- anti-abuse-wg - mailman.ripe.net

Re: [anti-abuse-wg] Definition of Abuse
by Suresh Ramasubramanian 16 Aug '16

16 Aug '16

Easier to ask – why do other RIRs not have nearly the same high quantum of such issues? What do they do to prevent these, and reclaim resources allocated to bogus entities? --srs On 15/08/16, 8:56 PM, "anti-abuse-wg on behalf of ox" <anti-abuse-wg-bounces(a)ripe.net on behalf of andre(a)ox.co.za> wrote: Unauthorized access is NOT ABUSE, in terms of the current definition: "The non sanctioned use of a resource to infringe upon the usage rights of another resource" And, this is the crux of it all, this defining of "abuse" is exactly why we require a definition.

4 6

Re: [anti-abuse-wg] Definition of Abuse
by Gert Doering 16 Aug '16

16 Aug '16

Hi, On Sun, Aug 14, 2016 at 07:55:01AM +0200, andre(a)ox.co.za wrote: > Definition of Abuse as it should be defined by RIPE > --------------------------------------------------------------------- > > The use of a resource to infringe upon the usage rights of another resource I like this. I'm not sure if there are "false positives", but the general idea feels good, and thinking about it a bit, it seems to match what I consider "abuse" and does not match "non-abuse" - of course, this is now tied to what someone would consider as "infringe upon usage rights". Gert Doering -- NetMaster -- have you enabled IPv6 on something today...? SpaceNet AG Vorstand: Sebastian v. Bomhard Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279

7 8

Re: [anti-abuse-wg] Definition of Abuse
by Marilson 15 Aug '16

15 Aug '16

“Define abuse” Are you kidding? In this WG? “Complicated” Only for those who feed with the practice of abuse. “meaningless political expression” Are you with nefarious intent? (using Andre words) “it should be defined by RIPE” This just keeps getting better than stand-up comic. Until... Marilson From: anti-abuse-wg-request(a)ripe.net Sent: Monday, August 15, 2016 5:37 AM To: anti-abuse-wg(a)ripe.net Subject: anti-abuse-wg Digest, Vol 58, Issue 21 Send anti-abuse-wg mailing list submissions to anti-abuse-wg(a)ripe.net To subscribe or unsubscribe via the World Wide Web, visit https://lists.ripe.net/mailman/listinfo/anti-abuse-wg or, via email, send a message with subject or body 'help' to anti-abuse-wg-request(a)ripe.net You can reach the person managing the list at anti-abuse-wg-owner(a)ripe.net When replying, please edit your Subject line so it is more specific than "Re: Contents of anti-abuse-wg digest..." Today's Topics: 1. Re: Definition of Abuse (Gert Doering) 2. Re: Definition of Abuse (Gert Doering) 3. Re: Definition of Abuse (Sascha Luck [ml]) 4. Re: Definition of Abuse (andre(a)ox.co.za) 5. Re: Definition of Abuse (andre(a)ox.co.za) 6. Unsubscribe (Eoin C. Bair?ad) ---------------------------------------------------------------------- Message: 1 Date: Sun, 14 Aug 2016 21:15:19 +0200 From: Gert Doering <gert(a)space.net> To: andre(a)ox.co.za Cc: anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] Definition of Abuse Message-ID: <20160814191519.GM79185(a)Space.Net> Content-Type: text/plain; charset="us-ascii" Hi, On Sun, Aug 14, 2016 at 07:55:01AM +0200, andre(a)ox.co.za wrote: > Definition of Abuse as it should be defined by RIPE > --------------------------------------------------------------------- > > The use of a resource to infringe upon the usage rights of another resource I like this. I'm not sure if there are "false positives", but the general idea feels good, and thinking about it a bit, it seems to match what I consider "abuse" and does not match "non-abuse" - of course, this is now tied to what someone would consider as "infringe upon usage rights". Gert Doering -- NetMaster -- have you enabled IPv6 on something today...? SpaceNet AG Vorstand: Sebastian v. Bomhard Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279

