Re: [anti-abuse-wg] Re: Interaction between the RIPE and anti-abuse communities]
Dear Kauto, all, In response to your email, here is some general information on abuse handling at the RIPE NCC. The RIPE NCC has a procedure for handling abuse complaints. Anyone can send a complaint to the email address abuse@ripe.net. All complaints are replied to in an appropriate manner. The timeline for the handling of a complaint varies depending on the type of abuse reported and the investigation/actions needed from our side. This procedure is currently not published. The RIPE NCC has realised the need for a publicly available procedural document in which all aspects of this procedure will be described in detail. The drafting of this document is in progress. To reply to your last question, there are some RIPE Database queries that will provide the information you require. Registration of an AS Number also requires this reference. The command: whois -r -Tinetnum,inet6num,aut-num -i org <LIRs organisation object> will give a list of all allocations and AS numbers for this LIR. It may also return assignments where the "org:" object is referenced. Using the command: whois -rM -Tinetnum,inet6num <allocation> for each allocation will give a list of all the assignments below the allocation. Please bear in mind, this may be a very long list and such a query may take time. These queries can be carried out from our web interfaces. But you might not get a full list as some of our web services have limits on the number of objects returned. Information about the sponsoring LIR is not publicly available. However, this issue has been raised by the RIPE community and a RIPE Task Force will be organised to discuss this and other relevant issues. Please see: http://www.ripe.net/ripe/policies/proposals/2010-10.html http://www.ripe.net/ripe/maillists/archives/db-wg/2011/msg00032.html Kind regards, Athina Fragkouli RIPE NCC -------- Original Message -------- Subject: Re: [anti-abuse-wg] Re: Interaction between the RIPE and anti-abuse communities Date: Wed, 02 Feb 2011 12:25:16 +0200 From: Kauto Huopio <kauto.huopio@ficora.fi> To: anti-abuse-wg@ripe.net Greetings all, I am a relative newcomer within RIPE community - but been working for some 10 years with CERT-FI, the national CERT team in Finland. During this period I have got a feeling (no statistics - yet) that the majority of cases where the validity of ipv4 / AS resource registration details can be questioned are within RIPE service area. APNIC, AFRINIC, LACNIC, ARIN -provided resources with this suspicion are quite rare on my radar. I have a couple of questions on my mind: 1) What is the current procedure to initiate an investigation with RIPE NCC on resource registration data consistency? 2) Are there any spesific requirements to be filled to trigger investiation procedures - what proof of suspicious registration data is needed? 3) Where I can find the current RIPE policies applied on this type of investigation request? 4) What kind of reply time one could expect from RIPE NCC for this type of request? 5) What methods I could use to extract -sponsoring LIR data of a inetnum / autnum object -all inetnum/autnum objects delegated by a spesified LIR from RIPE NCC WHOIS database? (personally I think there is no need to hide this information - all customer networks of an ISP can be easily extracted from BGP routing data, business protection needs IMHO do not warrant blocking this information) I have a couple of examples that could perhaps warrant a concentrated look. First is a recent and public one, documented here: http://www.abuse.ch/?p=3130 Could regisgtry consistency procedures be initiated on the suspicious resources mentioned in the blog post? A second case I would like to work with appropriate RIPE NCC staff directly. --Kauto -- Kauto Huopio - kauto.huopio@ficora.fi Senior information security adviser Finnish Communications Regulatory Authority / CERT-FI tel. +358-9-6966772, fax +358-9-6966515, mobile +358-50-5826131 CERT-FI watch desk daytime: +358-9-6966510 / http://www.cert.fi
In message <4D4AD64A.5000006@ripe.net>, Athina Fragkouli <athina.fragkouli@ripe.net> wrote:
The RIPE NCC has a procedure for handling abuse complaints. Anyone can send a complaint to the email address abuse@ripe.net. All complaints are replied to in an appropriate manner. The timeline for the handling of a complaint varies depending on the type of abuse reported and the investigation/actions needed from our side.
