in the results of this effort that could be easily tracked and expressed doubt about the need for a MIME type for this. Tobias said the MIME type discussion took place in other fora. Tobias said he will connect the community doing this to the anti-abuse working group community. Ruediger said it's essential to provide pointers to tools that use this. E. Presentation E1. Internet Abuse by Russian LEAs Alexander Isavnin (Internet Protection Society) The video archive is available at: https://ripe76.ripe.net/archives/video/119 There were no questions. X. A.O.B. There were no AOBs. Brian closed the session. Thanks, Brian Co-Chair, RIPE AA-WG Brian Nisbet Network Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

1 0

2017-02 Proposal Accepted (Regular abuse-c Validation)
by Marco Schmidt 01 Jun '18

01 Jun '18

Dear colleagues, Consensus has been reached on 2017-02, "Regular abuse-c Validation". This proposal gives the RIPE NCC a mandate to regularly validate "abuse-mailbox:" information and to follow up in cases where the attribute is deemed to be incorrect. You can find the full proposal at: https://www.ripe.net/participate/policies/proposals/2017-02 The new RIPE Document is ripe-705 and is available at: https://www.ripe.net/publications/docs/ripe-705 The RIPE NCC has already begun preparations to implement this policy change. Details of the implementation status are available at: https://www.ripe.net/manage-ips-and-asns/resource-management/policy-impleme… We will send another announcement once the implementation is complete and the regular validation is in place for all “abuse-mailbox:” attributes. Thank you to everyone who provided input. Kind regards, Marco Schmidt Policy Officer RIPE NCC Sent via RIPE Forum -- https://www.ripe.net/participate/mail/forum

1 0

GDPR - ICANN vs Tucows
by Michele Neylon - Blacknight 31 May '18

31 May '18

https://www.internetnews.me/2018/05/31/icann-vs-epag-tucows-german-court-ru… -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845

1 0

Re: [anti-abuse-wg] GDPR - positive effects on email abuse
by Malcolm Hutty 30 May '18

30 May '18

On 30/05/2018 04:47, it was written: > Well, many people. let me start with myself: You claim that my opinions > are rubbish and you compare my opinions to those same people > (Fox/Republicans) whom: > > violently take babies away from mommies - yes, at a border Americans > grab little babies from the hands of their mothers and take the mommy > and the little baby to different "detention" facilities. I have been following this thread with great interest, and have found points I find persuasive and unpersuasive on both sides. It could be said that the thread is wandering off into unproductive theorising, but in the circumstances of the advent of GDPR, whether public WHOIS really is a necessary or important component of anti-abuse activities seems a broad topic worth debating fully. Some light has even been shed on GDPR's meaning. I also consider myself highly tolerant of passionate and occasionally intemperate comments. It seems to me that it is better to have it out, and to show the respect of tolerating less well mannered arguments, than to try to aggressively police language and so exclude many people from full participation in the debate. Usually those that go over the top do more harm to their own case than to others, and that has been how I have reacted to some of the comments in this thread. But can we please leave out accusations that your political opponents abduct babies? That surely crosses the line. The trope is, at least, Older Than Feudalism, and very likely Older Than Dirt, and as always raising it serves no purpose other than to demonise one group of people and to smear another by association, thereby shutting down the conversation. It's not an argument, it's a transparent attempt to exclude. Please stop. More generally, I believe this discussion would be improved if people stopped throwing around terms like "European" and "Republican" as though they are terms of abuse. Our community is, and should be, open to all. Regards, Malcolm. -- Malcolm Hutty | tel: +44 20 7645 3523 Head of Public Affairs | Read the LINX Public Affairs blog London Internet Exchange | http://publicaffairs.linx.net/ London Internet Exchange Ltd Monument Place, 24 Monument Street London EC3R 8AJ Company Registered in England No. 3137929 Trinity Court, Trinity Street, Peterborough PE1 1DA

4 3

Re: [anti-abuse-wg] GDPR - positive effects on email abuse
by Brian Nisbet 30 May '18

