RIPE 69 - Anti-Abuse Working Group Minutes

Anti-Abuse Working Group Draft Minutes - RIPE 69

Date: 5 November 2015, 14:00-15:30

Working Group Co-Chairs: Brian Nisbet, Tobias Knecht

Scribe: Marco Hogewoning

Status: Draft

Brian Nisbet, WG co-chair, welcomed the attendees and apologised on behalf of Tobias Knecht who due to illness could not attend the session.

A. Administrative Matters

Brian apologised for the minutes of RIPE 68 being sent out late and asked the audience if there where any comments or additions.

Alexander Isavin, NetLine, mentioned that the section on law enforcement agencies is missing from the minutes. Brian says he remembers the discussion and will look into the matter.

He asked the working group to approve the session's agenda, which they did without further comments.

B. Update - Brian Nisbet, AA Working Group Co-Chair

Brian mentioned the charter was discussed in Warsaw and some follow up discussion took place in June. The new charter has been published on the website and Brian closed this action point.

Brian introduced the procedure to select working group chairs and gave the working group some background on why this is needed. A draft text was sent to the mailing list and a version with some minor changes in wording was published on Tuesday evening. Brian highlighted the main elements of the proposal that the chairs will have a term, there will be no limit on the number of terms and each term will last for three years.

There will be two or a maximum of three chairs for the working group and the decision on who will become chair preferably is made by consensus or alternatively by a secret ballot.

Brian asked if there were any further comments and deferred the discussion back to the mailing list to come to a conclusion about this topic Sander Steffann raised his thumb.

Brian pointed to a discussion the mailing list about AS Numbers and said that due to the recent number of emails he was not able to catch up. He suggested to leave the discussion on the mailing list as more people are likely to be behind on this topic. Brain mentioned that the RIPE NCC was already looking into some of the questions raised in the list and was expected to reply.

He clarified the discussion has to do with the credentials supplied when an AS Number is requested and any allocations that have been revoked.

C. Policies

Brian mentioned that due to Tobias' illness they haven't looked into the issue and mentioned that a conference call with the RIPE NCC has been planned in December to talk about this.

D2: RIPE NCC anti-abuse outreach activities

Mirjam Keuhne and Ivo Dijkhuis from the RIPE NCC presented about their outreach activity. A copy of the presentation is available at https://ripe69.ripe.net/presentations/116-SecurityUpdate4RIPE69.pdf

Brian reminded Mirjam about an open action point for the RIPE NCC from Warsaw to send some more information to the list, which hadn't happened yet.

D3. RIPE NCC Government / LEA Interactions Update

Marco Hogewoning, RIPE NCC, gave a short update on the interactions with law enforcement and governments.

An archived copy of Marco's presentation is available at https://ripe69.ripe.net/archives/video/10140/

Coming back to Alexander Isavin's earlier question about the minutes, Marco mentioned there is an open action point to provide more information about the LEA meetings. As there haven't been any LEA meetings yet, this information was not published.

Heather Schiller, ARIN, asked if the RIPE NCC published a report about the number of LEA enquiries they receive.

Marco mentioned the RIPE NCC in 2012 and 2013 published a transparency report which is available on the website.

Ruediger Volk, Deutsche Telekom, pointed out that the report does not list the level of access given to law enforcement agencies.

Marco explains the information contained in the report and said that it not only provides the number of enquiries but also gives some information on where the are coming from and provides an overview of the nature and reason of declined requests.

E2. Tor censorship countermeasures and how you can help

Jurre van Bergen, Greenhost, presented about countermeasures to Tor censorship.

A copy of the presentation is available at https://ripe69.ripe.net/presentations/112-tor-ripe69.pdf

Erik Bais, A2B Networks, asked if he understood correctly that Jurre had set up a foundation for this and what kind of work was involved in running an exit node.

Jurre clarified that the foundation was set up to maintain a dialogue with the law enforcement community and to actively assist them with warrants and subpoenas. He said they are happy to provide operators with training and help them to set up and suggested to take the discussion private.

Brian Nisbet mentioned that research networks have two issues with running tor exit nodes. One being the acceptable use policy prohibiting a third party from using these networks for this purpose. The other being that the misconceptions about the Tor project might lead to questions from the governments who fund the research network.

Jurre pointed out that majority of funding for the Tor project comes from governments. He explained they are using an IP block from a Dutch research institute, but as it was re-purposed they are not really using the research network.

Sacha van Geffen, Greenhost, asked if the foundation was busy creating and publishing any best current practices.

Jurre answered this is done and gave an example on controlling which ports can be used on a Tor exit node to limit certain services.

Brian suggested to Jurre to share some of this information with the mailing list, especially the ones on abuse policy as they relate to the working group.

E1. Impact of rom-0 vulnerability in SOHO routers

Tomas Hlavacek, NIC.CZ, presented on the ROM vulnerability in routers, an archived copy of his presentation is available at https://ripe69.ripe.net/presentations/61-rom0-vuln.pdf

Erik Bais, A2B Internet, asked if the holders of the IP addresses found in the research were notified about the issue. Tomas explained this was not done because people were not interested and the team chose to use mass media to create awareness. Erik suggested to have a chat about this as he had experience with cleaning up botnets and mailing owners might help.

Elvis Valea, V4Escrow, asked if there was a list with vulnerable modems available. Tomas answered it is usually the cheaper brands but they would not disclose names as the manufacturers don't like that.

Elvis asked Tomas if they scanned the whole Internet. Tomas confirmed.

Heather Schiller, Google, mentioned there are other groups looking into CPE vulnerabilities and it might help to share the data with them.

Bruce van Nice, Nominum, asked if any work was done in profiling the resolvers to see which sites were abused. Tomas answered they found one doing Google and Facebook phishing.

Marco Hogewoning, RIPE NCC, asked how many abuse reports came in after scanning the entire Internet. Tomas said he received three complaints.

E3. DDoS as a service

Jair Santanna, Universiteit Twente, presented on Booters: the DDoS as a Service phenomenon. An archived copy of his presentation can be found at https://ripe69.ripe.net/presentations/115-20141105_RIPE69_jjsantanna.pdf

A member of the audience mentioned they did some investigation to Booters themselves and find out these often use commercial anti-DDoS protection services as Booters sites tend to attack themselves. He suggested to work with these companies to take the front-end offline.

Jair said it is hard to find the evidence, but when they do these sites get taken offline by their providers.

X. AOB

Brian asked for any other business. Erik Bais mentioned he had noticed that after an IP transfer abuse reports get sent to the old IP address holder and that is a clear indication that people are not using the RIR whois databases and fail to update their own information in time. He said it also takes quite an effort to de-list transferred resources with blacklist operators.

Brian asked for suggestions on how the working group can help to improve this. Erik responded that more information about transfers to the abuse community could help and offers to explain how a transfer is actually done. Another suggestion is to make it easier to prove a transfer is legitimate.

Ruediger Volk suggested looking into the data flow from the RIPE NCC who administers the transfers to the parties who collect and distribute anti-abuse information.

Elvis Valea mentions that they observed BGP hijacks taking place in the brief period a transfer takes place and the RIPE Database objects get deleted. Brian responded that they haven't discussed BGP hijacks but this is worth looking into as it might require a policy change or change the way transfers are done.

Brian Nisbet thanked the attendees for their participation and closed the session.