- anti-abuse-wg - mailman.ripe.net

Call For Agenda Items - RIPE 85
by Brian Nisbet 22 Aug '22

22 Aug '22

Colleagues, We hope you're all having a good summer! As you have hopefully seen, registration has now opened for RIPE 85 in Belgrade - https://ripe85.ripe.net/ The meeting, running from the 24th - 28th October, will be hybrid and we're hoping to continue to evolve and make it as useful as possible for those in person and remote. The Anti-Abuse WG will be meeting and Markus, Tobias and I would invite people to submit topics for discussion, presentations for general enlightenment and, of course, work items for the working group. Speakers & presenters can either be present in Belgrade or reaching us live via the Internet! The session is currently scheduled for Thursday 27th October, but the date and time may both change as the various agendas fill up, we'll keep you posted. As always you can reach us at aa-wg-chair(a)ripe.net Thanks, Brian Co-Chair, RIPE AA-WG Brian Nisbet (he/him) Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

1 0

Re: [anti-abuse-wg] So many idiots. So little time.
by Alan Levin 22 Aug '22

22 Aug '22

On Mon, 22 Aug 2022 at 07:50, Alun Davies <adavies(a)ripe.net> wrote: > I’m out of office till 22 August. Any RIPE Labs related queries can be > sent to labs(a)ripe.net and one of my colleagues will get back to you. > irony - three unsolicited messages on the same subject - appropriate too > Jeroen, > > ist's hard to distinguish between straight statements and serious > questions on one hand and sarcasm, rhetorical questions and strawman > arguments on the other hand in written communication, especially when there > sometimes seems to be a "mode switch". I'm trying to respond seriously and > to be explicit about how I understood your statements. > > > > Am 14.08.22 um 10:26 schrieb jeroen(a)hackersbescherming.nl: > > My bad! I assumed that when u create or follow a training course that u > want > > to learn or teach a way that ALWAYS works. > > > > I'm unsure whether you meant that seriously or sarcastically. > > > > Of course the assumption is wrong. Training is a way of improving your > ability to do something, not of learning something that always works. A > football team will train to learn to play better and win more games, not to > learn a away that will let them win ALWAYS. Similarly, an abuse desk team > will train to learn ways of detecting abuse earlier, to distinguish between > true and false abuse accusations, to use tools and automation to focus > their human attention on the tricky problems instead of doing rote work, > etc. None of that will guarantee that there will be no abuse from their > network, but it will likely reduce the amount by catching it quicker and > making it unattractive for spammers. Of course, that's the theory, but my > experience from the other side of the fence is that quick and swift action > is the primary thing that reduces the amount of spam, and it should work > equally well and on a larger volume on the provider side. > > > > > > With my assumption of the below. > > To solve the abuse problem u either need a system that can hold the > abuser > > responsible or and that would be even better u need a system where nobody > > would grow an interest to even try to abuse > > > > Did you forget a period here? As such, this sentence sort of makes > sense, although I would not strive to "solve" the abuse problem but to > reduce the volume and impact on recipients. Holding abusers responsible may > be one way (although it would be necessary to define what that means). > > > > A system where nobody would grow an interest to even try abuse is > impossible, we know from the non-effectiveness of capital punishment > against murder etc. that there is no effective deterrant that keeps people > from wanting to do and actually doing horrible things. The only "effective" > way would be to lock up everybody as a safety measure. That's like blocking > access to port 25, surely it keeps out the spam, but would have some > undesirable side effects. > > > > So, this is not what I want. > > > > and when u start thinking into > > this direction all the other "BIG" problems in the world will become > easy to > > solve. (Yes u read this right they are easy to solve, we currently just > use > > the wrong systems (all over the world) to guide and lead us) > > Is this a strawman argument of the form "we should not try to solve > problem X because we can't solve problem Y and that's even bigger"? That's > faulty logic, I assume written tongue-in-cheek. > > > > When u would have a good system then a large portion or maybe even all of > > the current training material would be irrelevant since it is based on > the > > current system that doesn't provide a solution for the problem. > > > > That's an assumption about the training material (which I haven't seen > and know nothing about) and the current system that I don't share. It seems > to imply that there is no way of reducing the amount of spam in the current > system, which is IMO not true. > > > > I do think that the current system is lacking in some areas but is > overall usable, and that it is possible to reduce abuse within the > framework of the current system. Usable training material would teach what > can be done at one point (one provider) to achive this without requiring > undue cooperation from other players or changing the system. That is, > actually doable changes to one's operation to reduce the amount of abuse. > > > > > > What u are saying is that when I create a training that teaches 1+1=11 > and > > someone out there wants to learn this that this would be a usefull > training > > .... (maybe for someone to do on his own but not for a global/regional > > solution). > > Looks like a strawman argument again. I'm not proposing that training > should teach nonsense and that someone out there could want to learn > nonsense, so this would be useful training. What I was saying is that a > training course (which I presumed teaches something actually useful in > reducing the spam load) can only be useful for organizations that want to > get closer to that goal. If an organization does not share that goal (or > has different main goals), they most likely would not want or need the > training. > > > > It doesn't matter to which group u belong to, in the end we all belong to > > the same group called Humans.... > > We need a fair worldwide system where power is removed from all > > individuals!!!! (Since power allways creates a form of abuse) > > > > Looks like a hyperbole/strawman argument again: "If we can't solve the > worldwide power abuse issues, we should not even try to fight local abuse". > Faulty logic. > > > > Kind regards, > > > > Jeroen > > Cheers, > > Hans-Martin > > > > -- > > > > To unsubscribe from this mailing list, get a password reminder, or > change your subscription options, please visit: > https://lists.ripe.net/mailman/listinfo/anti-abuse-wg > -- > > To unsubscribe from this mailing list, get a password reminder, or change > your subscription options, please visit: > https://lists.ripe.net/mailman/listinfo/anti-abuse-wg > -- Alan Levin ---------------------------------- +27 21 4882820 (ddi)