30 May '18

Folks, Right, nobody, right now, is talking about banning anyone. Can we all please step back from the way this conversation is going and discuss the facts around what is happening. Your opinions on governments or groups are yours, that's fine, but the discussion is not enhanced by them becoming the focus. Please remember, as I said, that this mailing list is covered by the RIPE Community Code of Conduct which is here: https://www.ripe.net/participate/mail/ripe-mailing-list-ripe-forum-code-of-… I would really prefer if we could ensure that everyone feels welcome to participate in discussion on this mailing list. Thanks, Brian Co-Chair, RIPE AA-WG Brian Nisbet Network Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270 > -----Original Message----- > From: anti-abuse-wg <anti-abuse-wg-bounces(a)ripe.net> On Behalf Of ox > Sent: Wednesday 30 May 2018 13:59 > To: anti-abuse-wg(a)ripe.net > Subject: Re: [anti-abuse-wg] GDPR - positive effects on email abuse > > On Wed, 30 May 2018 13:37:20 +0100 > Malcolm Hutty <malcolm(a)linx.net> wrote: > > > Please stop. This is not helpful. > > > > so, what you are saying is that I should stop sending email? > or, whatever my opinions are, has to only be helpful? > > or if you say something, then it has to be accepted? > > I am a human person, I have feelings and when my feelings are insulted, I > react. I am not a particularly helpful person. > > > > But, I do not tell other people, in public, that their opinions are rubbish. > > > > In fact, I do not recall personally insulting anyone on this list, over many > years. > > I also do not compare the opinions of other people to evil people in my > country. > > I am tired of people demanding respect but treating other people like crap. > > I am tired of wolves hiding in sheep clothing. > > I am tired of being quiet. > > I am tired of people twisting words, making up fake news. > > Like you just did Malcolm, > > Simply saying: "accusations that your political opponents abduct babies" > > Without being responsible for your words. > > You should apologise Malcolm, but you will not. > > There is no reason why I should simply accept your word from on high. > > So, ban me from this wg and this email list then. Even though I have not > abused anyone. > > > ban me for taking offense, feeling hurt and speaking the truth. > > > Please do that. Show me you can? You know you want to. > > > > On 30/05/2018 13:36, ox wrote: > > > On Wed, 30 May 2018 13:06:57 +0100 > > > Malcolm Hutty <malcolm(a)linx.net> wrote: > > >> > > >> But can we please leave out accusations that your political > > >> opponents abduct babies? That surely crosses the line. The trope > > >> is, at least, > > > > > > there are no accusations of any kind. > > > > > > and, to be more clear, nobody said anything about abducting. > > > > > > Factually: > > > https://www.nytimes.com/2018/05/28/us/trump-immigrant-children- > lost. > > > html > > > > > > The USA does forcefully remove babies from the arms of their > > > mothers. > > > > > > Furthermore: The US Government does "lose" 000 these children. > > > > > > This is not accusations. And, mentioning the facts, as they are, > > > undisputed, does not cross any line. > > > > > > And who are 'political opponents' ? > > > > > > Please do bother actually reading the argument? or ask if you did > > > not understand it? > > > > > > Simply stating that, in your opinion, there are accusations and > > > abductions are pathetic in itself as it completely ignores or > > > addresses the salient fact that Ronald said my opinion is 'rubbish' > > > and that my opinion is equal to what "Fox" blasts out and "Fox" (by > > > implication, Republicans, in America states. > > > > > > It is my choice to find that offensive as by implication my opinion > > > equates that which the USA (and Fox) is promoting. > > > > > > As it disgusts me, it is an insult and it is offensive. > > > > > > > > >> Older Than Feudalism, and very likely Older Than Dirt, and as > > >> always raising it serves no purpose other than to demonise one > > >> group of people and to smear another by association, thereby > > >> shutting down the conversation. It's not an argument, it's a > > >> transparent attempt to exclude. Please stop. > > >> > > > Please stop what? Speaking the truth? > > > > > > Taking offense at people equating my opinions to rubbish? > > > > > > Please be more clear in what you are stating Malcolm? What would you > > > like to stop? > > > > > >> More generally, I believe this discussion would be improved if > > >> people stopped throwing around terms like "European" and > > >> "Republican" as though they are terms of abuse. Our community is, > > >> and should be, open to all. > > >> > > > Who said anything to the contrary? > > > > > > Andre > > > > > > > > > > > > > >

