- db-wg - mailman.ripe.net

Cleaning up SixXS inet6nums & 400.000++ junk inet6nums from 2a07:7ec0::/29 in the RIPE database
by Jeroen Massar 19 Jun '17

19 Jun '17

TLDR: - SixXS inet6nums will be cleansed out from RIPE DB - Somebody has 400k junk inet6nums (40% of total) in there... Hola, In regards to https://www.sixxs.net/sunset/, a few hours ago I let our little robot do one last chore: remove all SixXS inet6num's from the RIPEdb as those prefixes are now unused and if any abuse claims where outstanding (we didn't receive any over the last multiple years actually) then those folks had enough time to whois them... Normally, that robot was responsible for ensuring that all tunnels & subnets where properly registered in the database and also removed when they where not used (marked deleted) by that user for two weeks. I now instructed it to consider all prefixes (tunnels and subnets) as deleted and then let it batch out the changes (the RIPE mailserver does not like very large mails it seems...). It is already taking a few hours, but it seems that the mails that where sent in a period of 9 minutes, are being processed slowly, as responses of the updates are coming in. I am looking forward to the graph updating: https://www.ripe.net/analyse/statistics/ripe-database/ripedb-updates to see how much impact it had, as it seems that it is very slow... # Some stats Some stats, the robot takes: ftp://ftp.ripe.net/ripe/dbase/split/ripe.db.inet6num.gz $ cat ripe.db.inet6num |grep "^inet6num:" | wc -l 1000583 (that number is way too high, see below for why) 13 years ago in 2004 I wrote: https://www.ripe.net/ripe/mail/archives/db-wg/2004-May/002728.html "Thus SixXS takes care of 53.98% of the inet6num's" when we had 2898 prefixes ;) This time the robot found 70581 prefixes to clean (quite a few have been wiped already in the last months btw, thus that was not the max number, just the ones still left ;) Tomorrow all these SixXS prefixes should be gone. According to that number, SixXS would be 7% of the prefixes, that is rather quite a different number, thus I wondered, why is that. # Why are there now 1 million inet6nums? Junk! Thus lets look at the prefixes with more than 10k inet6nums registered: $ cat ripe.db.inet6num.clean | grep "^inet6num:" | awk '{print $2}' | cut -f1,2 -d: | sort -n |uniq -c | sort -n ... 10575 2001:6f8 <---- Easynet, mostly SixXS prefixes 13675 2001:4dd0 <---- Netcologne, mostly SixXS 14038 2001:41f0 <---- Ziggo, wow! now to actually enable users... 33982 2a02:1630 <---- AS30848 "TWT Spa" in .it nice! 37372 2a00:2381 <---- British Telecom nice! 61500 2a07:7ec4 <---- vv junk registrations 61501 2a07:7ec2 64575 2a07:7ec1 64575 2a07:7ec5 64577 2a07:7ec0 65600 2a07:7ec3 65600 2a07:7ec6 65600 2a07:7ec7 <---- ^^ junk registrations 210219 2a01:4f8 <---- Hetzner (makes sense to me...) So apparently, somebody who is not a LIR and who was last year caught with inserting bogus entries: https://www.ripe.net/ripe/mail/archives/db-wg//2016-May/005264.html currently has !!!!~400k!!!! inet6nums in there, that is ~40% of the total!!!! I picked a random few, most of them do not appear to actually be routed. If you look at the contents, you also notice that the details are bogus. Thus the big question: why does the RIPE NCC allow that junk to exist there? (Noting that it was shown last year that that "organisation" inserted bogus stuff too... and it has not been resolved) On top of that those 400k++ inet6nums all show bogus geo location (and are generally useless as they do not contain info at all), lets look at what registers that: inet6num: 2a07:7ec0::/29 netname: NL-OSP-20160517 country: GB ... address: Spuistraat 249-II address: 1012VP Amsterdam ... org-type: OTHER ... Really, a Dutch address, claiming a British country, while the prefix clearly show "NL" as prefix. Website at http://www.onlineserviceproviderbv.nl/ is empty, hosted on throw-away Digital Ocean, not on "own" infrastructure (the prefixes they have..). Checking RIS: https://stat.ripe.net/2a07%3A7ec0%3A%3A%2F29#tabId=routing Next to storing junk in RIPEDB, apparently also wasting a lot of routing space, as they all end up in a land of randomness. As that office address is close by RIPE NCC, can somebody maybe visit them and try to educate these folks (if anybody is there), to become quite a bit better netizen.... though, I bet you'll find people more home at: aut-num: AS202792 as-name: CLOUDSRV ... org-name: CloudSRV Limited org-type: LIR address: Unit 24 Oakleigh Court, Church Hill Road address: EN4 8UX address: East Barnet address: UNITED KINGDOM who are announcing a /31 of that space... I guess that after all these years it is still a very good idea to apply: https://www.space.net/~gert/RIPE/ipv6-filters.html Greets, Jeroen

