- members-discuss - mailman.ripe.net

Re: [members-discuss] LIR???s billing issues with RIPE NCC, need support
by ripe-member-discuss+lr＠c2play.de 04 Dec '18

04 Dec '18

2 1

Re: [members-discuss] LIR???s billing issues with RIPE NCC, need support
by Lutz Donnerhacke 04 Dec '18

04 Dec '18

> Because I need more addresses to offer to my customers. Purchasing > addresses from open market is risky. Thats why I open new LIRs. You are doing it wrong. Please learn how to operate an ISP in modern times. Two hints: - https://lutz.donnerhacke.de/eng/content/search?SearchText=NAT (use deepl.com) - https://tools.ietf.org/html/rfc6540 But please stop wasting tight resources by incompetence. And please stop stealing resources from others by tricking RIPE policies. Please note, that your message is enough to reclaim the illegal obtained resources back by RIPE NCC. That's one of the activities we pay them for.

3 2

Our AS is in a macro that we don't authorize.
by José Manuel Giner 02 Nov '18

02 Nov '18

Hi, we checked that our AS is present in the macro: AS24748:AS-THINX (they have thousands of AS in their macro) After contacting atman.pl who is responsible for this macro, they tell me: > It appears that AS59432 is contained in one of our customers AS-SETs and > it is automatically added to our AS-SET AS24748:AS-THINX > > As soon as they remove AS59432, it will disappear from AS24748:AS-THINX We have asked him how we can find out who that customer is. But their answer doesn't give us any information. > Please be kindly informed that our macros are being built automatically > according to our customers` macros. If your AS happens to be removed > from whichever of our customer`s macros, ours is to be changed accordingly. We are concerned about this situation and do not know how to proceed. Thank you for your help! -- José Manuel Giner http://ginernet.com

6 7

[ncc-announce] [news] Transfers Due to Change in Business Structure and Between LIR Accounts of One Member
by Фри Дата 29 Oct '18

29 Oct '18

1 0

Out of office email
by Cedric R 02 Aug '18

02 Aug '18

Hello, When i send a message to this mailing list, i receive some Out of office from a bunch of members. Can you avoid to use out of office on mailbox used for mailing list (maybe use separate mailbox). Thanks Cédric Rossius

2 1

Re: [members-discuss] Effective countermeasures against BGP hijacking
by Alex Band 02 Aug '18

