[anti-abuse-wg] RIPE 58 Draft Minutes

Colleagues,

These are the Draft minutes from the working group session at RIPE 58.
I would appreciate if you could let us know of any inaccuracies or other
issues.

Thanks,

Brian.

*******************************

Anti-Abuse Working Minutes
RIPE 58 - Status DRAFT
Thursday, 7 May 2009, 14:00 - Krasnapolsky Hotel, Amsterdam, the Netherlands
Co-Chairs: Brian Nisbet, Richard Cox
Scribe: Fergal Cunningham
Jabber: Timothy Lowe

A. Administrative Matters
Co-Chair Brian Nisbet opened the meeting at 14:01, welcomed the
attendees and introduced Co-Chair Richard Cox.
Brian explained the microphone etiquette. He then asked if there were
any comments on the minutes from RIPE 57. There were none so he said
they were now approved.

Brian said there were no additions to the posted agenda but the
presentation from Dr. Robert Bruen would now come before the rest of the
agenda items. He then invited Dr. Bruen to give his presentation.

B1. How to Use Policy Enforcement to Stop Abuse - Dr. Robert Bruen, KnujOn

Dr. Bruen gave his presentation, which is available at:
http://www.ripe.net/ripe/meetings/ripe-58/content/presentations/knuj0n-aawg.pdf

Dr. Bruen finished his presentation and asked for questions.

Malcolm Hutty (LINX) said the Dr. Bruen did not care about individuals
in relation to privacy, but he pointed out that this was an important
concern under EU law.

Dr. Bruen responded that he was not looking to get into the privacy issue.

Malcolm said, on the Chinese characters issue, that a billion people do
not use Mandarin just to annoy the presenter and that if he wanted to
read their addresses, he should learn their script. He added that there
was no reason why they should accept having to use a Latin or ASCII
script to register a domain.

Dr. Bruen said the rules say they have to.

Malcolm said he has spent a lot of time in the regulatory area dealing
with these issues and although he rarely is on the same side as
governments but here you just have to deal with it.

Dr. Bruen said they were hiding who they were and Malcolm said only the
spammers were hiding. Malcolm added than anything that was inconvenient
to Dr. Bruen was not evidence of evil doing.

Malcolm asked if the principle of reciprocity applied in relation the
online pharmacies. He asked if Dr. Bruen was saying that an American
online business without prescription should have domain name removed if
they posted Tylenol to Dubai because it was banned there.

Dr. Bruen said this was just enforceable on US soil.
Malcolm said if others can’t sell to then US then the opposite should
apply. Dr. Bruen said he agreed with that but he couldn’t tell Dubai
what to do. He also gave the analogy that the under Dr. Bruen’s
proposals the New York Times would stand to lose its domain name because
some of it’s content is not acceptable in other countries.

Dr. Bruen said if the domain name is given out through a registrar and
through Verisign in the US then they can’t take it away.

Peter Koch (DENIC) asked Dr. Bruen if he considered the .com top-level
domain to be a US national top-level domain. He further asked if this
meant all .com registrations are subject to US local laws only.

Dr. Bruen said the New York Times is in the US and got its domain
through a US-based registry.

Peter asked if he was saying that applies to all .com domains and all
.com registrations are subject to US local laws. Dr. Bruen responded
that if they were selling things in the US, then yes.

Peter asked how a domain could sell. He asked Dr. Bruen if he was
advocating national boundaries here.

Dr. Bruen said it was all about jurisdictional issues – if you sell
illegal stuff in the US then you are subject to US laws.

Peter said the positioning of the server and the domain name are two
completely different issues.

Co-Chair Richard Cox said it was an interesting presentation. He said
the list of registrars was not a surprise and he added that he was
interested that the list was not split into registrars engaged in
illegal and anti-social activities. He added that soliciting mails were
legal but were also unacceptable. He asked Dr. Bruen if he had done any
analysis based on this split.

Dr. Bruen responded that he had not so far due to lack of resources.

Richard mentioned the ICANN accreditation agreement, which he thought
was good to look at. He said Dr. Bruen didn’t mention 3.7.7.2, which
provides you
with a takedown in 14 days for bad Whois. He said it also provides for
an instant takedown where the bad Whois is willful.

Dr. Bruen made the point that there are rules saying you can’t have a
felon running a registrar and you can’t knowingly engage in illegal
activities or allow the domain to engage in illegal behaviour.

Richard said on the specific issue of Whois accuracy, most spammers
don’t expect their domain to last 14 days anyway. He said it is worth
looking at the clause that says there can be instant takedown where
there is obvious “intent” to put a willful false Whois. He said leaving
most of the fields in a Whois entry empty or putting in meaningless
words is willful data inaccuracy. He added that under these
circumstances this could lead to instant takedown, but if bad Whois data
could lead to instant takedown then you could be sure the entry would
suddenly become very credible-looking. He said this is not progress and
when pursuing Whois data people need to be aware of that.

Dr. Bruen said it was a war of escalation.

Uwe Rasmussen (Microsoft) said he supported what Richard said and added
that it was better to have the entire accounts of spammers closed down
in case they are using one domain at a time when they have thousands.

Dr. Bruen said four years ago he spent nine months with Microsoft
gathering evidence on a Russian spam gang in America and they were
bailed out and went straight back to Russia. He said he understood the
problem and was looking at ways to improve and appreciates and help he
can get.

Uwe said it was a sensitive subject because some people wanted to
register domains and use them with friends but not necessarily the whole
world. He said EU legislation had privacy rules for businesses as well
as individuals so their details could not always be divulged. He said
this makes the whole issue of Whois information and privacy a very
difficult area of debate.