1 0

Launching My Resources in the RIPE Database
by Alex Band 08 Jun '17

08 Jun '17

Dear colleagues, We are pleased to announce My Resources, a new service in the RIPE Database that allows resource holders and members who sponsor resources to get a comprehensive overview of all IPv4, IPv6 and ASN resources they hold or sponsor at a glance. Resource holders can also manage their resources with an easy-to-use inline editor. For more information, please see the news announcement: https://www.ripe.net/manage-ips-and-asns/db/announcements/launching-my-reso… Kind regards, Alex Band Product Manager RIPE NCC

1 0

AS34991 -- hijacked
by Ronald F. Guilmette 06 Jun '17

06 Jun '17

Is there any chance that any of you might be persuaded to have a word or two with either or both of the upstreams for AS34991, specifically with respect to the fact that that whole and entire AS has quite obviously been hijacked, and that it is currently being used and abused to announce a total of 20 completely and transparently bogus routes into various bits of IPv4 space that are allocated to various parties within the nation of Columbia, including but not limited to the National University thereof? I have already attempted to make contact with both upstreams in this case with no success and no reply so far, perhaps because I am not a european, or perhaps because I myself am not a network operator, or perhaps because I do not speak (or write) bulgarian. Below is a listing of the currently hijacked routes. Please note that the hijacker in this case quite obviously planned this all, quite carefully, and in advance of the actual hijackings, and he tried (and succeded!) to effectively legitimize all of these bogus route announcement via the simple and easy ruse of also pre-creating a set of matching, and equally bogus route objects within the RIPE data base. (As I learned the last time a case like this came up, the RIPE community, in its infinite wisdom, had made it so easy to create such route objects in the data base, with no authority or authorization whatsoever, that any baboon with a keyboard and a pulse may easily do so.) Of course, as the more observant among you may note, the domain name used for the contact email address for AS34991 has recently been re-registered, presumably after having lapsed. This indicates rather clearly, I think, that it is not merely the IPv4 blocks listed below that have been and are being hijacked, but also the AS34991 ASN itself. covfefe P.S. For the record, yes, some of the hijacked blocks in this case have already been sub-leased out to snowshoe spammers, and are being actively used for snowshoe spamming as we speak. ===================================================================== 152.204.132.0/24 -- Columbia 152.204.133.0/24 -- Columbia 152.231.25.0/24 -- Columbia 152.231.28.0/24 -- Columbia 168.176.187.0/24 -- Columbia, National University of 168.176.192.0/24 -- Columbia, National University of 168.176.194.0/24 -- Columbia, National University of 168.176.218.0/24 -- Columbia, National University of 168.176.219.0/24 -- Columbia, National University of 179.1.71.0/24 -- Columbia 181.57.40.0/24 -- Columbia 186.113.13.0/24 -- Columbia 186.113.15.0/24 -- Columbia 186.147.230.0/24 -- Columbia 190.90.31.0/24 -- Columbia 190.90.88.0/24 -- Columbia 200.1.65.0/24 -- Columbia 200.14.44.0/24 -- Columbia 200.24.3.0/24 -- Columbia 200.24.5.0/24 -- Columbia

1 0

Re: [db-wg] Whois release 1.89 deployed to the Release Candidate Environment
by Adam Castle 29 May '17

