- members-discuss - mailman.ripe.net

Re: [members-discuss] Effective countermeasures against BGP hijacking
by Cedric R 01 Aug '18

01 Aug '18

Anyone to start an internet secure day ? ;) Maybe it's a good way to kickstart that change Le 01-08-18 à 16:43, Dominic Schallert a écrit : > Hi Cedric, > >> Am 01.08.2018 um 15:45 schrieb Cedric R <ml(a)servperso.com >> <mailto:ml@servperso.com>>: >> >> Hello, >> I think it's not a bad idea but the real solution remain RPKI. >> If transit operator like HE or L3 start to reject INVALID RPKI and >> some riskly network start to sign theyr route (and it's pretty simple >> with RIR tools) we can clear a part of the problem quickly. >> I don't talk about reject unsigned route, but only invalid signed. > > I absolutely agree with you. Personally I believe, for making progress > with technology, we will always need some innovators and big players > which are able and willing to create a certain amount of pressure on > the market. If the big transit providers or networks like Google, > Amazon, etc. would agree about a certain date after which they will > reject all invalid RPKI, I guess we would see some spike in RPKI > adoption VERY quickly. Similiar thing just happening with HTTPS/TLS > and their flagging of http:// as insecure in their latest Chrome > builds. Same story around three years ago with Google's call for > mobile-first and responsiveness. Concerning BGP, unfortunately I do > not expect the any of the big ones to take this step anywhere soon, as > it would also dramatically impact their own availability and revenue. > So what other options do we have then? > > >> Also AS blacklisting can be quickly spoofed. >> What append if someone use hijacked ASN behind it's legit ASN to >> announce hijacked prefix (not every filters drop that). > > To be honest, that’s an issue I haven't thought about yet but you are > absolutely right. > The only feasible solution here would be strict IRRDB filtering on > autnum/as-set. > > Best Regards > Dominic > > >> Best Regards >> Cedric Rossius >> >> Le 01-08-18 à 11:59, Dominic Schallert a écrit : >>> Dear colleagues, >>> >>> I’m sure some of you have read about this recent incident; >>> https://bgpstream.com/event/144058 . Nowadays we’re talking about >>> transport security, https-per-default, etc. but the most fundamental >>> parts of the internet such as BGP, are basically broken from a >>> security perspective. While RPKI/ROA/ROV could fix most of the >>> current security-related struggles, their deployment currently >>> competes somewhat with IPv6 - or even worse - and therefore won’t be >>> a practical solution in the forseeable future. Strict IRRDB and >>> route object filtering is complicated (or almost impossible) as well. >>> >>> So I’m wondering, why can't we just have an automated blacklist like >>> RBL's for mailservers, where all AS'es detected for hijacking >>> prefixes are automatically blacklisted, similiar to Team Cymru's >>> fullbogons feed? The list combined with some scripting could then be >>> used for realtime AS-path filtering at border routers. Delisting of >>> blacklisted ASNs should happen only after a pre-defined amount of >>> time (eg. 14 days) or after paying a fee to a charity/non-profit and >>> providing a statement on the issue which is publicy released. The >>> idea is to hurt those who can’t get their stuff - especially prefix >>> filtering - together. >>> >>> I still remember the days where everyone complained about RBLs, >>> nowadays almost every mailserver setup relies on them. Sometimes >>> extreme problems require extrem solutions. >>> >>> Mit besten Grüßen >>> Kind Regards >>> >>> Dominic Schallert, BA >>> >>> >>> <logo_email.png> >>> >>> >>> *schallert.com e.U.* | Hauptstraße 35b, 6800 Feldkirch, Austria >>> FN: 440372g | UID: ATU66209211 | Gerichtsstand: Feldkirch >>> Tel.: +43 680 146 1947 | Fax: +43 134 242 642 616 >>> >>> www.schallert.com <http://www.schallert.com/> | office(a)schallert.com >>> <mailto:office@schallert.com> >>> >>> >>> >>> >>> >>> >>> >>> >>> _______________________________________________ >>> members-discuss mailing list >>> members-discuss(a)ripe.net >>> https://lists.ripe.net/mailman/listinfo/members-discuss >>> Unsubscribe:https://lists.ripe.net/mailman/options/members-discuss/ml%40ser… >> >> >

