- anti-abuse-wg - mailman.ripe.net

Re: [anti-abuse-wg] Brian Krebs posts stophaus chat logs of Spamhaus ddos coordination
by Suresh Ramasubramanian 27 Aug '16

27 Aug '16

Curious - what factors would these be that you identified? --srs > On 27-Aug-2016, at 2:00 PM, ox <andre(a)ox.co.za> wrote: > > On Sat, 27 Aug 2016 13:41:28 +0530 > Suresh Ramasubramanian <ops.lists(a)gmail.com> wrote: >> Worth a read >> http://krebsonsecurity.com/2016/08/inside-the-attack-that-almost-broke-the-… >> > Yes, the actual logs that Brian Krebs publishes, of the conversations, > underlines and serves as clear proof of those factors which serves to > obtuse anti abuse efforts. > > Until this is resolved, Internet abuse will continue to be difficult to > manage. This makes it difficult for anyone one the Internet, > including the Cyber Criminals themselves, to deal with Internet abuse > effectively anyway. > > 2c > > Andre > >

2 1

Brian Krebs posts stophaus chat logs of Spamhaus ddos coordination
by Suresh Ramasubramanian 27 Aug '16

27 Aug '16

Worth a read http://krebsonsecurity.com/2016/08/inside-the-attack-that-almost-broke-the-… --srs

2 1

Re: [anti-abuse-wg] Definition of Abuse - preamble
by Gunther Nitzsche 25 Aug '16

25 Aug '16

On 08/25/2016 04:38 PM, ox wrote: > ... > I did not reply to this, as it will involve me being somewhat direct but, > > I have a serious problem with people when they disagree just to argue > or for no real reason. Hmm.. I still do not see any arguments against my abuse definitions except: no, I want mine. You are getting somewhat emotional here - no good. > > This means that they have a different intent - or agenda - or something > and it serves only to disrupt > My intent is to have a most broad definition of abuse as possible. You seem to intentionally want to restrict this definition. I just don't know why. But if other members of this list tend more to your definition, it will be fine for me. >>>> I even doubt that the anti-abuse-working-group is limited to >>>> network based abuse. Entering wrong registration data (let's say by >>>> FAX) could also be covered by this group though it is not a network >>>> based abuse. >>>> > This is not an abuse group for battered men or battered women or abused > animals. What are you talking about? Yes, this group is not about animals, I agree .. but what the heck..? > > It is a network abuse group. > > No, it is not an abuse group for people whose pc's has been stolen or > abused in their homes. > > No, it is not an abuse group for old fax machines or faxing of fake > documents to anyone or even for that matter faxing of documents to > commit fraud. Says who? You are, as I do, a member of this mailing list and therefore a standard member of the anti-abuse-working-group. As far as I know you are no chair nor co-chair of this group and you are not in the position to define what to discuss in this group or not. (neither am I) I don't care if abuse is commited by old or new fax machines; if it somehow involves our/any abuse-department I do care. And if I (or i.e. legal authorities) cannot identify a fraudster because of a fake registration (DNS, IP-Allocation, whatsoever..) than I do see a direct relation to this group, regardless of the used technique. So yes, it *might* be the case that a fax triggers an abuse case. I don't want to talk about fax machines all the time - I just want a definition of abuse and of the goals of this group which *allows* me and others to discuss abuse incidents regardless of the terms "internet abuse" or "a second resource". I don't think, that this wish is that abstruse.. >It is the RIPE Anti Abuse WG --- We discuss network abuse.... Well, I do not see very much discussing here - just a very "blocking" attitude. tl;dr: I prefer a very broad definition of abuse not restricted to "internet abuse" best greetings, Gunther NetCologne Systemadministration -- NetCologne Gesellschaft für Telekommunikation mbH Am Coloneum 9 ; 50829 Köln Geschäftsführer: Timo von Lepel, Mario Wilhelm Vorsitzender des Aufsichtsrates: Dr. Andreas Cerbe HRB 25580, AG Köln

2 1

Re: [anti-abuse-wg] Definition of Abuse - preamble
by Gunther Nitzsche 25 Aug '16