1 0

Re: [anti-abuse-wg] Definition of Abuse
by Erik Bais 15 Aug '16

15 Aug '16

Hi Andre, > Definition of Abuse as it should be defined by RIPE > --------------------------------------------------------------------- > The use of a resource to infringe upon the usage rights of another resource The core of the problem of a good definition of abuse, is the intend of the action ... And intend is in the eye of the beholder ... I'll give an example : BGP Hijacking ... BGP Leaks ... If someone is doing a BGP Hijacks in order to knowingly divert traffic to harm others, while either the AS or the prefix is not rightfully under their control, it could be considered a Hijack. ( similar as carjacking. ) If those prefixes are used in order to : deny service to the original legitimate owner of the prefix, or an un-used prefix is abused for spewing out spam .. or to regain control of a Command and Control server/infrastructure ( Hacking Team action after Santrex was closing and they stopped announcing their prefixes ... ) there is clear intent to take something that wasn't yours in order to benefit from the outcome. However .. when some Bulgarian dude hijacked a prefix from the Ministry of Foreign Affairs 1.5 years ago, with the intent to spam on it ( Domains were pointed to it and other space they hijacked was also quickly spammed on and abused before released..) it was interesting to learn that hijacking as an Act, isn’t a crime .. (the law doesn't mention it.. it isn't illegal.. hence .. it is legal..) There could be made a case that the wrongful intent is and if they would actually spammed on the space, it is directly a crime.. But they didn't (yet) and they stopped the hijack before spamming on it.. So nothing happened, as if your neighbor borrowed your bike and returned it to your doorstep before you knew it was missing. In the same pristine condition .. It could have been said, this is a denial of service, but as the particular ministry wasn't using the space, nothing was denied ... they didn't even noticed it for a complete week. ((!! ) But that is another topic..) Now let's do a similar thing .. but with Cyber Crime fighting or Anti-Abuse in mind .. here comes the DMCA lobby or TRA (Telecom Regulator Agency in some Middle East country..) or some similar organization that is fond of protecting digital content rights.. And they are going to inject routes in a network, fiddle with BGP routing, in order to take down : Dreambox Key Servers on the internet (useful for free satellite decoding without subscriptions.. ) or phishing sites or command and control servers in $country .. or hell, why not take down the complete /21 of North Korea in the process while we talk about it ... Just because we can.. Who defines the greater good ... who is defining the wrongful intent of party X or party Y. Is the DMCA lobby correct if they want to shutdown some hosters torrent site customer.. or if the hoster correct that they don't take action on it and are not disclosing any information unless they are forced by a court order. There have been BGP injections in the past, to see if that could help in TRA compliance .. just in a subset of AS's. If those actions would have had a larger effect ... ( so large that it would have been noticed outside the region and into (this?) community perhaps.. or in the media.. ) ... who are we going to investigate .. The TRA that would like to enforce their local / regional laws and compliance .. or the violators that are facilitating the dreambox key servers that are sharing satellite subscriptions cards over the internet ... or the actual users of the dreambox in various countries ... In either of these scenario's .. the actual hoster or ISP that is hosting the 'service' on their IP space, is most likely outside the local jurisdiction and might not even be aware ... ( they are naughty/ignorant, that is different from being bad. ) In the near future, we will see a lot of grey actions, done by people that in their own mind and under their local laws, stand in their right to fiddle with your routing, if that means they can enforce local censorship or re-gain access to certain infrastructure or deny $party to their infrastructure when they will have a tactical benefit in this.. ( think Turkey during a coup.. or Syria being completely removed from the internet during attacks in Aleppo.. ) Our community covers a huge set of countries and there are quite a lot of political issues ( there are several countries that are real warzones today in our region.) .. and some of those political issues are corruption ( people getting paid to look the other way .. ) and some are just not dealing with the Spam Source because $investigator is blown out of his mind in the US or France Riviera ... RIPE isn't the internet police and this working group isn't either .. I think we should educate each other on what is going on, keep reporting on the issues we see, specifically around certain rotten area's .. We should refrain from forcing the RIPE NCC in becoming an internet police .. as they are an impartial party (like the Red Cross). They provide resources to those that need/request it.. and register who are using it. The same as the Red Cross, they hand out food to all people. Some of them might pick up a rifle 15 minutes later and shoot someone or sell that food .. but you can't blame the Red Cross for handing out food in certain areas or tell them to change their mission. Disciplinary actions (like de-registration due to abuse for instance) should not be up to the NCC, unless the information provided for registration isn´t correct. Everything else is not within the scope of the NCC imho. It should be taken up to the local law enforcement if things are not in compliance with the law ... And that could be different in each country of this huge service region... Moving into any other direction might be a very slippery slope we are getting ourselves into ... Ambition is good, but we shouldn't outreach our place in this delicate environment ... Regards, Erik Bais

2 3

Unsubscribe
by Eoin C. Bairéad 15 Aug '16

15 Aug '16

Unsubscribe me please Eoin C. Bairéad IT Mazars Block 3 The Harcourt Centre Charlotte Street Dublin 2 phone: +353 (1) 4494490 fax: +353 (1) 4750089 mobile: +353 (87) 2311357 ##################################################################################### Internet communications are not secure and the firm does not accept legal responsibility for the contents of this message. Any views or opinions presented are solely those of the author and do not necessarily represent those of the firm. This message is for the named person's use only. It may contain confidential, proprietary or legally privileged information. You must not, directly or indirectly, use, disclose, distribute, print, or copy any part of this message if you are not the intended recipient. ##################################################################################### ##################################################################################### This e-mail message has been scanned for Viruses and Content and cleared by NetIQ MailMarshal #####################################################################################

