- members-discuss - mailman.ripe.net

What to do
by Comunicaciones ACOTELSA 24 Nov '11

24 Nov '11

Hi all. We have detected a DoS from IP of APNIC, from China. Are there a procedure to inform APNIC or RIPE about the problem or the only way is inform to the WHOIS contact? Thanks in advance. Saludos... =========================================== Luis Ángel Lozano Aparicio Comunicaciones y Seguridad Grupo Acotel e-mail: comunicaciones(a)acotelsa.com ------------------------------------------ Tlf: 983 440274 - 902 194273 Fax:983 548220 Oficina 201 - Edificio Galileo, módulo Rojo Parque Tecnológico de Boecillo 47151 Boecillo (Valladolid) - España =========================================== Protección de Datos: ACOTELSA le informa de que los datos facilitados por Ud. y utilizados para el envío de esta comunicación serán objeto de tratamiento automatizado o no en nuestros ficheros, con la finalidad de gestionar la agenda de contactos de nuestra empresa y para el envío de comunicaciones profesionales por cualquier medio electrónico o no. Vd. podrá en cualquier momento ejercer el derecho de acceso, rectificación, cancelación y oposición en los términos establecidos en la Ley Orgánica 15/1999. El responsable del tratamiento es ACOTELSA, con domicilio en Ronda de Poniente, 3 bajo, 28760 Tres Cantos, Madrid. Confidencialidad El contenido de esta comunicación, así como el de toda la documentación anexa, es confidencial y va dirigido únicamente al destinatario del mismo. En el supuesto de que usted no fuera el destinatario, le solicitamos que nos lo indique y no comunique su contenido a terceros, procediendo a su destrucción. Gracias. Confidenciality The content of this communication and any attached information is confidential and exclusively for the use of the addressee. If you are not the addressee, we ask you to notify to the sender and do not pass its content to another person, and please be sure you destroy it. Thank you.

8 8

Re: [members-discuss] What to do
by sslavov＠blizoo.bg 22 Nov '11

22 Nov '11

Contact the Persons in the WHOIS database, your UPLINK Provider AND BLOCK IP RANGE. Best regards. Stoyan > > RIPE, APNIC or any of the other RIRs only handle administrative issues > wrt the allocation and distribution of IP addresses, AS numbers etc. > They have no "power" over the network of any ISP. > > You should contact the persons in the WHOIS, and at the same time, you > should contact your upstream provider and ask them if they can see where > the DOS originates and if they can perhaps block it for you. > > Do remember that IP packets can be spoofed, the source address of the > DOS packets may say "this originated from 243.1.2.3" but perhaps it is a > completely different network that is sending you the packets - your > upstream provider might be able to pinpoint the actual source. > > Mike. > > On 22-11-11 4:41 PM, Comunicaciones ACOTELSA wrote: >> Hi all. >> >> We have detected a DoS from IP of APNIC, from China. >> >> Are there a procedure to inform APNIC or RIPE about the problem or the >> only >> way is inform to the WHOIS contact? >> >> Thanks in advance. >> >> >> Saludos... >> >> =========================================== >> Luis Ángel Lozano Aparicio >> Comunicaciones y Seguridad >> Grupo Acotel >> e-mail: comunicaciones(a)acotelsa.com >> ------------------------------------------ >> Tlf: 983 440274 - 902 194273 Fax:983 548220 >> Oficina 201 - Edificio Galileo, módulo Rojo >> Parque Tecnológico de Boecillo >> 47151 Boecillo (Valladolid) - España >> =========================================== >> >> >> >> >> >> Protección de Datos: ACOTELSA le informa de que los datos facilitados >> por Ud. y utilizados para el envío de esta comunicación serán objeto de >> tratamiento automatizado o no en nuestros ficheros, con la finalidad de >> gestionar la agenda de contactos de nuestra empresa y para el envío de >> comunicaciones profesionales por cualquier medio electrónico o no. Vd. >> podrá en cualquier momento ejercer el derecho de acceso, rectificación, >> cancelación y oposición en los términos establecidos en la Ley Orgánica >> 15/1999. El responsable del tratamiento es ACOTELSA, con domicilio en >> Ronda de Poniente, 3 bajo, 28760 Tres Cantos, Madrid. >> >> Confidencialidad El contenido de esta comunicación, así como el de toda >> la documentación anexa, es confidencial y va dirigido únicamente al >> destinatario del mismo. En el supuesto de que usted no fuera el >> destinatario, le solicitamos que nos lo indique y no comunique su >> contenido a terceros, procediendo a su destrucción. Gracias. >> >> Confidenciality The content of this communication and any attached >> information is confidential and exclusively for the use of the >> addressee. If you are not the addressee, we ask you to notify to the >> sender and do not pass its content to another person, and please be sure >> you destroy it. Thank you. >> >> >> >> ---- >> If you don't want to receive emails from the RIPE NCC members-discuss >> mailing list, please log in to your LIR Portal account and go to the >> general page: >> https://lirportal.ripe.net/general/view >> >> Click on "Edit my LIR details", under "Subscribed Mailing Lists". From >> here, you can add or remove addresses. >> > > ---- > If you don't want to receive emails from the RIPE NCC members-discuss > mailing list, please log in to your LIR Portal account and go to the > general page: > https://lirportal.ripe.net/general/view > > Click on "Edit my LIR details", under "Subscribed Mailing Lists". From > here, you can add or remove addresses. >