29 May '17

Hello Elvis, Thanks for your comments. The RIPE NCC, with input from the working group chairs, are currently investigating a solution for all of the RIPE community mailing lists, which we hope will have as little negative impact as possible on those users who do not have DMARC enabled. We are hoping to have this solution tested and rolled out on all of our managed lists as soon as we can and we appreciate your patience in the meantime. Many thanks, Adam Castle Web Services RIPE NCC >> *From: *Elvis Daniel Velea <elvis(a)velea.eu <mailto:elvis@velea.eu>> >> *Subject: **Re: [db-wg] Whois release 1.89 deployed to the Release >> Candidate Environment* >> *Date: *24 May 2017 at 18:23:16 GMT+2 >> *To: *Tim Bruijnzeels <tim(a)ripe.net <mailto:tim@ripe.net>> >> *Cc: *db-wg(a)ripe.net <mailto:db-wg@ripe.net> >> >> Hi Tim, >> >> I can not believe that you guys still can not fix the mailing list to >> show the e-mails correctly. >> >> They currently (for the past few months) appear on an iPhone as attached : >> >> >> >> elvis >> >> Excuse the briefness of this mail, it was sent from a mobile device. >> >>> On May 24, 2017, at 06:38, Tim Bruijnzeels via db-wg <db-wg(a)ripe.net >>> <mailto:db-wg@ripe.net>> wrote: >>> >>> <mime-attachment> >

1 0

Re: [db-wg] Whois release 1.89 deployed to the Release Candidate Environment
by Gert Doering 24 May '17

24 May '17

Hi, On Wed, May 24, 2017 at 06:23:34PM +0200, Elvis Daniel Velea via db-wg wrote: > I can not believe that you guys still can not fix the mailing list to show the e-mails correctly. Thank the people that invented DMARC, consciously breaking mailing lists, and declaring that "not our problem". (But the NCC is working on other options) Gert Doering -- NetMaster -- have you enabled IPv6 on something today...? SpaceNet AG Vorstand: Sebastian v. Bomhard Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279

1 0

Re: [db-wg] Whois release 1.89 deployed to the Release Candidate Environment
by Elvis Daniel Velea 24 May '17

24 May '17

Hi Tim, I can not believe that you guys still can not fix the mailing list to show the e-mails correctly. They currently (for the past few months) appear on an iPhone as attached : elvis Excuse the briefness of this mail, it was sent from a mobile device. > On May 24, 2017, at 06:38, Tim Bruijnzeels via db-wg <db-wg(a)ripe.net> wrote: > > <mime-attachment>

1 0

Re: [db-wg] NWI-7: abuse-c implementation request
by Tim Bruijnzeels 24 May '17

24 May '17

Dear working group, We are working on an impact analysis for this NWI and we expect to have a response within two weeks. Kind regards, Tim Bruijnzeels Assistant Manager Software Engineering RIPE NCC > On 22 May 2017, at 20:56, William Sylvester via db-wg <db-wg(a)ripe.net> wrote: > > > From: William Sylvester <william.sylvester(a)addrex.net> > Subject: NWI-7: abuse-c implementation request > Date: 22 May 2017 at 19:59:44 GMT+2 > To: DB-WG <db-wg(a)ripe.net> > > > DB-WG Members, > > Support was shown for the proposal NWI-7 and no objections were raised after this round of discussion. At this time, the chairs request that the RIPE NCC schedule implementation of NWI-7 as described. > > This request is to add the "abuse-c:" attribute directly to the INET(6)NUM and AUT-NUM resource objects. The db-wg therefore ask the RIPE NCC to prepare an impact analysis, followed by an implementation plan and timeline for this request and the other issues raised in the problem statement of NWI-7 as follows: > > 1) Add the "abuse-c:" attribute to the INETNUM, INET6NUM and AUT-NUM objects > 2) Adjust the query logic to take account of 'local' "abuse-c:" attributes in preference to those referenced in ORGANISATION objects > 3) Allow both local and indirect references (via ORGANISATION objects) to "abuse-c:" attributes to operate hierarchically > 4) Deprecate "abuse-mailbox:" attribute from PERSON, ORGANISATION, MNTNER and IRT objects. > 5) Clean up data relating to the deprecated attributes. > 6) Update the 'person' keyword to take account of "abuse-c:" > > Thank you all for your work on this proposal! > > Kind regards, > > William > on behalf of DB-WG co-chairs > > >