25 Aug '16

On 08/25/2016 03:36 PM, ox wrote: > On Thu, 25 Aug 2016 15:28:58 +0200 > Gunther Nitzsche <gnitzsche(a)netcologne.de> wrote: >> On 08/25/2016 02:38 PM, ox wrote: >>> Get it yet? >>> >> No. Sorry. :-( > okay, I will try to explain it better :) > > > Normal bitcoin mining abuse = You --> CPU > > Anyway, Internet abuse same principle One resource --> another resource > > Get it now? I know what you mean, but I don't follow you here. I do not want this restriction and cannot see one reason why you insist on this. >> "If you use my server to do something. " Stop. >> I do not need "another resource". I wonder what arguments >> you have against my suggestion of wording. >> >> I even doubt that the anti-abuse-working-group is limited to >> network based abuse. Entering wrong registration data (let's say by >> FAX) could also be covered by this group though it is not a network >> based abuse. >> > wrong registration data by fax - is not Internet abuse (doubtful if it > even normal or just abuse...) First: I do not know why you also insist on "internet abuse" - I did not see any mention of this restriction in the existing charter of this group Second: It might very well turn into "Internet abuse" i.e. when it comes to find out sources of (other) abuse related actions. If the whois-record is wrong, one could identify this registration fake as abuse. (the severity might vary) So it might be a good idea to have this issue on topic right from the beginning. In your definition a registration fake is no abuse because only one resource is involved *and* because it did not happen via the internet; in my definition it is and it belongs to the topics of this group. We can setup a doodle for this :) As long as we don't hear other opinions on this I step back again .. best greetings, Gunther >> No artificial restrictions please; they might hurt us later on. >> >> NetCologne Systemadministration -- NetCologne Gesellschaft für Telekommunikation mbH Am Coloneum 9 ; 50829 Köln Geschäftsführer: Timo von Lepel, Mario Wilhelm Vorsitzender des Aufsichtsrates: Dr. Andreas Cerbe HRB 25580, AG Köln

2 1

Re: [anti-abuse-wg] Definition of Abuse - preamble
by Gunther Nitzsche 25 Aug '16

25 Aug '16

On 08/25/2016 02:38 PM, ox wrote: > Hello Gunther, > > Okay, I have read through your reply and it seems you do not understand > that a single resource is not a network. > > Internet Abuse - Needs two resources - otherwise it is not a network > and by default - not Internet Abuse. > > If you are on my server: > unauthorized - is abuse > authorized - is not abuse > > If you use my server to do something to another resource... > > Get it yet? > No. Sorry. :-( "If you use my server to do something. " Stop. I do not need "another resource". I wonder what arguments you have against my suggestion of wording. I even doubt that the anti-abuse-working-group is limited to network based abuse. Entering wrong registration data (let's say by FAX) could also be covered by this group though it is not a network based abuse. No artificial restrictions please; they might hurt us later on. best greetings, Gunther NetCologne Systemadministration -- NetCologne Gesellschaft für Telekommunikation mbH Am Coloneum 9 ; 50829 Köln Geschäftsführer: Timo von Lepel, Mario Wilhelm Vorsitzender des Aufsichtsrates: Dr. Andreas Cerbe HRB 25580, AG Köln

2 1

Re: [anti-abuse-wg] Definition of Abuse - preamble
by Gunther Nitzsche 25 Aug '16