1 0

Re: [members-discuss] Update on police order of 8 November
by Brandon Butterworth 16 Nov '11

16 Nov '11

> Please keep in mind, I'm not a laywer Likewise but it appears to be totally unnecessary action that establishes precedent for other more intrusive requests later > - These punishable facts are an immediate threat to the Dutch public order. Seems quite unlikely that there will be public disorder as a result of malware, at least to the extent freezing registry entries would prevent. > o The suspects in the US investigation will transfer the control of > the relevant registrations of a couple specific IP ranges in the > public register. > o The suspects in the US investigations will alter the > relevant registration(s) of a specific set of IP ranges in the > public register, unless specifically approved by the FBI of the > US attorney's office for the Southern District of New York. Why would that matter as long as they made an evidence record of what it was at this time. There's lots of things the suspects may do during the course of an investigation, like just live their normal lives. brandon

1 0

Update on police order of 8 November
by Axel Pawlik 16 Nov '11

16 Nov '11

Dear all, In the interest of transparency, I'd like to update you on the Dutch police order issued to the RIPE NCC on 8 November 2011 to temporarily lock a registration of four IP address blocks in the RIPE Registry until 22 March 2012. As mentioned earlier, we are working on full disclosure of the background documents. You can read a copy of the police order here: https://www.ripe.net/lir-services/member-support/police-order-8-november-20… We will update you if and when any other publishable materials become available. We have received independent legal advice and are in discussion with the appropriate authorities. We intend to pursue this matter further in Dutch court to establish a precedent so that we are certain of our rights regarding such orders. The RIPE NCC is committed to acting in the best interest of its membership and we will continue to inform you and the Internet community on this matter as it progresses. I'd also like to take this opportunity to clarify that we have not withdrawn, removed or reclaimed the address blocks in question. kind regards, Axel

2 2

NCC acting on registrations pursuant to "police order"?
by Sascha Luck 14 Nov '11

14 Nov '11

All, in the recent discussion on RPKI, it was stated by the NCC that it would not act on resource registrations (and, by extension, certificates and ROAs) without a valid Dutch court order. According to: http://www.ripe.net/internet-coordination/news/about-ripe-ncc-and-ripe/ripe… ther NCC has blocked changes to registered resources pursuant to "an order from Dutch police". Now, I'm not overly familiar with the Dutch legal system but in ours, a court order is different from a "police order". Considering the implications for, in particular, RPKI; could someone from the NCC confirm that this was, in fact, on foot of a court order? Alternatively, is a "police order" something equivalent, eg an order that must be followed on pain of legal sanction?` Regards, Sascha Luck

11 12

Re: [members-discuss] [#22756] Re: FW: NCC acting on registrations pursuant to "police order"?
by Sven Olaf Kamphuis 12 Nov '11