1 0

Re: [members-discuss] Effective countermeasures against BGP hijacking
by Dominic Schallert 01 Aug '18

01 Aug '18

Hi Cedric, > Am 01.08.2018 um 15:45 schrieb Cedric R <ml(a)servperso.com <mailto:ml@servperso.com>>: > > Hello, > I think it's not a bad idea but the real solution remain RPKI. > If transit operator like HE or L3 start to reject INVALID RPKI and some riskly network start to sign theyr route (and it's pretty simple with RIR tools) we can clear a part of the problem quickly. > I don't talk about reject unsigned route, but only invalid signed. I absolutely agree with you. Personally I believe, for making progress with technology, we will always need some innovators and big players which are able and willing to create a certain amount of pressure on the market. If the big transit providers or networks like Google, Amazon, etc. would agree about a certain date after which they will reject all invalid RPKI, I guess we would see some spike in RPKI adoption VERY quickly. Similiar thing just happening with HTTPS/TLS and their flagging of http:// as insecure in their latest Chrome builds. Same story around three years ago with Google's call for mobile-first and responsiveness. Concerning BGP, unfortunately I do not expect the any of the big ones to take this step anywhere soon, as it would also dramatically impact their own availability and revenue. So what other options do we have then? > Also AS blacklisting can be quickly spoofed. > What append if someone use hijacked ASN behind it's legit ASN to announce hijacked prefix (not every filters drop that). To be honest, that’s an issue I haven't thought about yet but you are absolutely right. The only feasible solution here would be strict IRRDB filtering on autnum/as-set. Best Regards Dominic > Best Regards > Cedric Rossius > > Le 01-08-18 à 11:59, Dominic Schallert a écrit : >> Dear colleagues, >> >> I’m sure some of you have read about this recent incident; https://bgpstream.com/event/144058 <https://bgpstream.com/event/144058> . Nowadays we’re talking about transport security, https-per-default, etc. but the most fundamental parts of the internet such as BGP, are basically broken from a security perspective. While RPKI/ROA/ROV could fix most of the current security-related struggles, their deployment currently competes somewhat with IPv6 - or even worse - and therefore won’t be a practical solution in the forseeable future. Strict IRRDB and route object filtering is complicated (or almost impossible) as well. >> >> So I’m wondering, why can't we just have an automated blacklist like RBL's for mailservers, where all AS'es detected for hijacking prefixes are automatically blacklisted, similiar to Team Cymru's fullbogons feed? The list combined with some scripting could then be used for realtime AS-path filtering at border routers. Delisting of blacklisted ASNs should happen only after a pre-defined amount of time (eg. 14 days) or after paying a fee to a charity/non-profit and providing a statement on the issue which is publicy released. The idea is to hurt those who can’t get their stuff - especially prefix filtering - together. >> >> I still remember the days where everyone complained about RBLs, nowadays almost every mailserver setup relies on them. Sometimes extreme problems require extrem solutions. >> >> Mit besten Grüßen >> Kind Regards >> >> Dominic Schallert, BA >> >> >> <logo_email.png> >> >> >> schallert.com e.U. | Hauptstraße 35b, 6800 Feldkirch, Austria >> >> FN: 440372g | UID: ATU66209211 | Gerichtsstand: Feldkirch >> >> Tel.: +43 680 146 1947 | Fax: +43 134 242 642 616 >> >> www.schallert.com <http://www.schallert.com/> | office(a)schallert.com <mailto:office@schallert.com> >> >> >> >> >> >> >> _______________________________________________ >> members-discuss mailing list >> members-discuss(a)ripe.net <mailto:members-discuss@ripe.net> >> https://lists.ripe.net/mailman/listinfo/members-discuss <https://lists.ripe.net/mailman/listinfo/members-discuss> >> Unsubscribe: https://lists.ripe.net/mailman/options/members-discuss/ml%40servperso.com <https://lists.ripe.net/mailman/options/members-discuss/ml%40servperso.com> >