02 Aug '18

Hi Dominic, > On 1 Aug 2018, at 16:43, Dominic Schallert <ds(a)schallert.com> wrote: > > Signed PGP part > Hi Cedric, > >> Am 01.08.2018 um 15:45 schrieb Cedric R <ml(a)servperso.com>: >> >> Hello, >> I think it's not a bad idea but the real solution remain RPKI. >> If transit operator like HE or L3 start to reject INVALID RPKI and some riskly network start to sign theyr route (and it's pretty simple with RIR tools) we can clear a part of the problem quickly. >> I don't talk about reject unsigned route, but only invalid signed. > > I absolutely agree with you. Personally I believe, for making progress with technology, we will always need some innovators and big players which are able and willing to create a certain amount of pressure on the market. If the big transit providers or networks like Google, Amazon, etc. would agree about a certain date after which they will reject all invalid RPKI, I guess we would see some spike in RPKI adoption VERY quickly. Similiar thing just happening with HTTPS/TLS and their flagging of http:// as insecure in their latest Chrome builds. Same story around three years ago with Google's call for mobile-first and responsiveness. Concerning BGP, unfortunately I do not expect the any of the big ones to take this step anywhere soon, as it would also dramatically impact their own availability and revenue. So what other options do we have then? After events like the MyEtherWallet BGP hijack, these big corporations you mention are certainly not ignoring RPKI. The feedback I’ve been getting from the industry is not so much the willingness to adopt RPKI but rather the lack of mature, well maintained and easy to use tooling to deploy and maintain it. The hosted systems that the RIRs offer are fine for basic management, but if you’re an enterprise with address space in multiple RIR regions or you are an LIR with a large amount of customers you manage routing for, clicking around in (multiple) RIR web interfaces gets old really fast. The same goes for relying party software to validate RPKI data; how many mature implementations are available? To use your own example, large scale deployment of HTTPS was only possible after Let’s Encrypt provided a practical and affordable way for everyone to have a certificate. The same can happen with RPKI... Cheers, Alex Band NLnet Labs @alexander_band https://nlnetlabs.nl > > >> Also AS blacklisting can be quickly spoofed. >> What append if someone use hijacked ASN behind it's legit ASN to announce hijacked prefix (not every filters drop that). > > To be honest, that’s an issue I haven't thought about yet but you are absolutely right. > The only feasible solution here would be strict IRRDB filtering on autnum/as-set. > > Best Regards > Dominic > > >> Best Regards >> Cedric Rossius >> >> Le 01-08-18 à 11:59, Dominic Schallert a écrit : >>> Dear colleagues, >>> >>> I’m sure some of you have read about this recent incident; https://bgpstream.com/event/144058 . Nowadays we’re talking about transport security, https-per-default, etc. but the most fundamental parts of the internet such as BGP, are basically broken from a security perspective. While RPKI/ROA/ROV could fix most of the current security-related struggles, their deployment currently competes somewhat with IPv6 - or even worse - and therefore won’t be a practical solution in the forseeable future. Strict IRRDB and route object filtering is complicated (or almost impossible) as well. >>> >>> So I’m wondering, why can't we just have an automated blacklist like RBL's for mailservers, where all AS'es detected for hijacking prefixes are automatically blacklisted, similiar to Team Cymru's fullbogons feed? The list combined with some scripting could then be used for realtime AS-path filtering at border routers. Delisting of blacklisted ASNs should happen only after a pre-defined amount of time (eg. 14 days) or after paying a fee to a charity/non-profit and providing a statement on the issue which is publicy released. The idea is to hurt those who can’t get their stuff - especially prefix filtering - together. >>> >>> I still remember the days where everyone complained about RBLs, nowadays almost every mailserver setup relies on them. Sometimes extreme problems require extrem solutions. >>> >>> Mit besten Grüßen >>> Kind Regards >>> >>> Dominic Schallert, BA >>> >>> >>> <logo_email.png> >>> >>> >>> schallert.com e.U. | Hauptstraße 35b, 6800 Feldkirch, Austria >>> >>> FN: 440372g | UID: ATU66209211 | Gerichtsstand: Feldkirch >>> >>> Tel.: +43 680 146 1947 | Fax: +43 134 242 642 616 >>> >>> www.schallert.com | office(a)schallert.com >>> >>> >>> >>> >>> >>> >>> _______________________________________________ >>> members-discuss mailing list >>> >>> members-discuss(a)ripe.net >>> https://lists.ripe.net/mailman/listinfo/members-discuss >>> >>> Unsubscribe: >>> https://lists.ripe.net/mailman/options/members-discuss/ml%40servperso.com >> > > >

2 1

Re: [members-discuss] Effective countermeasures against BGP hijacking
by Cedric R 01 Aug '18