12 Nov '11

Security expert Ronald Prince of forensic firm Fox-IT across all Macworld speculated that this action may be related to the rolling up of the DNS gang. "De DNS-servers draaiden op bepaalde ip-adressen. Nu zijn die vervangen door servers van de politie zelf." "The DNS servers were running on certain IP addresses. Now those servers replaced by the police themselves." ah so-called "security expert" and well known sockpuppet of the amerifags, ronald prins, is at it again... when he's not too busy persecuting the international souvereign military order of internet knights that is anonymous, he's always to be found to make some foolish statements in the press. The rolled malware gang has four million PCs worldwide able to infect. This is done through rogue DNS servers. NO -THIS IS DONE THROUGH MICROSOFT WINDOWS-, go and arrest bill gates for selling utter crap that doesn't belong on a network in the first place, and not fixing it on purpose although code is much easier to fix than to maintain a dictionary of search strings for 'known' virus code that exploits it. Prince says that the RIPE-blocking by the Dutch police can ensure that the infected computers keep their connection. Only is it not the rogue machines, but the police servers. " And that solves the problem ... how exactly... the next virus will show up and microsoft continue keep sell crap and isn't even being blamed by this rather pro-american so-called "security" expert. i'd say, flash the god damn biosses with an advertisement that gets them to the mac store, or force install ubuntu if you're already taking over a botnet anyway :P the dutch police gets paid by dutch taxpayers to protect dutch/european interests, not those of mickeysoft or the usa, or to run after people that exploit bugs (probably purposely) not fixed by microsoft to keep their "anti virus industry" buddies in business. i'd say, this whole thing is EASILY solved by a forced update of windows, on THEIR side of the ocean, i see no need to waste further european tax money on whatever that god damn ex-colony of amsterdam wants. (and while we're at the subject, why on earth do we let them sell that crap in our stores ;) -- Greetings, Sven Olaf Kamphuis, CB3ROB Ltd. & Co. KG ========================================================================= Address: Koloniestrasse 34 VAT Tax ID: DE267268209 D-13359 Registration: HRA 42834 B BERLIN Phone: +31/(0)87-8747479 Germany GSM: +49/(0)152-26410799 RIPE: CBSK1-RIPE e-Mail: sven(a)cb3rob.net ========================================================================= <penpen> C3P0, der elektrische Westerwelle http://www.facebook.com/cb3rob ========================================================================= Confidential: Please be advised that the information contained in this email message, including all attached documents or files, is privileged and confidential and is intended only for the use of the individual or individuals addressed. Any other use, dissemination, distribution or copying of this communication is strictly prohibited. On Fri, 11 Nov 2011, support(a)privatelayer.com wrote: > Dear Valued Private Layer Customer, > > > Our tech support department has received your message in good order and we have assigned a ticket number to your request. > > The ticket number assigned is: 22756. We are reviewing your ticket and will reply to it shortly. > > > Best Regards, > > Private Layer INC > Tech Support Department > support(a)privatelayer.com >

1 0

Re: [members-discuss] FW: NCC acting on registrations pursuant to "police order"?
by Erik Bais 11 Nov '11

11 Nov '11

Hi Brandon, >>> 1 Each Party shall adopt such legislative and other measures as >>> may be necessary to enable its competent authorities to order or >>> similarly obtain the expeditious preservation of specified computer >>> data > >It's just preservation, it doesn't say prevention of new data creation (you'd have to preserve that too) >It would just be a limitation of the RIPE systems if they have to lock an account to ensure retention of data, they could implement other means to provide a preserved data trail while leaving the account active. Your statement might be true and is also the problem with international ratification of Treaties and the underlying national implementation into the law. In this case, the question would be, what was the actual request from the Police, in order to get some more detail on it. If a preservation of information would have been enough or if a freeze of an account would be required. An online copy of the actual request from the KLPD in that case would be nice, where the personal details can be removed with black marker to protect the innocence etc. (blah blah .. ;-) ) I can only imagine that the operational system of RIPE would not have been designed to comply with anything like a Data retention act in mind. (Off-topic: Which in the Netherlands is still on 12 months btw.) So was the locking of the accounts towards the RIPE systems or freezing of the subnets, was it about the LIR portal, the associated maintainer passwd, or something else, like preventing them from doing changes to rev. dns. ? Or was it about avoiding transfers or changes in the Whois DB ? And instead of dealing with all the fuzz of the above, RIPE NCC might have taken the route of ... disable the accounts and wait ... Which is a perfectly good action imho as it would freeze the evidence present and the people involved would only notice it when they would actually need to make changes. Questions .. questions .. And only a few that know. Erik