1 0

Re: [members-discuss] Effective countermeasures against BGP hijacking
by Arash Naderpour 01 Aug '18

01 Aug '18

Hi, And how you can detect if an AS is hijacking a prefix? RPKI does not check if entire path is correct and the attacker can bypass it by adding the origin AS at the end of AS-PATH. BGPsec is there to address the BGP hijacking, but creating a black-list and some policies to list/delist ASNs just making things more complex (starting with who is going to manage the list) Regards, Arash From: members-discuss <members-discuss-bounces(a)ripe.net> On Behalf Of Dominic Schallert Sent: Wednesday, 1 August 2018 7:59 PM To: members-discuss(a)ripe.net Subject: [members-discuss] Effective countermeasures against BGP hijacking Dear colleagues, I’m sure some of you have read about this recent incident; https://bgpstream.com/event/144058 . Nowadays we’re talking about transport security, https-per-default, etc. but the most fundamental parts of the internet such as BGP, are basically broken from a security perspective. While RPKI/ROA/ROV could fix most of the current security-related struggles, their deployment currently competes somewhat with IPv6 - or even worse - and therefore won’t be a practical solution in the forseeable future. Strict IRRDB and route object filtering is complicated (or almost impossible) as well. So I’m wondering, why can't we just have an automated blacklist like RBL's for mailservers, where all AS'es detected for hijacking prefixes are automatically blacklisted, similiar to Team Cymru's fullbogons feed? The list combined with some scripting could then be used for realtime AS-path filtering at border routers. Delisting of blacklisted ASNs should happen only after a pre-defined amount of time (eg. 14 days) or after paying a fee to a charity/non-profit and providing a statement on the issue which is publicy released. The idea is to hurt those who can’t get their stuff - especially prefix filtering - together. I still remember the days where everyone complained about RBLs, nowadays almost every mailserver setup relies on them. Sometimes extreme problems require extrem solutions. Mit besten Grüßen Kind Regards Dominic Schallert, BA schallert.com e.U. | Hauptstraße 35b, 6800 Feldkirch, Austria FN: 440372g | UID: ATU66209211 | Gerichtsstand: Feldkirch Tel.: +43 680 146 1947 | Fax: +43 134 242 642 616 <http://www.schallert.com> www.schallert.com | <mailto:office@schallert.com> office(a)schallert.com --- This email has been checked for viruses by AVG. https://www.avg.com

2 1

Re: [members-discuss] Effective countermeasures against BGP hijacking
by Cedric R 01 Aug '18

