- anti-abuse-wg - mailman.ripe.net

More funny business involvolving the RIPE Route Registry
by Ronald F. Guilmette 15 Aug '17

15 Aug '17

I'd like to call the attention of all of you to a NANOG posting that I made recently: https://mailman.nanog.org/pipermail/nanog/2017-August/091954.html It would appear that the network AS29073, formerly known as Ecatel, and also formerly known as Quasi Networks, and now known as Novogara Ltd. may be having a spot of bother soon. The English translation of a document that I was given a link to today appears to indicate that some or all of the principals behind this specific "bullterpoof hosting" company have been ordered by a Dutch court to answer some pointed questions about their ownnership and/or control over this "Seychelles Islands" company, and perhaps also about their alleged tendency to provide hosting for other people's intellectual property: https://uitspraken.rechtspraak.nl/inziendocument?id=ECLI:NL:RBDHA:2017:9026… That, of course, is not really -my- main concern. I am at the moment rather more concerned about the manner in which they came to be doing routing for a particular legacy Afrinic /14 block, i.e. the 196.16.0.0/14 block. That has not been adequately explained as of now, I think. I wonder if any of you on this list peer with this network, AS29073 and if so, why. It seems to have a rather colorful reputation, to say the least: http://www.cyberlightglobal.com/is-another-attack-on-western-financial-inst… http://news.softpedia.com/news/complex-bitcoin-phishing-scheme-leads-back-t… https://umbrella.cisco.com/blog/2016/06/20/bitcoin-wallet-phishes-reveal-ro… https://techcrunch.com/2012/08/04/grum-inside-the-takedown-of-one-of-the-wo… I can speak another time about how easy it was, apparently, for these clever fellows to slip a route object into the RIPE data base which would seem to sanction their routing of the suspect block in question. Regards, rfg

1 0

Re: [anti-abuse-wg] Not Abuse
by peter h 15 Aug '17

15 Aug '17

On Tuesday 15 August 2017 09.17, ox wrote: > Hi All, > > Some spammers are now sending "verify your email account" spam abuse. I would say that sending a single unsolicited "verify your email account" IS SPAM The keyword here is "unsolicited" This is not the same as a mail sent as a respons to some action done, subscribe or purchase from someone. That "verify your email account" is legitimate. But unsolicited is always spam. > > When an email address is submitted and a vendor confirms that email > address (prior to subscribing it to a bulk mail list, etc) : > > imho, sending a single (one) email to verify/confirm every 24 hour > period - with a maximum of two verify/confirms reminders (one per 24 > hour period) - is not abuse. > > But sending more than one verify/confirm email, in a single 24 hour > period - and sending more than 3 emails in total - in any period - is > abuse. > > I know that I have used the spammer, twitter.com before as an example, > but they are good examples to use. > > Twitter.com seems to never remove their victims email addresses (and > even ignores unsubscribe requests). Twitter.com also seems to go > through bursts of activity and sends many confirmation emails to > spamtraps (accounts that has never existed and only exists in stolen > databases - i.e not real person/people) - whether criminals or third > parties submit these fake email addresses to twitter.com or how > twitter.com obtains these addresses are not relevant to this thread > > What is relevant is: Do you agree that sending "more than 3 verify your > email account" is abuse? > > If you do not agree, what do you think that number should be? > > How many "verify your email address" and reminders to confirm, etc. is > not abuse, in your opinion? > > Like I said, I think one in 24 hours and a total of three, seems > reasonable to me. > > Thanks! > > Andre > > -- Peter Håkanson There's never money to do it right, but always money to do it again ... and again ... and again ... and again. ( Det är billigare att göra rätt. Det är dyrt att laga fel. )

2 1

Not Abuse
by ox 15 Aug '17

15 Aug '17

Hi All, Some spammers are now sending "verify your email account" spam abuse. When an email address is submitted and a vendor confirms that email address (prior to subscribing it to a bulk mail list, etc) : imho, sending a single (one) email to verify/confirm every 24 hour period - with a maximum of two verify/confirms reminders (one per 24 hour period) - is not abuse. But sending more than one verify/confirm email, in a single 24 hour period - and sending more than 3 emails in total - in any period - is abuse. I know that I have used the spammer, twitter.com before as an example, but they are good examples to use. Twitter.com seems to never remove their victims email addresses (and even ignores unsubscribe requests). Twitter.com also seems to go through bursts of activity and sends many confirmation emails to spamtraps (accounts that has never existed and only exists in stolen databases - i.e not real person/people) - whether criminals or third parties submit these fake email addresses to twitter.com or how twitter.com obtains these addresses are not relevant to this thread What is relevant is: Do you agree that sending "more than 3 verify your email account" is abuse? If you do not agree, what do you think that number should be? How many "verify your email address" and reminders to confirm, etc. is not abuse, in your opinion? Like I said, I think one in 24 hours and a total of three, seems reasonable to me. Thanks! Andre