3 2

Re: [members-discuss] FW: NCC acting on registrations pursuant to "police order"?
by Brandon Butterworth 11 Nov '11

11 Nov '11

>> 1 Each Party shall adopt such legislative and other measures as >> may be necessary to enable its competent authorities to order or >> similarly obtain the expeditious preservation of specified computer >> data It's just preservation, it doesn't say prevention of new data creation (you'd have to preserve that too) It would just be a limitation of the RIPE systems if they have to lock an account to ensure retention of data, they could implement other means to provide a preserved data trail while leaving the account active. brandon

1 0

Some thoughts I was not able to say at GM-2011
by poty＠iiat.ru 09 Nov '11

09 Nov '11

Hello everybody, At the beginning I'd like to apologize for my poor spoken English which prevented me to clearly state my opinion at GM. It is not related to any problems with EB preventing me to do that! Thank them for the opportunity given and sorry for emotional expressions. I hope that something from my speech at GM was understandable, but to make my position more consistent I'll sum the thoughts I wanted to express. My main concern is about openness of the decisions if we speak about money, not technical and police things. All the three interrelated finance documents (The Activity Plan, which defines the expenses and is the base for the Budget, which defines the balance between the expenses and incomes, and the Charging Scheme as a result of defined incomes to cover expenses) were compiled inside of the RIPE NCC and were not clear to me and (according to several posts here in the list) to several other members. For example, who exactly gave the feedbacks for initial RIPE NCC Proposed New Charging Scheme 2012? The members-discuss list was pristine innocent about this "the current Charging Scheme model is complex and makes it difficult for individual members to easily determine their own fees" complains. Private conversations? Maybe... But it shouldn't in my opinion be private as soon as it relates to all the members! The new published EB email which enables another private channel between a person and the EB is a bad thing according to the logic of my sentences above. The main and the only "panel" for discussion should be either the members-discuss list or new "finance-discuss?" list, opened maybe only to members (I don't mind if it is completely opened). As stated by Nigel Titley, the Chairman of the Executive Board, at the GM the things are going to change to the next GM. The lack of discussions about the documents before GM-2011 was in my opinion related to usefulness and the source reasons in the documents. Speaking about the Activity Plan - we (members) asked the EB about adding cost to each activity in 2007-2008. Without the numbers the Activity Plan is a way of stating things, but not evaluating effectiveness of the services. Discuss "marked on stone" statements is not very rewarding venture. Thankfully the numbers will appear soon in the document. Second point in the matter - the procedure of changing the Activity Plan - it is not exist now and should be invented. There was already the suggestions about it in the list I won't going to repeat them now. Speaking about the Charging Scheme... I'm not against the increase of the amount to pay, I'm against of the misty motivations for the rise and some predictability of expenses. There should be clearly defined "resource classes" included in each membership category, and clearer definition of fairness. (I'd also decide on the consulting about the taxation issue, but it in unrelated thing up to now.) I can give many examples of that but I'm trying to make this message as short as possible. For example, I don't agree with the "free" IPv6: the LIRs would pay for the blocks indirectly, through IPv4 counting, anyway - whom we are going to trick then? The last thing which is the most important to me - the services of the RIPE NCC above the main baseline of "providing unique blocks of numbers and register them on the DB". It is related to the Activity Plan certainly, but I'd like to mention them from different point of view - in term of including some of them in the Charging Scheme. I'm repeating - I'm not against developed services "made in RIPE NCC", think that many of them (not all though) are very useful, but why some of them deserves to be mentioned in the Charging Scheme, the others - not? Why not related to the main activity things should be mentioned in invoices at all? I think of it like "tie in sale", not very pleasant thought of course. Regards, Vladislav Potapov Ru.iiat

1 0

Re: [members-discuss] Voting @ GM 2011
by Brandon Butterworth 07 Nov '11

07 Nov '11

> The alternative, of course, is to continue with the old charging scheme > as we have used up until now but of course we put together the new > charging scheme as a response to the membership after complaints about > the old one, so I wouldn't expect that to be popular. There will always be some who think the price is too damn high and they should pay less (and in this case others should pay more instead). When you change it you'll make some happier, some will think it's still to high and you'll add others who now think it's too high. The latter two will continue to be heard. Overall the RIPE fees aren't that large and for big ISP are just noise. If there is change that's a sign where to make it. brandon

1 0