01 Aug '18

Hello, I think it's not a bad idea but the real solution remain RPKI. If transit operator like HE or L3 start to reject INVALID RPKI and some riskly network start to sign theyr route (and it's pretty simple with RIR tools) we can clear a part of the problem quickly. I don't talk about reject unsigned route, but only invalid signed. Also AS blacklisting can be quickly spoofed. What append if someone use hijacked ASN behind it's legit ASN to announce hijacked prefix (not every filters drop that). Best Regards Cedric Rossius Le 01-08-18 à 11:59, Dominic Schallert a écrit : > Dear colleagues, > > I’m sure some of you have read about this recent incident; > https://bgpstream.com/event/144058 . Nowadays we’re talking about > transport security, https-per-default, etc. but the most fundamental > parts of the internet such as BGP, are basically broken from a > security perspective. While RPKI/ROA/ROV could fix most of the current > security-related struggles, their deployment currently competes > somewhat with IPv6 - or even worse - and therefore won’t be a > practical solution in the forseeable future. Strict IRRDB and route > object filtering is complicated (or almost impossible) as well. > > So I’m wondering, why can't we just have an automated blacklist like > RBL's for mailservers, where all AS'es detected for hijacking prefixes > are automatically blacklisted, similiar to Team Cymru's fullbogons > feed? The list combined with some scripting could then be used for > realtime AS-path filtering at border routers. Delisting of blacklisted > ASNs should happen only after a pre-defined amount of time (eg. 14 > days) or after paying a fee to a charity/non-profit and providing a > statement on the issue which is publicy released. The idea is to hurt > those who can’t get their stuff - especially prefix filtering - together. > > I still remember the days where everyone complained about RBLs, > nowadays almost every mailserver setup relies on them. Sometimes > extreme problems require extrem solutions. > > Mit besten Grüßen > Kind Regards > > Dominic Schallert, BA > > > > > *schallert.com e.U.* | Hauptstraße 35b, 6800 Feldkirch, Austria > FN: 440372g | UID: ATU66209211 | Gerichtsstand: Feldkirch > Tel.: +43 680 146 1947 | Fax: +43 134 242 642 616 > > www.schallert.com <http://www.schallert.com> | office(a)schallert.com > <mailto:office@schallert.com> > > > > > > > > > _______________________________________________ > members-discuss mailing list > members-discuss(a)ripe.net > https://lists.ripe.net/mailman/listinfo/members-discuss > Unsubscribe: https://lists.ripe.net/mailman/options/members-discuss/ml%40servperso.com

1 0

Re: [members-discuss] Effective countermeasures against BGP hijacking
by Dominic Schallert 01 Aug '18

01 Aug '18

Hi Dmitry, > The answer is simple. It will be centralized system and so: > - you will need to trust its system engineers > - any breaking of this system can cause Internet crash if many AS`es will use it > > So it is very bad idea on my opinion. That’s a very good point and probably the most problematic one also with existing lists such as Spamhaus EDROP. I'm thinking of a decentralized system run by a nonprofit/NGO or maybe even some sort of blockchain or DLT-based approach where multiple, independent parties are required to sign something - or in this case add entries to the list, in order to avoid misuse, censorship and a single point of failure. The contributing organizations could be RIRs, IXPs, Tier-1 ISPs and NGOs in different continents, countries and legislations, where atleast for example one-third of them need to flag an ASN before it gets added to the list. > What we need that all follow the rules: https://www.routingmanifesto.org/ <https://www.routingmanifesto.org/> Thanks for the link Kind Regards > On 01.08.2018 12:59, Dominic Schallert wrote: >> Dear colleagues, >> >> I’m sure some of you have read about this recent incident; https://bgpstream.com/event/144058 <https://bgpstream.com/event/144058> . Nowadays we’re talking about transport security, https-per-default, etc. but the most fundamental parts of the internet such as BGP, are basically broken from a security perspective. While RPKI/ROA/ROV could fix most of the current security-related struggles, their deployment currently competes somewhat with IPv6 - or even worse - and therefore won’t be a practical solution in the forseeable future. Strict IRRDB and route object filtering is complicated (or almost impossible) as well. >> >> So I’m wondering, why can't we just have an automated blacklist like RBL's for mailservers, where all AS'es detected for hijacking prefixes are automatically blacklisted, similiar to Team Cymru's fullbogons feed? The list combined with some scripting could then be used for realtime AS-path filtering at border routers. Delisting of blacklisted ASNs should happen only after a pre-defined amount of time (eg. 14 days) or after paying a fee to a charity/non-profit and providing a statement on the issue which is publicy released. The idea is to hurt those who can’t get their stuff - especially prefix filtering - together. >> >> I still remember the days where everyone complained about RBLs, nowadays almost every mailserver setup relies on them. Sometimes extreme problems require extrem solutions. >> >> Mit besten Grüßen >> Kind Regards >> >> Dominic Schallert, BA >> >> >> <Mail-Anhang.png> >> >> >> schallert.com e.U. | Hauptstraße 35b, 6800 Feldkirch, Austria >> >> FN: 440372g | UID: ATU66209211 | Gerichtsstand: Feldkirch >> >> Tel.: +43 680 146 1947 | Fax: +43 134 242 642 616 >> >> <http://www.schallert.com/>www.schallert.com <http://www.schallert.com/> | <mailto:office@schallert.com>office(a)schallert.com <mailto:office@schallert.com> >> >> >> >> >> >> >> _______________________________________________ >> members-discuss mailing list >> members-discuss(a)ripe.net <mailto:members-discuss@ripe.net> >> https://lists.ripe.net/mailman/listinfo/members-discuss <https://lists.ripe.net/mailman/listinfo/members-discuss> >> Unsubscribe: https://lists.ripe.net/mailman/options/members-discuss/noc%40mega-net.ru <https://lists.ripe.net/mailman/options/members-discuss/noc%40mega-net.ru> >