1 0

Definition of Abuse
by andre＠ox.co.za 14 Aug '16

14 Aug '16

Definition of Abuse as it should be defined by RIPE --------------------------------------------------------------------- The use of a resource to infringe upon the usage rights of another resource Reasoning: ---------------- The above covers all abuse scenarios and it does not tell anyone what to do or what not to do. It is fair and reasonable and includes everything

1 0

Re: [anti-abuse-wg] (no subject)
by Ronald F. Guilmette 14 Aug '16

14 Aug '16

andre(a)ox.co.za wrote: >We should all be able to agree on the basics... Andre, You obviously don't have the historical context, and thus, because of that, you don't get the joke. But rather than watching you flail around needlessly and pointlessly for the next couple of weeks, I'll take pity on you, give you the historical context, and then you'll get the joke _and_ understand what you are up against. I already proposed what you are proposing, well more than a year ago now, right here on this list, i.e. coming up with a common accepted definition of the word "abuse". (It seemed then... as it does now... the very height of absurdity to even have a mailing list, let alone a whole working group, dedicated to discussing and formulating policy with respect to "abuse" as long as nobody can even agree what that is, but I digress.) Anyway, my poposal to develop a definition of the word "abuse"... one that could be used by this Working Group, and others... was met with reactions which ranged from people basically telling me to f... I'm sorry... to "sod" off, all the way through to abject stunned silence. Not a single soul on this list at the time said anything that could even remotely be construed as an endorsemdent of the proposal. (I couldn't even get Suresh, whose views and mine are often in alignment, to even second the motion.) (I had intended at that time to just resign from this list in utter disgust, but somehow never was able to bring myself to do so.) Anyway, the point is that it is highly likely that nothing at all has changed in the intervening time since then, and thus, your idea to develop a definition of "abuse" has about as much chance of going anywhere as mine did. In short, you have about as much chance for success here as the proverbial snowball in hell. What you don't understand is that there are people on this list... perhaps even a majority... who have been reading too much Ayn Rand. They adamantly hold the same view of the Internet that Alan Greenspan, head of the U.S. Federal Reserve prior to the 2008 Economic Crisis, held about regulating banks, pre-2008, i.e. that the ideal policy was that everybody should be allowed to do whatever the hell they want, whenever they want, period. Note that even when he was called on the carpet and grilled about the final result of his spectacularly idiotic policies by congressional inquiries in the wake of the 2008 economic meltdown, the best that Greenspan could do was to offer up the lame excuse that he had believed that the banks would never be so foolish as to take actions which might crash the entire system, and that he believed they would avoid doing so, simply because it was in their own best interests to avoid such an outcome. Bottom line: He was wrong. Greed and short-term thinking often make falible human beings act against their own long term interests. Even if nothing else proved that, 2008 certainly did. I don't mean to discourage you from persuing the creation of a definition of "abuse". In fact I wish you all the best of luck with that. I'm only posting now to give you some idea of the fact that we've seen this movie before, and that at this point in time there's no reason to believe that it will end any differently than it did last time. But for whatever it's worth, I second your motion to develop a common definition of the word "abuse". All those in favor, please say "aye". (and cue the crickets) Regards, rfg

2 1

Russian carding... no, Islandic carding... no Belizian carding!
by Ronald F. Guilmette 14 Aug '16