1 0

Re: [anti-abuse-wg] Abuse & ipv6 - Email Servers and e-Registry
by phishing＠storey.xxx 05 Aug '17

05 Aug '17

1 0

Abuse & ipv6 - Email Servers and e-Registry
by ox 05 Aug '17

05 Aug '17

Hi, ipv6 & abuse has many different aspects and this specific thread is about email servers. If you wish to discuss other abuse aspects of ipv6, please do have the decency (and courtesy/netiquette) of starting a new thread. I am working from the proposition that ipv6 email servers will operate on a pro active basis as regards abuse, instead of a reactive basis (as is the case with ipv4) - The eventual proposed protocol will see spam and other types of email abuse almost disappear and become the exception, rather than the rule. Current status: All current production email servers offering ipv6 do so on a white list basis Some reputation lists are already building 'white lists' of ipv6 - many spammers and abusers are already embedded into the startup white lists and there are already many practical challenges in low/small data. White listing, by itself, will not work (or at the very least will be a chargeable service and even then) will be problematic as individual email servers would have little or no control, except by manually allow/deny individual ipv6 numbers/ranges (in a playing field of 2(128)) ipv6 for email servers is going to be much more problematic and challenging than many thought as it would require less privacy (deep content inspection) and as implemented by some large providers, would mean the eventual end of privacy. (as small esp's are forced out and the email players become larger and larger) Large ipv6 email providers will only able to filter abuse properly by filtering content and if not discussed/solved the eu/world will have less/no freedom. I am working on a concept where DNS TXT is used on a devolutionary basis (using encryption) from an ipv6 DNS email server registry to secondary master sub domains - cross referenced with the sub reply on TXT. This would enable email servers to manage and exercise their own inter operability (as they do now) as well as manage their own reputation score(s), w/l and even b/l (by omission/default) and even do so close to real time (as they do now, re-actively) There are a number of challenges: This could be 'hidden' as yadnswl (yet another ipv6 dns whitelist - in fact there are already some ideas of doing exactly that...) But, in reality (and in truth/openness) all the planned ipv6 white I have seen implies 'central control' - and would already be a 'central registry of sorts. (we are going to end up with some version(s) of this anyway - it is a question of whether it will be open or provided using different terminology by someone - and how it would be controlled or used) I am proposing calling a cow a cow, and calling it a "registry" by name. As this would be called a 'registry' of email servers (and not a dns white list) - the age old (well, decades old) arguments of 'control' / 'transparency' and other obvious issues, come into play - as many of the objectors to a registry would need to be satisfied around the open/transparency/control issues that such a registry would seem to provide - So I would need to efficiently communicate the obvious foundation propositions clearly to avoid problems in that regard. *********************************************************************** The problem/challenge with email abuse has always been in the balance between freedom (to send email anywhere) and in taking responsibility for what you send. To be responsible you have to be identifiable (not anonymous) and this has always been the problem. ********************************************************************** It is quite simple, I am proposing the addition and removal from the registry would be free and open (no control from registry) The registry is only a "starting point" or a single point of reference and has no authority or control over and of anything. And as such a proposed registry would accommodate all resources there should be less objections to it. The registry would delegate a unique sub domain to a single ipv6 number and with 2(128) and the registry intended for 'server' or 'service' on the behalf of other ipv6 or clients, there would need to be at least some defining criteria and a balance with freedom/open and being responsible for the resource needs to be found, for such a registry to be credible and fair. The technology exists to do this, the protocol in general principle, is solid. (and could be refined anyway) I am soliciting comments as to the balance of open/free/fair with responsible - what minimum is required in filing registration at a proposed registry such as this? Obviously: ipv6 number (as a minimum) - but what else? Own DNS TXT encrypted key (match rDNS) 1. Name? 2. Email Address? 3. Phone Number? 4. Physical Address? 5. 2nd factor email address? 6. ? Also, welcome to email me off list - as on list this thread may probably generate a lot of static/noise useless/valueless/empty comments... as well as awake many trolls... Andre

1 0

Re: [anti-abuse-wg] AS41609, AS203974, and Alexandru ("Andrei") Stanciu / Suceava, Romania
by Ronald F. Guilmette 05 Aug '17