25 Aug '16

On 08/24/2016 12:21 PM, ox wrote: > yes at least 2 different resources always has to be involved for it to > be Internet Abuse Thanks for pointing this out, but I don't get it .. why do you want ro restrict the definition in this way? There might be the case that next year someone brings up a topic of abuse not covered by this restriction and people involved start to argue. I prefer to be as general as possible when defining such a word. ... > if you use the same resource it is not Internet Abuse - as in your own > example using someone's CPU to mine bitcoin and doing so on the CPU > directly, is not Internet Abuse (it is very abusive, though!) Of course it is - I remotely (via the internet) control your server, doing abusive things. If someone would complain at abuse@ about such an incident I would expect the source provider to act accordingly. The remote control can be a security breach, but that is not the point. > if you have broken in/compromised security etc - it is Internet abuse, > in terms of the current definition In the example of directly using my > email server to send spam it falls within the definition of Internet > abuse as defined above :) I do not see the second resource involved in this case. So therefore I would like to change the sentence to: "The infringement of usage rights by the non sanctioned use of resources" along with your additional definitions.. (This includes >=1 resources..) (Someone might correct my english) (instead of: "The non sanctioned use of a resource to infringe upon the usage rights of another resource" ") and btw .. I would also like to see Ronald's valid questions answered. If there are no actions, sanctions whatsoever following the definition of abuse and the ongoing discussions here than this Group has officially turned into a Debate Club of old nerds (including me:), beeing probably kind of ... how do I say...inefficient? (at least as a RIPE working group) ...But.. On the other hand: https://www.ripe.net/support/abuse : "The RIPE community has an Anti-Abuse Working Group <https://www.ripe.net/ripe/groups/wg/anti-abuse> that discusses topics relating to Internet abuse and ways to prevent it. If you are interested in abuse topics, you may want to join the Anti-Abuse Working Group Mailing List <http://www.ripe.net/mailman/listinfo/anti-abuse-wg/>." and: https://www.ripe.net/participate/ripe/wg/anti-abuse : (as Brian said in 2013: "The main text of that page is the WG Charter. It may be useful to be more explicit on this, but that is the charter. " "...The working group considers both technical and non-technical aspects of abuse, with the following goals: * Produce and continue to update a BCP (Best Common Practice) document for ISPs similar in nature to RIPE-409 <https://www.ripe.net/publications/docs/ripe-409> but covering a wider range of possible abusive behaviours. * Provide advice (beyond that of the BCP) to relevant parties within the RIPE region such as ISPs, governments and law enforcement agencies on strategic and operational matters. * Discuss and disseminate information on technical and non-technical methods of preventing or reducing network abuse." That could mean we should just focus on the configuration of spamassassin and force the use of dmarc and x-arf and talk about "to block or not to block a failed DKIM E-Mail" like other anti-abuse groups do instead of e.g. trying to force RIPE NCC to terminate LIR contracts based on abusive behaviour. (no irony) So instead of searching a definition of abuse (which will be really helpful I believe) we also could start to (re-)define the goals of this group. If there would be consensus that it is not the task of this group to discuss also anti-abuse behaviour of RIPE/RIPE NCC or how to treat LIRs, then we can happily focus on other things. (In that case: sorry Ronald..) But that would not be my opinion.. >Andre (searching for cover:) best greetings, Gunther NetCologne Systemadministration -- (The opinions expressed here represent my own and not those of my employer.) NetCologne Gesellschaft für Telekommunikation mbH Am Coloneum 9 ; 50829 Köln Geschäftsführer: Timo von Lepel, Mario Wilhelm Vorsitzender des Aufsichtsrates: Dr. Andreas Cerbe HRB 25580, AG Köln

3 3

Re: [anti-abuse-wg] Definition of Abuse - preamble
by Marilson 25 Aug '16

25 Aug '16

Andre, Is praiseworthy your efforts as was the effort by Denis in this group. Sometimes I have the impression that you guys are giving punch in knife tip or barking up the wrong tree. The current discussion seems to seek answers at the semantic. And the idealization of the concepts and definitions begin to collide with the use of a language that is not native to all, as well remembered by Gunther Nitzsche in his last intervention. You are one step closer to doing what Gunther's ancestor did in the century XIX discussing On the Genealogy of Morality (F. Nietzsche) beginning to investigate the root of a single word: the word abuse. What is its genesis? And more importantly, what are the conditions of its genesis? Will discuss in the light of the uses and customs of the present age but there will no consensus. Anyway, I'll put the ball on the ground and try to give my definition of abuse in the most practical way possible, with my English. CAUSE AND EFFECT First remember that I am not an IT professional and I have no concern with possible abuses that ISPs, Registrars and RIRs may suffer. They have professionals and tools to care for themselves. What matters are the billion people on the planet victims of abuse as never before happened. Today the barbarian hordes do not invade the villages with their horses. They remain comfortable and cowardly sitting in front their keyboards stealing and angering millions of people every day - and properly protected and hidden under the cloak of pernicious "protect service". Today barbarians have a new name: coward psychopaths. DEFINITION AND SOLUTION There is nothing more dispensable than the definition of abuse. It is explicit in all AUPs, TOSs and ASPs that govern all contracts between these companies and their customers. Nothing is easier to implement than a solution to end the abuse. I have the perfect recipe: a dose of shame, a dose of honesty, a drop of ethics and a spray jet in the nose with Syntocinon to replace the Oxytocin that the hypothalamus of psychopaths do not produce - empathy. In other words, providers just need to put into practice what their AUPs, TOSs and ASPs, abundantly displayed on their websites, contractually determines. Losses and damage from such abuse are solely the responsibility of those companies. REGULATION AND MODUS OPERANDI If a victim denounces, with evidence, a customer of an ISP, the ISP must contact and warn his customer. If this victim denounce for a second time the same client, the ISP is obliged to penalize his client. In the third complaint ceases to be abuse to be a crime. Here it is characterized conspiracy to the practice of crime. And that is the psychotic posture, dishonest and greedy of most ISPs. No matter if we are denouncing a spammer or scammer. And by insisting on the complaint, copying to various institutions and to the media, the retaliation will be inexorable. Every crime is an abuse but neither all abuse is a crime. PROGNOSIS Nothing will be done. The status quo shall prevail. Marilson