1 0

Re: [members-discuss] Effective countermeasures against BGP hijacking
by NOC 01 Aug '18

01 Aug '18

Hi. Why ? The answer is simple. It will be centralized system and so: - you will need to trust its system engineers - any breaking of this system can cause Internet crash if many AS`es will use it So it is very bad idea on my opinion. What we need that all follow the rules: https://www.routingmanifesto.org/ С наилучшими пожеланиями :: With best regards, Дмитрий Николаев технический директор ООО "Меганет-2003" :: Dmitry Nikolaev CTO "Meganet-2003" LLC On 01.08.2018 12:59, Dominic Schallert wrote: > Dear colleagues, > > I’m sure some of you have read about this recent > incident; https://bgpstream.com/event/144058 . Nowadays we’re talking > about transport security, https-per-default, etc. but the most > fundamental parts of the internet such as BGP, are basically broken > from a security perspective. While RPKI/ROA/ROV could fix most of the > current security-related struggles, their deployment currently > competes somewhat with IPv6 - or even worse - and therefore won’t be a > practical solution in the forseeable future. Strict IRRDB and route > object filtering is complicated (or almost impossible) as well. > > So I’m wondering, why can't we just have an automated blacklist like > RBL's for mailservers, where all AS'es detected for hijacking prefixes > are automatically blacklisted, similiar to Team Cymru's fullbogons > feed? The list combined with some scripting could then be used for > realtime AS-path filtering at border routers. Delisting of blacklisted > ASNs should happen only after a pre-defined amount of time (eg. 14 > days) or after paying a fee to a charity/non-profit and providing a > statement on the issue which is publicy released. The idea is to hurt > those who can’t get their stuff - especially prefix filtering - together. > > I still remember the days where everyone complained about RBLs, > nowadays almost every mailserver setup relies on them. Sometimes > extreme problems require extrem solutions. > > Mit besten Grüßen > Kind Regards > > Dominic Schallert, BA > > > > > *schallert.com e.U.* | Hauptstraße 35b, 6800 Feldkirch, Austria > > FN: 440372g | UID: ATU66209211 | Gerichtsstand: Feldkirch > > Tel.: +43 680 146 1947 | Fax: +43 134 242 642 616 > > www.schallert.com | office(a)schallert.com > > > > > > > > > _______________________________________________ > members-discuss mailing list > members-discuss(a)ripe.net > https://lists.ripe.net/mailman/listinfo/members-discuss > Unsubscribe: https://lists.ripe.net/mailman/options/members-discuss/noc%40mega-net.ru