01 Aug '18

Anyone to start an internet secure day ? ;) Maybe it's a good way to kickstart that change Le 01-08-18 à 16:43, Dominic Schallert a écrit : > Hi Cedric, > >> Am 01.08.2018 um 15:45 schrieb Cedric R <ml(a)servperso.com >> <mailto:ml@servperso.com>>: >> >> Hello, >> I think it's not a bad idea but the real solution remain RPKI. >> If transit operator like HE or L3 start to reject INVALID RPKI and >> some riskly network start to sign theyr route (and it's pretty simple >> with RIR tools) we can clear a part of the problem quickly. >> I don't talk about reject unsigned route, but only invalid signed. > > I absolutely agree with you. Personally I believe, for making progress > with technology, we will always need some innovators and big players > which are able and willing to create a certain amount of pressure on > the market. If the big transit providers or networks like Google, > Amazon, etc. would agree about a certain date after which they will > reject all invalid RPKI, I guess we would see some spike in RPKI > adoption VERY quickly. Similiar thing just happening with HTTPS/TLS > and their flagging of http:// as insecure in their latest Chrome > builds. Same story around three years ago with Google's call for > mobile-first and responsiveness. Concerning BGP, unfortunately I do > not expect the any of the big ones to take this step anywhere soon, as > it would also dramatically impact their own availability and revenue. > So what other options do we have then? > > >> Also AS blacklisting can be quickly spoofed. >> What append if someone use hijacked ASN behind it's legit ASN to >> announce hijacked prefix (not every filters drop that). > > To be honest, that’s an issue I haven't thought about yet but you are > absolutely right. > The only feasible solution here would be strict IRRDB filtering on > autnum/as-set. > > Best Regards > Dominic > > >> Best Regards >> Cedric Rossius >> >> Le 01-08-18 à 11:59, Dominic Schallert a écrit : >>> Dear colleagues, >>> >>> I’m sure some of you have read about this recent incident; >>> https://bgpstream.com/event/144058 . Nowadays we’re talking about >>> transport security, https-per-default, etc. but the most fundamental >>> parts of the internet such as BGP, are basically broken from a >>> security perspective. While RPKI/ROA/ROV could fix most of the >>> current security-related struggles, their deployment currently >>> competes somewhat with IPv6 - or even worse - and therefore won’t be >>> a practical solution in the forseeable future. Strict IRRDB and >>> route object filtering is complicated (or almost impossible) as well. >>> >>> So I’m wondering, why can't we just have an automated blacklist like >>> RBL's for mailservers, where all AS'es detected for hijacking >>> prefixes are automatically blacklisted, similiar to Team Cymru's >>> fullbogons feed? The list combined with some scripting could then be >>> used for realtime AS-path filtering at border routers. Delisting of >>> blacklisted ASNs should happen only after a pre-defined amount of >>> time (eg. 14 days) or after paying a fee to a charity/non-profit and >>> providing a statement on the issue which is publicy released. The >>> idea is to hurt those who can’t get their stuff - especially prefix >>> filtering - together. >>> >>> I still remember the days where everyone complained about RBLs, >>> nowadays almost every mailserver setup relies on them. Sometimes >>> extreme problems require extrem solutions. >>> >>> Mit besten Grüßen >>> Kind Regards >>> >>> Dominic Schallert, BA >>> >>> >>> <logo_email.png> >>> >>> >>> *schallert.com e.U.* | Hauptstraße 35b, 6800 Feldkirch, Austria >>> FN: 440372g | UID: ATU66209211 | Gerichtsstand: Feldkirch >>> Tel.: +43 680 146 1947 | Fax: +43 134 242 642 616 >>> >>> www.schallert.com <http://www.schallert.com/> | office(a)schallert.com >>> <mailto:office@schallert.com> >>> >>> >>> >>> >>> >>> >>> >>> >>> _______________________________________________ >>> members-discuss mailing list >>> members-discuss(a)ripe.net >>> https://lists.ripe.net/mailman/listinfo/members-discuss >>> Unsubscribe:https://lists.ripe.net/mailman/options/members-discuss/ml%40ser… >> >> >

1 0

Re: [members-discuss] Effective countermeasures against BGP hijacking
by Dominic Schallert 01 Aug '18