1 0

So many idiots. So little time.
by Ronald F. Guilmette 14 Aug '22

14 Aug '22

[ part 1 - text/plain - Notification 574B ] This is the mail system at host segfault.tristatelogic.com. I'm sorry to have to inform you that your message could not be delivered to one or more recipients. It's attached below. For further assistance, please send mail to postmaster. If you do so, please include this problem report. You can delete your own text from the attached returned message. The mail system <abuse(a)serverius.net>: host mail.serverius.net[91.221.69.174] said: 554 5.7.1 This message has been blocked because ASE reports it as spam. (in reply to end of DATA command) [ part 2 - message/delivery-status - Delivery report 435B (suppressed) ] [ part 3 - message/rfc822 - Undelivered Message 23.2KB ] Number is required after -h Return-Path: <rfg(a)tristatelogic.com> Received: by segfault.tristatelogic.com (Postfix, from userid 1237) id 754EF4E7D0; Fri, 12 Aug 2022 14:59:24 -0700 (PDT) From: "Ronald F. Guilmette" <rfg(a)tristatelogic.com> To: abuse(a)serverius.net Cc: spamreports(a)tristatelogic.com Subject: Spam from your network (AS50673): [194.104.236.160] Date: 12 Aug 2022 14:59:24 -0700 X-Rfg-Spam-Report: (AS50673): [194.104.236.160] Message-Id: <20220812215924.754EF4E7D0(a)segfault.tristatelogic.com> ...

3 7

New on RIPE Labs: Threat Integration Lessons of Indicator and Incident Exchange
by Anastasiya Pak 09 Aug '22

09 Aug '22

Dear colleagues, Integration of shared indicators of compromise is very difficult when the responsibility is distributed to organisations which are then left with the task of turning those indicators into defensive actions or blocking rules. In the new article on RIPE Labs, Kathleen Moriarty, Chief Technology Officer for the Center of Internet Security, shares lessons learned for indicator and incident exchange. Read now: https://labs.ripe.net/author/kathleen_moriarty/threat-integration-lessons-o… Kind regards, Anastasiya Pak Marketing & Communications Officer RIPE NCC

1 0

postal address in IRT objects
by denis walker 23 Jul '22

23 Jul '22

Colleagues I have started a discussion on the DB-WG mailing list about the usefulness (or not) of a mandatory postal address in the IRT object. As there are perhaps more CSIRT people on this mailing list I thought I would bring it to your attention. The discussion starts here https://www.ripe.net/ripe/mail/archives/db-wg/2022-July/007537.html Your opinions would be appreciated. cheers denis proposal author

3 2

International survey on cyber skill gap in tertiary education
by Wout de Natris 15 Jul '22