05 Aug '17

ox <andre(a)ox.co.za> you wrote: >For Abuse purposes... Email Administrators should as a rule not >relay/accept emails from IP numbers with no reverse... I do agree completely. However as is made clear by this exact case, there are enough inbound mail servers still left on this planet that do not follow that rule so as to make it worthwhile for spammers to continue to go to great lengths... even hijacking old & abandoned legacy IPv4 blocks... to get "fresh" IP addresses, even if they can't set up any reverse DNS for those. In a way, this case shows just how desperate spammers have become in their search for "fresh" IP addres space. Regards, rfg

2 1

Reliance on rDNS
by Niall O'Reilly 05 Aug '17

05 Aug '17

By co-incidence, this is operationally relevant for me. On 4 Aug 2017, at 20:46, Ronald F. Guilmette wrote: > ox <andre(a)ox.co.za> you wrote: > > >> For Abuse purposes... Email Administrators should as a rule not >> relay/accept emails from IP numbers with no reverse... > > > I do agree completely. However as is made clear by this exact case, > there are enough inbound mail servers still left on this planet that > do not follow that rule This is not a "rule", but a heuristic of first approximation which, if relied on exclusively and dogmatically, has the consequences of arbitrarily penalizing the innocent, breaking network neutrality, and violating the end-to-end principle. Any of these consequences is itself an abuse. Email administrators and reputation brokers have other information and processes available to them which can be used to mitigate these consequence when appropriate. Failure to do so is either to play the bully or complacently to take the lazy option. I am currently in frustrating correspondence with a reputation broker who rigidly applies this so-called "rule", to whom I have most recently written the following. This is not helpful. The address of this mail server is provisioned dynamically, but has long-term persistence. I have no reason to believe that my connectivity provider can oblige me by implementing the measures you demand. It is not only today or yesterday that more sophisticated and flexible approaches than simple reliance on rDNS data have been available for making assessments of reputation. I have dealt with other reputation services in the past, and have been able to satisfy their requirements for whitelisting after a far shorter exchange of correspondence that the one in which we are now engaged. Your company, by relying, as it apparently does, solely on rDNS data to determine the reputation of the mail server I operate and announcing this reputation to its clients, is choosing act in a way which seems to involve defamation, denial of service, and holding the users of my e-mail system to ransom. This is, quite simply, abuse or, as I put it in an earlier message, bullying. I have re-used this item of correspondence with the intent of illustrating a current operational problem which shows the pernicious effect of the unmitigated application of the so-called "rule" mentioned in earlier posts. It is not my intent, and I hope I have not strayed too far in that direction, to mis-use this list as a channel for reporting abuse. Best regards, Niall O'Reilly

3 2

Re: [anti-abuse-wg] AS41609, AS203974, and Alexandru ("Andrei") Stanciu / Suceava, Romania
by Suresh Ramasubramanian 04 Aug '17

04 Aug '17

I do get that a problem with incompetence and/or malice depending on which way hanlons razor cuts in allowing these ranges to be hijacked is being shoved onto receiving isps for them to mitigate it, yes. --srs > On 04-Aug-2017, at 1:35 PM, ox <andre(a)ox.co.za> wrote: > > On Fri, 4 Aug 2017 13:31:29 +0530 > Suresh Ramasubramanian <ops.lists(a)gmail.com> wrote: >> Lovely of you to mansplain rdns based spam filtering to Ron - he’s >> been doing it since at least 1998 that I know of, most probably >> earlier >> > > I think you are confused or deliberately trying to distribute FUD > > Did you note that I quoted what Ron already said on nanog - for this list? > > This means that; > > imnsho many people on THIS LIST are relaying email when there is no > reverse. > > get it? > > Andre >

2 1

New on RIPE Labs: SHA2017: Hackers' Camping, RIPE Topics
by Vesna Manojlovic 04 Aug '17

04 Aug '17

Dear colleagues, Today begins the newest edition of four-yearly Dutch summer camping conferences for and by hackers: SHA2017. http://sha2017.org/ Since there is an overlap between topics and participants within the RIPE community, this is an invitation to the talks and workshops - a small selection was recommended, from more then 200 lectures. There is a special sub-selection relevant to Anti-Abuse WG. Read more about it in this RIPE Labs article: https://labs.ripe.net/Members/becha/sha2017-hackers-camping-ripe-topics ... or if you are there too, get in touch :) Regards, Vesna Manojlovic Community Builder RIPE NCC

1 0

Re: [anti-abuse-wg] Straw-man abuse reporting system (was: New on RIPE Labs: Botnets: As We See Them in 2017)
by phishing＠storey.xxx 04 Aug '17

04 Aug '17

1 0