- anti-abuse-wg - mailman.ripe.net

Re: [anti-abuse-wg] anti-abuse-wg post from hank@interall.co.il requires approval
by Markus de Brün 16 Feb '23

16 Feb '23

Hello Hank, thanks for your email yesterday. It was held, because it was too big, and I rejected it by mistake. Would you to so kind to send it again? Apologies and many thanks in advance, Markus (co-chair anti-abuse wg)

1 0

RIPE NCC Anti-Abuse Training A Reality!
by Brian Nisbet 03 Feb '23

03 Feb '23

Colleagues, After much hard work by both the RIPE NCC Learning and Development Team and members of this Working Group, the Anti-Abuse training is now a reality! The training is primarily intended for new LIRs and those who are planning to set up an abuse desk, but there's likely something in there for a lot of people. The first webinar was held recently and the whole thing is now available here: https://www.ripe.net/support/training/webinar-recordings/webinar-anti-abuse… The content has undergone a couple of slight revisions since then and it will be rerun in Q2 of this year. We would encourage you all to spread the word to those for whom it would be useful to try to make the world a better place for Internet users! Thanks again to all who were involved! Brian Co-Chair, RIPE AA-WG Brian Nisbet (he/him) Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

3 2

Anti-Abuse Webinar 25 January 2023
by Gerardo Viviers 03 Jan '23

03 Jan '23

Dear colleagues, I’m wishing you all an abuse free 2023! We invite you to join our new RIPE NCC webinar about Anti-Abuse taking place on Wednesday, 25th of January 2023 at 10:00 (UTC). This webinar is an introduction to the topic of network abuse and handling abuse reports. You will understand the importance and added value of abuse management while learning how to set up an abuse desk. For more information and registration please visit this page. — Please help us promote the RIPE NCC Anti-Abuse Webinar by sharing the following social media posts in your network: LinkedIn: https://www.linkedin.com/posts/ripe-ncc_webinar-network-abuse-activity-7009… Facebook: https://www.facebook.com/photo?fbid=538964928274042&set=a.348591780644692 Twitter: https://twitter.com/ripencc/status/1603395769825796096 We are thankful for your help. Kind regards, Gerardo Viviers RIPE NCC Learning & Development

1 1

Minutes from RIPE 85
by Markus de Brün 10 Nov '22

10 Nov '22

Hi all, thank you for attending the Anti-Abuse Working Group session at RIPE 85 and for your contributions and feedback. Our colleagues from RIPE NCC provided minutes for the session. Please have a look at the minutes and let us know by 24.11.2022 if you have any additions, clarifications or comments. Regards, your co-chairs

1 0

Draft Agenda - AA-WG Session @ RIPE 85
by Brian Nisbet 11 Oct '22

11 Oct '22

Colleagues, Here is the draft agenda for our session on Thursday 27th October at 09:00 CEST. There is still some time available in the agenda if you would like to raise a work item, policy discussion or issue to the WG or present on a suitable topic. A. Administrative Matters * Welcome * Scribe, Chat, Stenography * MeetEcho Mic & Chat Etiquette * Ratings Where Appropriate * Approve Minutes from RIPE 84 * Finalise agenda * Code of Conduct B. Update * B.1. Recent List Discussion * B.2. RIPE NCC Training Webinar C. Policies - *C.1. D. Interactions - *D.1. Update from German Anti-Abuse Group "KG Abuse" E. Presentation - *E.1. urlscan.io X. A.O.B. Z. Agenda for RIPE 86 Thanks, Brian Co-Chair, RIPE AA-WG Brian Nisbet (he/him) Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

1 0

Anti-Abuse Training - Final? Draft Slides & Zoom Call
by Brian Nisbet 26 Sep '22

26 Sep '22

Colleagues, As you know the RIPE NCC L&D team has been working on a one hour anti-abuse training session. We've received substantial input from the WG and we're hoping that will continue as the Gerardo and the team work to get everything into the final state. First off, this is the current slide deck. If you have the opportunity we would ask if you could take a look and either reply with your feedback to the list or directly to Gerardo - gviviers(a)ripe.net https://docs.google.com/presentation/d/1FylfGQoMrgg0xJjNnE3wLvcW9KV1KmwcE4c… We're also arranging for another online round table to discuss the material as needed, because sometimes voice is better than text. This will be taking place on Tuesday 27th September from 10:00 - 12:00 CEST on Zoom. The plan is to run down through the full slidedeck and allow for comments and discussion as needed. The link to this call will be: https://ripe.zoom.us/j/91448568019?pwd=VDFKWEJqT2lkbFdGbVpaL0FmL1R1Zz09 This call, as with any AA-WG activity, will be subject to the RIPE Community Code of Conduct. Thanks for all your work so far and I look forward to more productive discussion! Brian Co-Chair, RIPE AA-WG Brian Nisbet (he/him) Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