15 Jul '22

Dear colleagues, We are currently researching the growing gap between the skills of young people graduating from tertiary studies and the expectations of employers in the tech and cybersecurity industry, and we're interested in hearing your views. We kindly invite you to fill out our survey in English<https://forms.gle/Dna6nSeiKMFY11cP9>, French<https://forms.gle/BzGZmmT2iJqkLRat8> or Polish<https://forms.gle/5cgeRjz29r1ZKTWE8>. The deadline is 15 August. The survey has been developed by the IGF's Internet Standards, Security and Safety Coalition (IS3C)<http://www.is3coalition.org>. It aims to establish where the gaps are and possible solutions, as well as to find out more about current good practice in this area around the world. To do this we need your views, knowledge and expertise. We hope you can assist us in getting a clear picture of the current playing field by filling in this questionnaire. An analysis of results will be made available at www.is3coalition.org<http://www.is3coalition.org/> in September 2022, in the lead up to a series of workshops bringing together academia and industry. If you know colleagues interested in this topic, then please share this survey with them. Best regards, Janice Richardson, Wout de Natris Chair of WG2 of the IS3C IS3C Cordinator https://forms.gle/5cgeRjz29r1ZKTWE8 - Polish version https://forms.gle/BzGZmmT2iJqkLRat8 - French version https://forms.gle/Dna6nSeiKMFY11cP9 - English version - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - De Natris Consult Kamerlingh Onnesstraat 43 Tel: +31 648388813 2014 EK Haarlem Skype: wout.de.natris denatrisconsult(a)hotmail.nl<mailto:denatrisconsult@hotmail.nl> http://www.denatrisconsult.nl Blog http://woutdenatris.wordpress.com

1 0

Reclamation of Number Resources
by Ronald F. Guilmette 07 Jul '22

07 Jul '22

Greetings all, As many of you no doubt know, there has been quite an extraordinarily large brouhaha of late within the AFRINIC region relating to AFRINIC's efforts to reclaim certain large blocks of IPv4 addresses from one particular member organization. This effort has resulted in considerable litigation within Mauritius, the home country of AFRINIC. Partially as a result of this ongoing controversy, but also just for my own edification, I would like to ask a number of questions about any and all prior instances in which RIPE has reclaimed number resources from member organizations, based on policy. It seems safe to assume that there have historically been some instances in which RIPE memberships have been terminated, and any associated assigned number resources reclaimed, if and when a given member has simply failed to pay fess due to RIPE. My questions however have to do with situations where policy violations other than the non-payment of fees are involved. Specifically, I would like to know if any of you can recall past instances where number resources have been reclaimed, by RIPE, for any of the following reasons: *) Usage of the assigned number resources was no longer consistant with the original justification submitted to RIPE. *) Violation(s) of out-of-region usage policy. *) Any other policy violations. Thanks in advance for any and all responses. Regards, rfg

1 0

Adding a "Security Information" contact?
by Max Grobecker 06 Jul '22

06 Jul '22

Moin-Moin and hello, TL;DR: Should there be an optional contact for sending security information to (i.e. about vulnerable services), which can be different from the abuse contact? Background: We get a reasonable amount of security information sent to our abuse mailbox about things like "There's a vulnerable Confluence server on your network" and "This IP has contacted a botnet C&C server". Technically, this is not an abuse related issue, but still relevant to know and forward to the respective customer. Most of these e-mails originate from our local CERT (in my case CERT-BUND in Germany) but there are some other senders which are informing about these vulnerable services. I guess, most other providers know about these from their local CERTs or other organizations. Our abuse mailbox is not overflowing with these, of course, but it makes semi-automated handling a bit painful. For example, we would like to forward these information to our customers, but we wont need to take further action on this, because we refuse to break into the offices of our customers at night and patch their software. Also, sometimes these reports contain outdated data and the vulnerability has been removed in the time between collecting these information and sending the e-mail. On the other hand, for real abuse like sending spam or participating in DDoS, we also want to forward this information as quick as possible (automated), but also we want to know about and escalate so we can pull the plug if needed. So I wondered, if there (c|sh)ould be an optional contact/role for sending security related information to? This could be a different mailbox which does another automated handling of forwarding this notifications. What is your opinion on this? Greetings Max

10 22

RIPE 84 minutes
by Markus de Brün 29 Jun '22

29 Jun '22

Hi all, our colleagues from RIPE NCC provided minutes for the AA WG session at RIPE 84. Please have a look at them and let us know by 07.07.22 if you have any additions, clarifications or comments. Thanks, Markus

1 0

Proposal 2022-01
by Ronald F. Guilmette 24 Jun '22

24 Jun '22

Just curious... How many of you folks have actually read sections 4.0, 5.0, and 6.0 of this pending proposal from the Database Working Group? https://www.ripe.net/participate/policies/proposals/2022-01 I suspect that many of you are going to want to read those sections before you have your memberships revoked for non-compliance. Regards, rfg

2 2