1 0

Re: [db-wg] Whois release 1.89 deployed to the Release Candidate Environment
by Tim Bruijnzeels 24 May '17

24 May '17

Dear Working Group, We found two minor issues while 1.89 was in the Release Candidate Environment. #1 Abuse contact information was sometimes returned incorrectly for ASNs #2 The “Zonemaster” configuration was incorrect We had a fix ready for the first issue and therefore we deployed release 1.89.1 to production on 22 May as planned. The fix for the second issue was deployed on 23 May. Note that “Zonemaster” is not enabled yet in production. Although this was tested in the Release Candidate environment, and we don’t expect issues, we plan to enable “Zonemaster” in production manually, knowing that we have the option to revert without the need for a new release in case unforeseen issues are still found. We will send an announcement about this change to this working group before we do. Kind regards Tim Bruijnzeels Assistant Manager Software Engineering RIPE NCC Database Group > On 4 May 2017, at 14:55, Tim Bruijnzeels via db-wg <db-wg(a)ripe.net> wrote: > > > From: Tim Bruijnzeels <tim(a)ripe.net> > Subject: Whois release 1.89 deployed to the Release Candidate Environment > Date: 4 May 2017 at 14:55:51 GMT+2 > To: db-wg(a)ripe.net > > > Dear working group, > > We just deployed release 1.89 to the Release Candidate (RC) environment. If no issues are raised we plan to deploy this version to production on 22 May 2017. > > This release contains a number of small improvements: > > - Include information on who changed an object in update responses if SSO or PGPKEY is used for authentication > - Replaced dnscheck with Zonemaster for improved domain object (and nameserver) validation > - Fixed NRTM client bugs #279 and #294 > > The complete list of other minor issues solved by this release can be found here: > https://github.com/RIPE-NCC/whois/blob/master/changes.txt > > Kind regards > > Tim Bruijnzeels > Assistant Manager Software Engineering > RIPE NCC Database Group > > >

1 0

NWI-7: abuse-c implementation request
by William Sylvester 22 May '17

22 May '17

DB-WG Members, Support was shown for the proposal NWI-7 and no objections were raised after this round of discussion. At this time, the chairs request that the RIPE NCC schedule implementation of NWI-7 as described. This request is to add the "abuse-c:" attribute directly to the INET(6)NUM and AUT-NUM resource objects. The db-wg therefore ask the RIPE NCC to prepare an impact analysis, followed by an implementation plan and timeline for this request and the other issues raised in the problem statement of NWI-7 as follows: 1) Add the "abuse-c:" attribute to the INETNUM, INET6NUM and AUT-NUM objects 2) Adjust the query logic to take account of 'local' "abuse-c:" attributes in preference to those referenced in ORGANISATION objects 3) Allow both local and indirect references (via ORGANISATION objects) to "abuse-c:" attributes to operate hierarchically 4) Deprecate "abuse-mailbox:" attribute from PERSON, ORGANISATION, MNTNER and IRT objects. 5) Clean up data relating to the deprecated attributes. 6) Update the 'person' keyword to take account of "abuse-c:" Thank you all for your work on this proposal! Kind regards, William on behalf of DB-WG co-chairs

1 0

First RIPE NCC webinar for law enforcement
by Richard Leaning 17 May '17

17 May '17

Hi all, Some of you are aware that the RIPE NCC has been actively engaging with law enforcement across Europe to help them gain a better understanding of RIPE NCC tools and services that might be of use in cybercrime investigations - including the RIPE Database. After the discussion that took place during the Database Working Group session at RIPE 74 last week (https://ripe74.ripe.net/programme/meeting-plan/db-wg/<https://ripe74.ripe.net/programme/meeting-plan/db-wg/), I thought some of you might be interested in learning about a new initiative by the RIPE NCC, in collaboration with Europol and CEPOL (the European Union Agency for Law Enforcement Training), to offer a series of six webinars tailored specifically to police, law enforcement and judiciary working in the area of cybercrime. The first of these took place on 15 May, with more than 400 cybercrime agents participating from across Europe: https://www.ripe.net/publications/news/ripe-ncc-webinars-for-law-enforcement We’ll publish a more detailed article on RIPE Labs when the webinar series concludes next month. Kind regards, Richard Leaning External Relations RIPE NCC

1 0