14 Aug '16

https://www.verified.is/ (Gee! Big surprise! Russian language only.) -> .IS = Iceland -> 82.221.130.101 That site is obviously all written in Russian, but it is resident on a little /26 IP address block that's pretending to be owned by a Belizian company. (See below.) But of course, it's actually physically sitting in a data center somewhere in Iceland, and on an Icelandic AS. I am seeing this kind of thing almost every day now... bullshit domains sitting on bullshit networks, almost always in RIPE IP space, but all claiming to be in either Belize or UAE. I've given up any hope that posting any of this kind of information here will have any impact on anything, ever. A part of me wants to scream "Which part of this repeating pattern do you folks not understand?" but I know that doing so here is pointless. So I'm really only posting this here so that later on, nobdy can say to me "Gee Ron, why didn't you ever say anything to anybody about that?" I did say something. In fact I said plenty... about both Belize and UAE. It's not my fault if everybody with power and influence within RIPE continued to ignore the now all-too-obvious patterns because the self- evident truths about what's been going on doesn't suit their own financial interests. Regards, rfg P.S. At least the .IS domain administrators are looking at possibly suspending the doamin name on the grounds that the registration info "isn't accurate". I commend them for that. That's one hell of a lot more than the network operator (AS50613, Advania) is willing to do. Advania didn't even have the courtesy to answer my email, even if only to tell me to go pound sand. ========================================================================= inetnum: 82.221.130.64 - 82.221.130.127 netname: ORANGEWEB descr: OrangeWebsite.com - Network org: ORG-IL351-RIPE country: IS admin-c: OTD3-RIPE tech-c: OTD3-RIPE status: ASSIGNED PA mnt-by: MNT-ADVANIA created: 2016-01-27T15:08:11Z last-modified: 2016-01-27T15:08:11Z source: RIPE organisation: ORG-IL351-RIPE org-name: Icenetworks Ltd. org-type: OTHER address: 60 Market Square address: Belize City, Belize <== I hope they speak Russian down there! e-mail: sales(a)orangewebsite.com abuse-c: OTD3-RIPE mnt-ref: MNT-ADVANIA mnt-by: MNT-ADVANIA created: 2014-11-05T10:30:10Z last-modified: 2014-11-05T10:46:28Z source: RIPE role: OrangeWebsite.com Technical Department address: OrangeWebsite.com address: Klapparstigur 7 address: 101 Reykjavik address: Iceland abuse-mailbox: abuse(a)orangewebsite.com e-mail: support(a)orangewebsite.com admin-c: AK12182-RIPE tech-c: AK12182-RIPE mnt-by: MNT-ADVANIA nic-hdl: OTD3-RIPE created: 2013-12-16T09:41:11Z last-modified: 2013-12-16T09:41:11Z source: RIPE % Information related to '82.221.128.0/19AS50613' route: 82.221.128.0/19 descr: Advania / Thor Data Center origin: AS50613 mnt-by: THOR-MNT mnt-lower: THOR-MNT created: 2013-07-30T12:15:23Z last-modified: 2013-07-30T12:15:23Z source: RIPE

9 22

RIPE Charter
by Ronald F. Guilmette 12 Aug '16

12 Aug '16

I apologize to everyone for the fact that I haven't been able to get time today to weigh in on all of the back and forth that's been generated by my post about verified.is. Everyone who knows me knows that I have strong feelings about pretty much everything that has been said, and that I'me never shy about expressing those opinions, but it has been a long, hard, and exhausting day. I have been trying to work on several things simultaneously. It is now past 3 AM here where I am, and I'm off to bed at last. I hope to reply here to some of the things that have been said tomorrow. But before I turn in, I feel compelled to seek a bit more infomation about the fundamental RIPE Charter. I thank Brian for directing me at the following document, which seems to be a kind of overall Charter of RIPE: https://www.ripe.net/publications/docs/ripe-001 That is indeed enlightening, and quite helpful, but I feel the need to press further and ask if there is also and additionally some other Charter document elsewhere. I've read on the Ripe.Net site that RIPE is formally constituted as a formal "association" under Dutch law. Where I come from, we call these kinds of things "non-profit corporations" and each one must file a document called "Articles of Incorporation" with the state in which they are formed. These Articles of Incorporation must clearly specify the purposes for which the entity is formed. Does there exist a similar sort of formal document which has been filed by RIPE, on its own behalf, with Dutch authorities? If so, I would like to be able to peruse that also as I prepare myself for drafting a propposal... hopefully one which will not conflict in any way with either the letter or the spirit of *any* of RIPEs fundamental founding documents, as ammended. Lastly, I must ask the question: What is RIPE NCC, exactly? Is it a formal organ which is itself chartered strictly and only under the auspices and authority of RIPE itself? Or is it, in any sense, an autonomous entity which is in some ways (or perhaps in all ways) NOT bound to obey and/or show total fealty to the Charter of RIPE itself, e.g. as embodied in ripe-001 and/or any such other documents which together consitute RIPE's formal Charter? I beg everyone's patience with me for asking these questions here. I do understand that many, most or all subscribers here may deride me for asking about things that are arguably "off topic". But to be frank, I don't think they are off topic at all. The work of this WG, such as it is, must live within the confines of the Charter of RIPE itself. Certainly for me, and I suspect also for other members of this WG, a proper review of, and respect for the fundamental tenents of RIPE itself must guide the work ahead, whatever it may be. Regards, rfg

7 12

Re: [anti-abuse-wg] (no subject)
by Ronald F. Guilmette 12 Aug '16

12 Aug '16

andre(a)ox.co.za wrote: >But: The very definition of abuse - has it changed? If yes, >what exactly constitutes abuse in 2016? - We may actually have to >redefine the definition of abuse? Oh now THIS ought to be fun to watch. Let me just get my popcorn... Regards, rfg

2 1