- anti-abuse-wg - mailman.ripe.net

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 48, Issue 24
by Marilson 11 Nov '15

11 Nov '15

Hi Lu, I would like to congratulate you for your concern to meet spamcop. You are the first representative of an ISP that I see, in the last seven months, concerned about complaints that spamcop reports. Look Ronald, all is not lost! As a rule your peers have reacted to allegations of dishonest and sociopathic way. They have refused to stop spammers and scammers and have retaliated by sending spam, phishing and viruses in heaps. When I tell in heaps I am referring to tens per day absolutely equal. The record is of the Lomadee with 167 equal spams in 4 days. Pure rage. Sociopathy and greed. Mr. Neylon, do not you dare disqualify my information because I have evidence in abundance, which you guys are blocking, preventing from being shown. Every time someone denounces the ISPs you try to disqualify the complaint. The problem, my dear, is that you are trying to defend the indefensible. Even being one of the foxes caring the hen house. Lu, there is another problem regarding spamcop that you should consider. Since last month there have been failures in the companies appointed to be reported. I am no longer using companies that spamcop indicates to abuse. I do my own research. The reason is obvious. Besides the spammer be hiding there is a profusion of ISPs behind a single spam that must be confusing the spamcop search system. And that is premeditated. Contrary to Ronaldo, I am not at all concerned with identifying the spammer. The reason is simple, he is the least responsible for this naughtiness that torments the lives of billions of people. Without the complicity of ISPs and Registrars, spammers and scammers would not be noticed. And the growing number of spammers and scammers is fostered by ISPs, and I can prove that. Question by Ronald: >Please correct me if I'm wrong, but you, Mr. Neylon, *are* the head of one of the registrar companies that has a direct financial interest inthis matter, right? Is that >correct is it not? Answer by Mr. Neylon: >Blacknight is a registrar and hosting provider. Well, well, nobody needs help to known what is Blacknight... Mr. Fox if you want to stay hidden, wear feathers. Michele, you are certainly a clever and apparently competent person in your role, but my dear, do not stay trying to disqualify all complaints that are made against ISPs and Registrars because your position is uncomfortable - you are defending the indefensible. I am architect and urban planner. My job is to create the most pleasant environments to the people, where they feel good. It is extremely difficult for me to understand a profession that has made efforts to irritate and defraud people. If your hypothalamus is not producing oxytocin make a hormone replacement because without oxytocin you will be unable to empathize with people. In other words let sociopathy for companies like Volkswagen. If you do not change your attitude the next time I will ask you if you have killed, today, one refugee child or kicked one. Until Marilson

17 110

RIPE 71 Agenda - Third Draft
by Brian Nisbet 09 Nov '15

09 Nov '15

Colleagues, Here is the second draft of the RIPE 71 Anti-Abuse WG session. The session will take place at 11:00 EET (GMT +2) on Thursday 19th November. The session will be live streamed and recorded, along with live stenography. A. Administrative Matters - 5' * Welcome * Scribe, Jabber, Stenography * Microphone Etiquette * Approve Minutes from RIPE 70 * Finalise agenda B. Update - 15' * B1. Recent List Discussion * B2. AA-WG Chair Matters C. Policies - 0' D. Interactions - 20' * D1. Working Groups * D2. Update on RIPE NCC Security Outreach Activities - Mirjam Kuhne E. Presentation - 45' * E1. Open Source Abuse Management for Network Operators - Abuse.io * E2. Helping Network Operators to Bring Down DDos Sources - ANSSI X. A.O.B. Z. Agenda for RIPE 72 There is still a very small amount of room on the agenda if anyone has any subjects they wish to bring to the working group. Brian -- Brian Nisbet, Network Operations Manager HEAnet Limited, Ireland's Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin 1 Registered in Ireland, no 275301 tel: +35316609040 web: http://www.heanet.ie/

1 0

Whois database verification
by Karl-Josef Ziegler 07 Nov '15

07 Nov '15

As an argument I can't take 'it's technically/legally not possible' because it was and is done by other companies. I think the truth behind is 'we don't want it to be implemented because it lowers our profit margins'. Just my 2 cents. - Karl-Josef Ziegler

1 0

Re: [anti-abuse-wg] WHOIS (AS204224)
by Sascha Luck [ml] 06 Nov '15

06 Nov '15

On Fri, Nov 06, 2015 at 12:46:44PM -0500, Jeffrey Race wrote: >I said that the mechanism by which the >internet operates was slackly designed and >is slackly operated so has become a cesspool of >criminality. Yes. In the same way that roads have been designed without police checkpoints every few 100 metres, so they have become the favoured means of transportation for criminals. In the same way that cities have not been designed as prisons, so they have become "cesspools of criminality". In the same way that phone networks have been designed without positive vetting of all users and (until recently) without the means to record any and all conversations, so they are/were used daily by criminals. Had the internet been designed like a corporate LAN with strict access controls, it would not exist today. rgds, Sascha Luck