1 0

Effective countermeasures against BGP hijacking
by Dominic Schallert 01 Aug '18

01 Aug '18

Dear colleagues, I’m sure some of you have read about this recent incident; https://bgpstream.com/event/144058 <https://bgpstream.com/event/144058> . Nowadays we’re talking about transport security, https-per-default, etc. but the most fundamental parts of the internet such as BGP, are basically broken from a security perspective. While RPKI/ROA/ROV could fix most of the current security-related struggles, their deployment currently competes somewhat with IPv6 - or even worse - and therefore won’t be a practical solution in the forseeable future. Strict IRRDB and route object filtering is complicated (or almost impossible) as well. So I’m wondering, why can't we just have an automated blacklist like RBL's for mailservers, where all AS'es detected for hijacking prefixes are automatically blacklisted, similiar to Team Cymru's fullbogons feed? The list combined with some scripting could then be used for realtime AS-path filtering at border routers. Delisting of blacklisted ASNs should happen only after a pre-defined amount of time (eg. 14 days) or after paying a fee to a charity/non-profit and providing a statement on the issue which is publicy released. The idea is to hurt those who can’t get their stuff - especially prefix filtering - together. I still remember the days where everyone complained about RBLs, nowadays almost every mailserver setup relies on them. Sometimes extreme problems require extrem solutions. Mit besten Grüßen Kind Regards Dominic Schallert, BA schallert.com e.U. | Hauptstraße 35b, 6800 Feldkirch, Austria FN: 440372g | UID: ATU66209211 | Gerichtsstand: Feldkirch Tel.: +43 680 146 1947 | Fax: +43 134 242 642 616 www.schallert.com <http://www.schallert.com/> | office(a)schallert.com <mailto:office@schallert.com>

1 0

RIPE forces us to pay the bill unfairly
by olena.dmytrenko＠bignet.ua 24 Jul '18

24 Jul '18

Hello everybody! We got a problem! We want to share it with you to find out your opinion on this matter. We are transferring our network to other company. The transfer is approved. As policy prescribed, you have to pay the annual fee. For today these are the third quartal and the forth. But RIPE forces us to pay the bill for the first quartal, however our LIR was opened later in the second one. ( in APRIL 2018). We would like to see and discuss the rules, where it is prescribed what to pay in such cases. Where we can read the regulation that you need to pay an annual fee for the quarters in which Lir did not even exist. Furthermore, we have 5 more LIRs on one company. Is it fare to be forced to pay all annual invoices on all Lirs, before the transfer one part of the network from 1 LIR? --Olena Dmytrenko

30 38

Re: [members-discuss] RIPE forces us to pay the bill unfairly
by Paul Thornton 10 Jul '18

10 Jul '18

On 10/07/2018 09:31, Martin Huněk wrote: > Dear Olena, > > stop looking for sympathy here, you get none. > > As you have written, you have 5 LIRs. It means that you probably have five times more IPv4 space that you deserved. As you might know, these addresses are reserved for late comers so they get at least some portion of the IPv4 space. Every thing else is just a tolerated abuse. Only unfair thing about this whole thing is that it is still tolerated (in the name of accurate database). So it is only fair that you had to pay for such "abuse" of (post-) last /8 space. These rules are there precisely because of that. > I am curious as to how the OP is able to transfer what is clearly non-legacy space out of this LIR when by their own admission, it hasn't been in existence for two years. Paul.

2 1

Re: [members-discuss] Request to update the SSA - Article 2.2, acceptance of documents
by Christian Kratzer 30 Jun '18

30 Jun '18

Hi, On Mon, 25 Jun 2018, John Fitzgerald wrote: > Since we have seen so many invalid certificates and signatures and even big CAs fail, we are voting for the good old paperwork method. I agree. I also cannot understand why this is such a big deal unless you want to create lots of LIR. For any valid business model setting up a lir is a one time thing where I do not worry about 300 EUR costs for paperwork. Greetings Christian -- Christian Kratzer CK Software GmbH Email: ck(a)cksoft.de Wildberger Weg 24/2 Phone: +49 7032 893 997 - 0 D-71126 Gaeufelden Fax: +49 7032 893 997 - 9 HRB 245288, Amtsgericht Stuttgart Mobile: +49 171 1947 843 Geschaeftsfuehrer: Christian Kratzer Web: http://www.cksoft.de/

2 1