1 1

Re: [anti-abuse-wg] Definition of Abuse - preamble
by Gunther Nitzsche 24 Aug '16

24 Aug '16

Hi, On 08/24/2016 10:05 AM, Andre Coetzee wrote: > > ================= > Definition of abuse > ================= > > "The non sanctioned use of a resource to infringe upon the usage rights > of another resource" > > ----------------------------------------------- > another? In the meaning of "a different" or at least "an additional" resource? If I use (abuse) a resource which directly infringes your usage rights, this behaviour would not fall in this definition because there is not "another" resource involved..? example .. aehh.. like... I use your cpu-time for calculating bitcoins..? I use your mailserver for spamming? Maybe I just don't get the english words right :) best greetings, Gunther NetCologne Systemadministration -- NetCologne Gesellschaft für Telekommunikation mbH Am Coloneum 9 ; 50829 Köln Geschäftsführer: Timo von Lepel, Mario Wilhelm Vorsitzender des Aufsichtsrates: Dr. Andreas Cerbe HRB 25580, AG Köln

2 1

Definition of Abuse - preamble
by Andre Coetzee 24 Aug '16

24 Aug '16

Hello Everyone, Now that everyone has had enough time to comment, it seems that the definition of abuse now works for all types of Internet abuse. So, there is not a technical definition of what abuse actually is, which is very helpful to have, as this is an ABUSE WG, so knowing what abuse means is crucial to the group itself. (As well as to RIPE) Someone said something which caused me to think that the definition, as a technical definition, and not a contractual definition or a definition that intends to regulate, control or subjugate - It may be specifically useful to add a preamble (and possibly other sections?) Here is my proposal for the preamble, it is a very rough first draft sucked from my thumb in less than 3 minutes..., so if you see something that needs refinement, please pitch in. Of course, if it looks good, this is great also! ============ Internet Abuse ============ Understanding what constitutes Internet Abuse is not an easy undertaking as the topic is very technical. The Internet consists of resources and the understanding of Internet abuse relates to also understanding the use and interaction between these resources. Examples of Internet resources include also processes, protocols,credentials as well as other types of resources. More practical examples could be Internet Protocol numbers, Domain names or even Email addresses. This technical definition of abuse does not include identifying the authority for any specific resource as it is not intended to define any rights to resources but simply to define what technically constitutes Internet abuse as it relates to all Internet resources. ================= Definition of abuse ================= "The non sanctioned use of a resource to infringe upon the usage rights of another resource" ----------------------------------------------- Terminology used in the definition ----------------------------------------------- (1) Resource Any Internet Resource (2) Use and Usage Any direct or indirect action involving a resource (3) Rights The correct assignment or allocation of a resource by he authoritative holder of such a resource which results in the entitlement or reasonable expectation to use, or ability to use, such an allocated or assigned resource (4) Sanctioned An action, event or situation originating from the authoritative holder of rights to a resource that gives permission, or permission is granted by direct implication, which authorises that situation, event or action. (5) Infringe An action, event or situation which limits, reduces, undermines or encroaches upon the fair use of a resource

1 0

Re: [anti-abuse-wg] Definition of Abuse - Terminology used in the definition
by Ronald F. Guilmette 19 Aug '16

19 Aug '16

ox <andre(a)ox.co.za> wrote: >(4) Sanctioned >An action, event or situation originating from the authoritative holder >of rights to a resource that gives permission, or permission is granted >by direct implication, which authorises that situation, event or action. OK, Andre, I give up. Congratulations. You've succeded in wearing me down until I just give up. That fact that you still clearly either can't or won't comprehend that the "authority" you speak of has to come from somewhere convinces me that you are now -deliberately- failing to understand. Authority for Internet number resources begins at IANA, and then devolves down to the Regional Internet Registries. The fact that you can go on attempting to define "sanctioned" without ever even menioning any of these official bodies, or their authority, has persuaded me that you actually do not -want- to understand this simple but overridingly critical point. I already asked, multiple times, and in multiple ways, "Sanctioned by who? Sanctioned by what?" But you continue to carry on as if this is just an unimportant, annoying, and irrelevant detail. When push comes to shove and someone asks "Who decides who the authoritative holder of rights to a resource is?" you can just tell them "Judge Judy."

2 1