1 0

Re: [anti-abuse-wg] WHOIS (AS204224)
by Sascha Luck [ml] 06 Nov '15

06 Nov '15

On Fri, Nov 06, 2015 at 11:57:18AM -0500, Jeffrey Race wrote: >>The internet resource management mechanism as managed by RIRs and >>LIRS is "of a criminal nature", do I understand you correctly? > >The mechanism is the internet Uhuh. I guess it's just as well that barely any operators seem to read this list. They may be less than happy to learn that they are all criminals. rgds, Sascha Luck

3 2

Re: [anti-abuse-wg] WHOIS (AS204224)
by Sascha Luck [ml] 06 Nov '15

06 Nov '15

On Fri, Nov 06, 2015 at 10:01:33AM -0500, Jeffrey Race wrote: >At present the internet is a cesspool of crime without >effective mechanisms of accountability and traceability. An As an, albeit small, part of the Internet, I take exception to this statement. >outsider viewing this thread (and the dozens of others I've been >monitoring for more than a decade) would find remarkable the >unspoken assumption of their discussions: how to make life >trouble-free for the registration and contracting bodies, even >though this makes inevitable the criminal nature of the >mechanism they are charged with managing. The internet resource management mechanism as managed by RIRs and LIRS is "of a criminal nature", do I understand you correctly? >With a proper goal in mind ("Develop our mechanisms so the >internet is no longer a cesspool of crime") the kind of >discussion below ("We can't consider that because it would be a >lot of work and some people would become upset") would be out of >bounds. What discussion is out-of-bounds is not for you to determine, sir. >The matter of the "defining discussion goal" will have to be >taken up in order to make progress on this list's putative >purpose of "anti-abuse." Had you read the charter of this WG, you would have learned that its purpose is to *discuss* abuse, not to stamp it out. And I will say again, you will NOT define what the goals or contents of discussion in this WG are. rgds, Sascha Luck > >Jeffrey Race > > >On Fri, 6 Nov 2015 13:49:01 +0000, Sascha Luck [ml] wrote: > >>On Fri, Nov 06, 2015 at 11:56:51AM +0100, denis wrote: >>> >>>Add to that all the possible language issues and I am not sure >>>how you will expect the RIPE NCC to validate all this personal >>>contact data with people who they have no relationship with >>>and who may have never heard of the RIPE NCC or RIPE. Anyone >>>who receives an email from an organisation they have never >>>heard of, possibly in a language they don't understand, asking >>>to validate personal information...well you know how that will >>>be treated these days. >> >>I've occasionally done db cleanup death-marches for customers >>where I've created/updated/deleted 100 or so objects in a >>single day. (usually with contact data relating to the LIR >>which does have a contract with the NCC) Is the idea seriously >>that someone doing this will have to field 100 phone calls or >>reply to 100 emails over the day? >> >>What about the numerous LIRs who do their resource management >>programatically, without human input? >> >>IMO, such actions would actually discourage proper resource >>management and lower the quality of the db. >> >>>Also bear in mind a single data validation is quite pointless. >>>What is valid today may not be tomorrow. So you cannot trust >>>data that was validated yesterday. To have any benefit this >>>data would have to be routinely re-validated. Given the >>>quantity of personal data sets in the RIPE Database (we are >>>talking millions), many of whom have never heard of the RIPE >>>NCC, to ask them to undertake this exercise would result in >>>the RIPE NCC being reported to many law enforcement >>>authorities for phishing. >> >>Not even considering the inevitable members' revolt. >> >>rgds, Sascha Luck >> > > >

3 2

unsubscribe
by Paul Skram 06 Nov '15

06 Nov '15

I don't have time to read your endless bickering and insults. You people need to learn how to effectively communicate.

2 1

Solving the issue of rogue ROUTE objects in the RIPE Database
by ripedenis＠yahoo.co.uk 06 Nov '15