01 Aug '18

Hi Cedric, > Am 01.08.2018 um 15:45 schrieb Cedric R <ml(a)servperso.com <mailto:ml@servperso.com>>: > > Hello, > I think it's not a bad idea but the real solution remain RPKI. > If transit operator like HE or L3 start to reject INVALID RPKI and some riskly network start to sign theyr route (and it's pretty simple with RIR tools) we can clear a part of the problem quickly. > I don't talk about reject unsigned route, but only invalid signed. I absolutely agree with you. Personally I believe, for making progress with technology, we will always need some innovators and big players which are able and willing to create a certain amount of pressure on the market. If the big transit providers or networks like Google, Amazon, etc. would agree about a certain date after which they will reject all invalid RPKI, I guess we would see some spike in RPKI adoption VERY quickly. Similiar thing just happening with HTTPS/TLS and their flagging of http:// as insecure in their latest Chrome builds. Same story around three years ago with Google's call for mobile-first and responsiveness. Concerning BGP, unfortunately I do not expect the any of the big ones to take this step anywhere soon, as it would also dramatically impact their own availability and revenue. So what other options do we have then? > Also AS blacklisting can be quickly spoofed. > What append if someone use hijacked ASN behind it's legit ASN to announce hijacked prefix (not every filters drop that). To be honest, that’s an issue I haven't thought about yet but you are absolutely right. The only feasible solution here would be strict IRRDB filtering on autnum/as-set. Best Regards Dominic > Best Regards > Cedric Rossius > > Le 01-08-18 à 11:59, Dominic Schallert a écrit : >> Dear colleagues, >> >> I’m sure some of you have read about this recent incident; https://bgpstream.com/event/144058 <https://bgpstream.com/event/144058> . Nowadays we’re talking about transport security, https-per-default, etc. but the most fundamental parts of the internet such as BGP, are basically broken from a security perspective. While RPKI/ROA/ROV could fix most of the current security-related struggles, their deployment currently competes somewhat with IPv6 - or even worse - and therefore won’t be a practical solution in the forseeable future. Strict IRRDB and route object filtering is complicated (or almost impossible) as well. >> >> So I’m wondering, why can't we just have an automated blacklist like RBL's for mailservers, where all AS'es detected for hijacking prefixes are automatically blacklisted, similiar to Team Cymru's fullbogons feed? The list combined with some scripting could then be used for realtime AS-path filtering at border routers. Delisting of blacklisted ASNs should happen only after a pre-defined amount of time (eg. 14 days) or after paying a fee to a charity/non-profit and providing a statement on the issue which is publicy released. The idea is to hurt those who can’t get their stuff - especially prefix filtering - together. >> >> I still remember the days where everyone complained about RBLs, nowadays almost every mailserver setup relies on them. Sometimes extreme problems require extrem solutions. >> >> Mit besten Grüßen >> Kind Regards >> >> Dominic Schallert, BA >> >> >> <logo_email.png> >> >> >> schallert.com e.U. | Hauptstraße 35b, 6800 Feldkirch, Austria >> >> FN: 440372g | UID: ATU66209211 | Gerichtsstand: Feldkirch >> >> Tel.: +43 680 146 1947 | Fax: +43 134 242 642 616 >> >> www.schallert.com <http://www.schallert.com/> | office(a)schallert.com <mailto:office@schallert.com> >> >> >> >> >> >> >> _______________________________________________ >> members-discuss mailing list >> members-discuss(a)ripe.net <mailto:members-discuss@ripe.net> >> https://lists.ripe.net/mailman/listinfo/members-discuss <https://lists.ripe.net/mailman/listinfo/members-discuss> >> Unsubscribe: https://lists.ripe.net/mailman/options/members-discuss/ml%40servperso.com <https://lists.ripe.net/mailman/options/members-discuss/ml%40servperso.com> >

1 0

Re: [members-discuss] Effective countermeasures against BGP hijacking
by Arash Naderpour 01 Aug '18