This procedure is currently not published. The RIPE NCC has realised the need for a publicly available procedural document in which all aspects of this procedure will be described in detail. The drafting of this document is in progress.
Speaking only for myself, let me just say that I, for one, very much look forward to this document. I feel sure that it will bring clarity and consistancy into what is, from the outside, currently an entirely murky black box. Perhaps just as importantly, the publication of this document may itself serve to spur other RiRs to provide a similar level of clarity for their abuse handling processes... which is sorely needed. I do have one small suggestion for the drafters of this document... I suspect that it will be quite helpful and illuminating if the final document contains a flowchart of the abuse handling process. One picture is indeed sometimes worth a thousand words. Regards, rfg
On 04/Feb/11 00:39, Ronald F. Guilmette wrote:
In message <4D4AD64A.5000006@ripe.net>, Athina Fragkouli <athina.fragkouli@ripe.net> wrote:
The RIPE NCC has a procedure for handling abuse complaints. Anyone can send a complaint to the email address abuse@ripe.net. All complaints are replied to in an appropriate manner. The timeline for the handling of a complaint varies depending on the type of abuse reported and the investigation/actions needed from our side.
To be effective, it is necessary that the procedure can handle, on average, the number of complaints that arrive in the meanwhile. The number of complaints may rise significantly if the procedure is published and the address advertised.
I do have one small suggestion for the drafters of this document... I suspect that it will be quite helpful and illuminating if the final document contains a flowchart of the abuse handling process. One picture is indeed sometimes worth a thousand words.
Agreed, especially if the procedure provides for handing complaints to external abuse teams, e.g. according to IP allocations.
That is only useful if the organization doing so has some sort of oversight or escalation power over what the receiver of those complaints is supposed to do. It might actually make sense to involve the dutch CERT in this. On Fri, Feb 4, 2011 at 2:16 PM, Alessandro Vesely <vesely@tana.it> wrote:
Agreed, especially if the procedure provides for handing complaints to external abuse teams, e.g. according to IP allocations.
-- Suresh Ramasubramanian (ops.lists@gmail.com)
Suresh Ramasubramanian wrote:
That is only useful if the organization doing so has some sort of oversight or escalation power over what the receiver of those complaints is supposed to do.
It might actually make sense to involve the dutch CERT in this.
Which one? I presume you are thinking about GOVCERT.nl ? If I am right, what would be that CERT's role with regard to this discussion?
On Fri, Feb 4, 2011 at 2:16 PM, Alessandro Vesely <vesely@tana.it> wrote:
Agreed, especially if the procedure provides for handing complaints to external abuse teams, e.g. according to IP allocations.
Wilfried (wearing my ACOnet-CERT scarf for a moment :-) )
Purely a coordination role - where regulators and law enforcement may well have a role to play when there's malware involved. And yes, I do mean the people at govcert.nl thanks --srs On Thu, Mar 10, 2011 at 2:29 PM, Wilfried Woeber, UniVie/ACOnet <Woeber@cc.univie.ac.at> wrote:
Suresh Ramasubramanian wrote:
That is only useful if the organization doing so has some sort of oversight or escalation power over what the receiver of those complaints is supposed to do.
It might actually make sense to involve the dutch CERT in this.
Which one? I presume you are thinking about GOVCERT.nl ?
If I am right, what would be that CERT's role with regard to this discussion?
On Fri, Feb 4, 2011 at 2:16 PM, Alessandro Vesely <vesely@tana.it> wrote:
Agreed, especially if the procedure provides for handing complaints to external abuse teams, e.g. according to IP allocations.
Wilfried (wearing my ACOnet-CERT scarf for a moment :-) )
-- Suresh Ramasubramanian (ops.lists@gmail.com)
participants (5)
-
Alessandro Vesely -
Athina Fragkouli -
Ronald F. Guilmette -
Suresh Ramasubramanian -
Wilfried Woeber, UniVie/ACOnet