06 Nov '15

HI all I am going to have one last go at solving this problem. I challenge anyone/everyone to tell me why this is such a stupid idea, technically impossible to do, won't solve any of the issues partially or fully. Then I can shut up about it and go away. If you can't condemn the idea then support it. Lets fix this issue once and for all, stop this endless discussion about rogue ROUTE objects and get on with life. So here is my 4 step proposal that I believe could be implemented within a month. If we implemented this you can be sure that all ROUTE objects in the RIPE Database were created with the knowledge and approval of the related resource holders. I believe that is the desired goal. STEP 1 Any ROUTE object submitted for creation in the RIPE Database involving an out of region resource (address space and/or ASN) where that out of region resource does not exist in the authoritative RIR database (has not been allocated or assigned), reject the creation. The RIPE NCC mirrors the operational data from all the other 4 RIRs. These mirrors are updated daily as well as the RIRs daily stats. It is easy to determine if a resource is registered in the authoritative database. STEP 2 For those ROUTE objects from STEP 1 where the out of region resource does exist, hold the object creation as pending. The mechanism for doing this already exists in the RIPE Database software as it is used for multiple authentications. Lookup the out of region resource(s) in the authoritative database(s) and find the contacts for that resource. Send a notification to those contacts informing them of the pending ROUTE object creation in the RIPE Database. The notification mechanism already exists in the RIPE Database software. If they don't approve, do nothing and the creation request will time out after a week and the object will not be created. If they do approve, respond in some way (many technical options for doing this that the RIPE NCC can choose from). If appropriate approval(s) are received within a week, create the ROUTE object. STEP 3 On a daily basis, for each ROUTE object in the RIPE Database that relates to an out of region resource, check for the continued existence of that resource in the appropriate RIR database. If it no longer exists, delete the ROUTE object from the RIPE Database. STEP 4 This is a one off cleanup of existing ROUTE objects. For all ROUTE objects currently in the RIPE Database that relate to an out of region, existing resource, send the appropriate notifications. For any that no response is received within a week, delete the ROUTE object from the RIPE Database. cheers denis

10 14

AS's with route objects for undelegated space
by Richard Clayton 06 Nov '15

06 Nov '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I have read recent discussion here about AS204224 with interest... ... what seems to have escaped notice is rather temporary nature of the dubious route objects inserted into the RIPE database by AS204224. At the time of writing there are no such objects present, whereas at 03:45 this morning there were 5 such objects. That's a pattern that has continued for some time ... I noted the "now you see it, now you don't" behaviour a while back and have paid close attention for about a week. I speculate that, because a while ago I opened a ticket about AS204224, the RIPE NCC people are currently playing whack-a-mole in their own database system :( That is they are removing the route objects, and once they go home for the day AS204224 puts the objects back again! <https://www.lightbluetouchpaper.org/2015/11/02/ongoing-badness-in-the- ripe-database/> The alternative explanation is some sort of inherent shyness by the maintainers of AS204224 which causes them to remove their route objects when the sun rises ... It's been observed here that AS204224 is not alone, but I don't see a complete analysis... I think a full list of AS's which have a similar modus operandi (recently inserted route objects for undelegated space) would be (data is from 03:45 today, the count is of prefixes that are for un-delegated IPv4 address space): AS21674, Recursos Numeracao Internet (24 prefixes, from July) AS200439, LLC Stadis (4 prefixes, from Nov 4th) AS200534, LLC Relax (5 prefixes, 4 from Nov 4th, 1 from June) AS201432, RapidVDS (1 prefix from May) AS204135, LLC Transmir (1 prefix from Nov 4th) AS204210, CJSC TEPLOVODOMER (1 prefix from September) AS204211, LLC Aspect (4 prefixed from early October) AS204223, LLC Tehnokom (1 prefix from 4 Nov) AS204224, CJSC Mashzavod-Marketing-Servis (5 prefixes from 4 Nov) AS204225, OJSC Kommunenergo (1 prefix from September) If you don't see route objects when you look, then the "shyness" is clearly contagious. In addition to these AS's, there's now just under 50 other AS's who also have route objects for un-delegated space. This is IMHO undesirable, but they have been in this state for many years and I doubt that it fits with the dynamic and recent pattern for the prefixes above (indeed AS21674 looks like an outlier as well, I include it for being recent). I note the wish by some not to adopt a policing role, but it does seem to me that this is civic hygiene -- there is no legitimate reason I can see for the existence of a route object for un-routeable IPv4 space and that absent some sort of special circumstances appeal, I think it is entirely appropriate to treat the published records by the RIRs of the space that they have delegated as being authoritative. - -- Dr Richard Clayton <richard.clayton(a)cl.cam.ac.uk> Director, Cambridge Cloud Cybercrime Centre mobile: +44 (0)7887 794090 Computer Laboratory, University of Cambridge, CB3 0FD tel: +44 (0)1223 763570 -----BEGIN PGP SIGNATURE----- Version: PGPsdk version 1.7.1 iQA/AwUBVjuGgeINNVchEYfiEQLKZgCfRzKhmQdpaGsgnwaoKbFLlMf1ixMAmwUp nzhiUrbQw7jfimpH5TkFp78n =25Ns -----END PGP SIGNATURE-----

4 3

Whois database verification
by Karl-Josef Ziegler 05 Nov '15

05 Nov '15

2 1