3 3

Survey into skill gap in cyber security education and demand
by Wout de Natris 09 Sep '22

09 Sep '22

Dear colleagues, 67.5% of companies consider the gap between their expectations and the skills tertiary graduates bring to the workplace is having a strong or very strong impact on their performance. Many point to a lack of understanding of secure web communications, cloud computing and strategic thinking. We'd love to hear your views and suggestions. Join our (IS3C) survey at https://forms.gle/Dna6nSeiKMFY11cP9. Please consider taking this survey to ensure that its results are balanced and representative as this step is only the beginning of our work. Best regards, Wout de Natris Coordinator Internet Standards, Security and Safety Coalition (IS3C) IS3C: Making the Internet more secure and safer - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - De Natris Consult Kamerlingh Onnesstraat 43 Tel: +31 648388813 2014 EK Haarlem Skype: wout.de.natris denatrisconsult(a)hotmail.nl<mailto:denatrisconsult@hotmail.nl> http://www.denatrisconsult.nl Blog http://woutdenatris.wordpress.com

1 0

Yet another BGP hijacking towards AS16509
by Siyuan Miao 23 Aug '22

23 Aug '22

Hi folks, Recently I read a post regarding the recent incident of Celer Network and noticed a very interesting and successful BGP hijacking towards AS16509. The attacker AS209243 added AS16509 to their AS-SET and a more specific route object for the /24 where the victim's website is in ALTDB: (Below is our IRRd4 server NRTM logging, UTC timezone) irrd.log-20220817.gz:31106270-ADD 96126 irrd.log-20220817.gz:31106280- irrd.log-20220817.gz:31106281-as-set: AS-SET209243 irrd.log-20220817.gz:31106306-descr: quickhost set irrd.log-20220817.gz:31106332-members: AS209243, AS16509 irrd.log-20220817.gz:31106362:mnt-by: MAINT-QUICKHOSTUK irrd.log-20220817.gz:31106392-changed: crussell(a)quickhostuk.net 20220816 irrd.log-20220817.gz:31106438-source: ALTDB irrd.log-20220817.gz:31147549-ADD 96127 irrd.log-20220817.gz:31147559- irrd.log-20220817.gz:31147560-route: 44.235.216.0/24 irrd.log-20220817.gz:31147588-descr: route irrd.log-20220817.gz:31147606-origin: AS16509 irrd.log-20220817.gz:31147626:mnt-by: MAINT-QUICKHOSTUK irrd.log-20220817.gz:31147656-changed: crussell(a)quickhostuk.net 20220816 irrd.log-20220817.gz:31147702-source: ALTDB Then they started announcing the prefix ... under another AWS ASN (AS14618) I guess AS1299 Arelion doesn't check if the origin AS of an announcement is in the customer's AS-SET but it's pretty normal and understandable. https://stat.ripe.net/widget/bgplay#w.resource=44.235.216.0/24&w.ignoreRean… Type: A > announce Involving: 44.235.216.0/24 Short description: The new route 34854 1299 209243 14618 has been announced Path: 34854, 1299, 209243, 14618, Community: 1299:35000,34854:3001 Date and time: 2022-08-17 19:39:50 Collected by: 00-2.56.11.1 Hjacking didn't last too long. AWS started announcing a more specific announcement to prevent hijacking around 3 hours later. Kudos to Amazon's security team :-) Type: A > announce Involving: 44.235.216.0/24 Short description: The new route 58057 34549 5511 1299 16509 has been announced Path: 58057, 34549, 5511, 1299, 16509, Community: 5511:521,5511:666,5511:710,5511:5511,34549:100,34549:5511 Date and time: 2022-08-17 23:08:47 Collected by: 00-194.50.92.251 The attacker cleaned up the IRR objects on 17 Aug and surprisingly no one seems to notice them ... irrd.log-20220819.gz:26517714-ADD 96196 irrd.log-20220819.gz:26517724- irrd.log-20220819.gz:26517725:as-set: AS-SET209243 irrd.log-20220819.gz:26517750-descr: quickhost set irrd.log-20220819.gz:26517776-members: AS209243, AS35437, AS37497 irrd.log-20220819.gz:26517815-mnt-by: MAINT-QUICKHOSTUK irrd.log-20220819.gz:26517845-changed: crussell(a)quickhostuk.net 20220817 irrd.log-20220819.gz:26517891-source: ALTDB irrd.log-20220819.gz:26517910-DEL 96197 irrd.log-20220819.gz:26517920- irrd.log-20220819.gz:26517921-route: 44.235.216.0/24 irrd.log-20220819.gz:26517949-descr: route irrd.log-20220819.gz:26517967-origin: AS16509 irrd.log-20220819.gz:26517987-mnt-by: MAINT-QUICKHOSTUK irrd.log-20220819.gz:26518017-changed: crussell(a)quickhostuk.net 20220816 irrd.log-20220819.gz:26518063-source: ALTDB Nowadays hijacking a service by forging AS path is pretty easy and RPKI won't be able to solve this (as it validates origin AS and prefixes only) :-( Regards, Siyuan