01 Aug '18

Hi, And how you can detect if an AS is hijacking a prefix? RPKI does not check if entire path is correct and the attacker can bypass it by adding the origin AS at the end of AS-PATH. BGPsec is there to address the BGP hijacking, but creating a black-list and some policies to list/delist ASNs just making things more complex (starting with who is going to manage the list) Regards, Arash From: members-discuss <members-discuss-bounces(a)ripe.net> On Behalf Of Dominic Schallert Sent: Wednesday, 1 August 2018 7:59 PM To: members-discuss(a)ripe.net Subject: [members-discuss] Effective countermeasures against BGP hijacking Dear colleagues, I’m sure some of you have read about this recent incident; https://bgpstream.com/event/144058 . Nowadays we’re talking about transport security, https-per-default, etc. but the most fundamental parts of the internet such as BGP, are basically broken from a security perspective. While RPKI/ROA/ROV could fix most of the current security-related struggles, their deployment currently competes somewhat with IPv6 - or even worse - and therefore won’t be a practical solution in the forseeable future. Strict IRRDB and route object filtering is complicated (or almost impossible) as well. So I’m wondering, why can't we just have an automated blacklist like RBL's for mailservers, where all AS'es detected for hijacking prefixes are automatically blacklisted, similiar to Team Cymru's fullbogons feed? The list combined with some scripting could then be used for realtime AS-path filtering at border routers. Delisting of blacklisted ASNs should happen only after a pre-defined amount of time (eg. 14 days) or after paying a fee to a charity/non-profit and providing a statement on the issue which is publicy released. The idea is to hurt those who can’t get their stuff - especially prefix filtering - together. I still remember the days where everyone complained about RBLs, nowadays almost every mailserver setup relies on them. Sometimes extreme problems require extrem solutions. Mit besten Grüßen Kind Regards Dominic Schallert, BA schallert.com e.U. | Hauptstraße 35b, 6800 Feldkirch, Austria FN: 440372g | UID: ATU66209211 | Gerichtsstand: Feldkirch Tel.: +43 680 146 1947 | Fax: +43 134 242 642 616 <http://www.schallert.com> www.schallert.com | <mailto:office@schallert.com> office(a)schallert.com --- This email has been checked for viruses by AVG. https://www.avg.com

2 1

Re: [members-discuss] Effective countermeasures against BGP hijacking
by Cedric R 01 Aug '18

01 Aug '18

Hello, I think it's not a bad idea but the real solution remain RPKI. If transit operator like HE or L3 start to reject INVALID RPKI and some riskly network start to sign theyr route (and it's pretty simple with RIR tools) we can clear a part of the problem quickly. I don't talk about reject unsigned route, but only invalid signed. Also AS blacklisting can be quickly spoofed. What append if someone use hijacked ASN behind it's legit ASN to announce hijacked prefix (not every filters drop that). Best Regards Cedric Rossius Le 01-08-18 à 11:59, Dominic Schallert a écrit : > Dear colleagues, > > I’m sure some of you have read about this recent incident; > https://bgpstream.com/event/144058 . Nowadays we’re talking about > transport security, https-per-default, etc. but the most fundamental > parts of the internet such as BGP, are basically broken from a > security perspective. While RPKI/ROA/ROV could fix most of the current > security-related struggles, their deployment currently competes > somewhat with IPv6 - or even worse - and therefore won’t be a > practical solution in the forseeable future. Strict IRRDB and route > object filtering is complicated (or almost impossible) as well. > > So I’m wondering, why can't we just have an automated blacklist like > RBL's for mailservers, where all AS'es detected for hijacking prefixes > are automatically blacklisted, similiar to Team Cymru's fullbogons > feed? The list combined with some scripting could then be used for > realtime AS-path filtering at border routers. Delisting of blacklisted > ASNs should happen only after a pre-defined amount of time (eg. 14 > days) or after paying a fee to a charity/non-profit and providing a > statement on the issue which is publicy released. The idea is to hurt > those who can’t get their stuff - especially prefix filtering - together. > > I still remember the days where everyone complained about RBLs, > nowadays almost every mailserver setup relies on them. Sometimes > extreme problems require extrem solutions. > > Mit besten Grüßen > Kind Regards > > Dominic Schallert, BA > > > > > *schallert.com e.U.* | Hauptstraße 35b, 6800 Feldkirch, Austria > FN: 440372g | UID: ATU66209211 | Gerichtsstand: Feldkirch > Tel.: +43 680 146 1947 | Fax: +43 134 242 642 616 > > www.schallert.com <http://www.schallert.com> | office(a)schallert.com > <mailto:office@schallert.com> > > > > > > > > > _______________________________________________ > members-discuss mailing list > members-discuss(a)ripe.net > https://lists.ripe.net/mailman/listinfo/members-discuss > Unsubscribe: https://lists.ripe.net/mailman/options/members-discuss/ml%40servperso.com

1 0