1 0

Re: [anti-abuse-wg] GDPR - positive effects on email abuse
by Malcolm Hutty 30 May '18

30 May '18

Please stop. This is not helpful. On 30/05/2018 13:36, ox wrote: > On Wed, 30 May 2018 13:06:57 +0100 > Malcolm Hutty <malcolm(a)linx.net> wrote: >> >> But can we please leave out accusations that your political opponents >> abduct babies? That surely crosses the line. The trope is, at least, > > there are no accusations of any kind. > > and, to be more clear, nobody said anything about abducting. > > Factually: > https://www.nytimes.com/2018/05/28/us/trump-immigrant-children-lost.html > > The USA does forcefully remove babies from the arms of their mothers. > > Furthermore: The US Government does "lose" 000 these children. > > This is not accusations. And, mentioning the facts, as they are, > undisputed, does not cross any line. > > And who are 'political opponents' ? > > Please do bother actually reading the argument? or ask if you did not > understand it? > > Simply stating that, in your opinion, there are accusations and > abductions are pathetic in itself as it completely ignores or > addresses the salient fact that Ronald said my opinion is 'rubbish' > and that my opinion is equal to what "Fox" blasts out and "Fox" (by > implication, Republicans, in America states. > > It is my choice to find that offensive as by implication my opinion > equates that which the USA (and Fox) is promoting. > > As it disgusts me, it is an insult and it is offensive. > > >> Older Than Feudalism, and very likely Older Than Dirt, and as always >> raising it serves no purpose other than to demonise one group of >> people and to smear another by association, thereby shutting down the >> conversation. It's not an argument, it's a transparent attempt to >> exclude. Please stop. >> > Please stop what? Speaking the truth? > > Taking offense at people equating my opinions to rubbish? > > Please be more clear in what you are stating Malcolm? What would you > like to stop? > >> More generally, I believe this discussion would be improved if people >> stopped throwing around terms like "European" and "Republican" as >> though they are terms of abuse. Our community is, and should be, open >> to all. >> > Who said anything to the contrary? > > Andre > > > -- Malcolm Hutty | tel: +44 20 7645 3523 Head of Public Affairs | Read the LINX Public Affairs blog London Internet Exchange | http://publicaffairs.linx.net/ London Internet Exchange Ltd Monument Place, 24 Monument Street London EC3R 8AJ Company Registered in England No. 3137929 Trinity Court, Trinity Street, Peterborough PE1 1DA

3 2

Re: [anti-abuse-wg] GDPR - positive effects on email abuse
by Ronald F. Guilmette 30 May '18

30 May '18

ox <andre(a)ox.co.za> wrote: >Firstly I would like to comment that the multinationals and their funded trade >groups (and their lobby orgs) shouted from the rooftops that if the GDPR came >into effect, Internet in the EU would collapse and there would be digital doom >and gloom. I am not a multinational. I am an individual volunteer anti-abuse researcher. And yet even -I- have told everyone I know that the disappearance of public WHOIS is and will be an epic catastrophy. If there was cybercrime on the Internet before, it will be increased, going forward, by tenfold. >How wrong they were (hindsight is perfect - as we can all clearly see) Be patient. The change has only just occurred. >The EU has truly become a world and global leader in the reclamation of >individual rights and the free Internet. Here on this side of the pond, one usually has to turn on Fox News in order to be treated to this level of rubbish. The only thing that has happened is that private researchers the world over have been effectively blinded due to the supreme arogance and idiocy of europeans... europeans who, in their religious fervor, have come to view it as their holy obligation to foist their demented notions onto the rest of the world, whether any of the rest of us like it or not. Meanwhile the malevolent forces of state-sponsored intrigue and violation of human rights are and shall remain totally unfettered and unaffected by GDPR, as they will be the first ones to obtain special exemptions allowing them to continue to see WHOIS data. The CIA, NSA, BDN, and FSB are undoubtedly celebrating the arrival of GDPR, as it further entrenches their special status at the expense of the great unwashes masses. Friday was a sad day for both transparency and democracy, but all across the globe both criminals and statists undoubtedly celebrated it with toasts of champaign. Regards, rfg

12 34