2 3

Re: [anti-abuse-wg] Autoresponders
by Ángel González Berdasco 22 Aug '22

22 Aug '22

On 2022-08-22 at 11:40 +0200, Alan Levin wrote: > On Mon, 22 Aug 2022 at 07:50, someone <…(a)ripe.net<http://ripe.net>> wrote: > > I’m out of office till 22 August. Any RIPE Labs related queries can > > be sent to labs(a)ripe.net<mailto:labs@ripe.net> and one of my colleagues will get back to > > you. > > irony - three unsolicited messages on the same subject - appropriate > too This list was lucky. db-wg received 477 copies of this Out of Office message. It actually serves as a great example of what an autoresponder shall *not* be doing: * It only ran when the user returned to the office * It replied to every message, with no waiting period * It replied to mailing lists¹ * It replied *to its own vacation message* distributed by the mailing list, creating a loop And it happened from inside the same organization, so the delivery delay would have been minimal. It must have been a tiny Bedlam3 for RIPE. RFC 3834 recommendations were not pointless musings. Kind regards ¹ The list properly contained a Precedence: list header, so no fault of the mailing list software here. -- INCIBE-CERT - Spanish National CSIRT https://www.incibe-cert.es/ PGP keys: https://www.incibe-cert.es/en/what-is-incibe-cert/pgp-public-keys ==================================================================== INCIBE-CERT is the Spanish National CSIRT designated for citizens, private law entities, other entities not included in the subjective scope of application of the "Ley 40/2015, de 1 de octubre, de Régimen Jurídico del Sector Público", as well as digital service providers, operators of essential services and critical operators under the terms of the "Real Decreto-ley 12/2018, de 7 de septiembre, de seguridad de las redes y sistemas de información" that transposes the Directive (EU) 2016/1148 of the European Parliament and of the Council of 6 July 2016 concerning measures for a high common level of security of network and information systems across the Union. ==================================================================== In compliance with the General Data Protection Regulation of the EU (Regulation EU 2016/679, of 27 April 2016) we inform you that your personal and corporate data (as well as those included in attached documents); and e-mail address, may be included in our records for the purpose derived from legal, contractual or pre-contractual obligations or in order to respond to your queries. You may exercise your rights of access, correction, cancellation, portability, limitationof processing and opposition under the terms established by current legislation and free of charge by sending an e-mail to dpd(a)incibe.es. The Data Controller is S.M.E. Instituto Nacional de Ciberseguridad de España, M.P., S.A. More information is available on our website: https://www.incibe.es/proteccion-datos-personales and https://www.incibe.es/registro-actividad. ====================================================================

1 0

Apologies for spam
by Alun Davies 22 Aug '22

22 Aug '22

Hello all, My apologies to everyone who received my out of office response this morning. Just wanted to note that the relevant messages have now been removed from the archives. Again, sorry for the spam! Best regards, Alun Davies RIPE NCC

1 0