Dr. Bruen said he has yet to find a legitimate use for this privacy
protection legislation.

Aaron Kaplan (CERT) said it was an escalation issue and with the
financial flow the tipping point was not in Dr. Bruen’s favour. He added
that a greater number of solutions to the problem would be efficient,
such as following the money trail.

Dr. Bruen said one has shut down as much spam as they have.

Brian thanked Dr. Bruen for his presentation and asked to move on with
the agenda.

B2. Botnets and Badguys - Community Response

Co-Chair Richard Cox explained that he was unable to attend the last two
RIPE Meetings but said he was in regular contact with his Co-Chair. He
then gave a talk on botnets and bad guys on behalf of Spamhaus.

He explained that he considered “bad guys” not to be just the criminals
but also those who flood in-boxes with junk email, which can be legal if
you do certain things.

He explained the snowshoe technique that is currently being used,
whereby spammers spread their activity across a wide area of the
Internet. The technique sees a /23 or /24 rotated at numerous hosting
providers across the US and more recently in Europe. Customers of ISPs
may say they had a spammer on their block but it is the customer who is
the spammer. The block will go quiet and when attention falls off they
will use it again. He said at the end of the day the ISPs have the IP
addresses so it is the ISPs that will ultimately suffer.

Richard then moved on to botnets, noting that a lot of them were doing
spam and worse, which is why there was now an Anti-Abuse Working Group
instead of an Anti-Spam Working Group. He spoke about the high-profile
Conficker botnet, explaining versions A and B before moving on to the
version C. He said Conficker C has domains in all the well-known
top-level domains. He said the obvious solution is to get the registrar
to refuse registration of those domains. He said this has been fairly
successful in top-level domains but it is more difficult with country
code domains.

He said Conficker D would probably carry the main payloads. He sees
their plan as to examine Conficker C to see which registrars and
top-level domains will block registration, so as a community we need to
share with each other in order to protect against this type of activity.
He said Conficker was a major threat to the usability of the Internet.

He went on to talk about the latest problem being encountered,
particularly for the RIPE community, of hosting by means of a fake
entity, setting up an ASN and asking for IP ranges while using
completely bogus information. He said the entity that checks the
information is the LIR, which may be located in the same country and
subjected to local pressures. He also said the bogus entity can be an
LIR, which brings them into contact with the RIPE NCC. He said RIPE is
exposing itself as a friend to bad guys by not having central validation
of the holders of ASNs and IP address space. He said APNIC and ARIN have
central validation so they know exactly who the space is going to, but
RIPE does not have this.

Richard concluded and opened the floor for questions.

Richard Barnes (BBN) said it was a good idea for the RIPE NCC and the
other RIRs to have contact with these bad guys, but he asked if there
was a scalable approach to doing this.

Richard Cox said scalability was always an issue and the bad guys will
always find countermeasures for whatever we do. He said we should be
aware of the problem and there should at least be a physical mail flow
between an RIR and an entity that uses its services.

Aaron Kaplan said that the updates from Conficker B to C happened
without domain names. He added that with a smart botnet like Conficker
uses multiple approaches and the domain route is just one way it can
communicate so all options should be considered.

Richard agreed that this was a key point.

Dr. Bruen mentioned sending mail through the post to a network that was
deaccredited by ICANN. He said the fact that there was no postal address
was useful in building evidence so sending mail through the post to
these people can be quite helpful in that regard.
Richard agreed that it was helpful in a country where you could rely on
the postal service.

Dmitry Kohmanyuk (.ua) agreed that if you send mail to the Ukraine there
may be problems, and he added that it is just as easy to fake a postal
address as an email address. He said on the Conficker front they blocked
all the Conficker B domains on the registry level. He said the switch to
Conficker C leaves no way to prepopulate the registry because the names
are no longer known in advance. He said in relation to RIPE registering
AS for unknown parties, when an LIR does too many of these bad
registrations, say more than 3 percent, the LIR should be removed.

Max Tulyev (NetAssist) said mandatory postal mail would delay the
registration process and give no real opportunity to detect the spammers.

Richard said APNIC and ARIN don’t use LIRs because they know the risks
in this. He gave the example of Nominet in the UK sending a capture code
by mail.
He said there are problems with this but if a crime has been committed
then law enforcement can go to the address the mail was posted to, so
this provides some sort of audit trail.

Brian mentioned that the subject of postal mail was discussed
sufficiently and the Working Group was aware of the issue. He suggested
moving on with the discussion.

Uwe Rasmussen if we needed to exercise more control on the people that
obtain ASNs or IP address space or if the dynamics of it should be
changed. He suggested an approach whereby the IPs obtained by ghost or
phantom ISPs or bulletproof ISP can be closed so quickly that it is not
interesting for them any more. He said it would take them a week to
receive the IP addresses but they could be shut down in 24 hours if they
were used for illegal activity.

Richard said this was a very reasonable suggestion but there is also the
issue of how far one can intrude to protect the integrity of the
Internet. He added that the current situation is unacceptable and we
should look to put more pressure on the bad guys while trying not to
interfere with the good guys.

Matt Ford (ISOC) complimented Richard’s presentation and said it was
imperative that the community act to implement measures as soon as
possible because the threat posed by a degraded network and the
incentives for other parties to step in and tell the community how to
run the network were too great to do otherwise.

Richard thanked Matt and asked to take what he said here to use in
another presentation he would give. He said it was impossible to get
everything perfect but the community can do better through greater
communication and through sharing ideas and working together.

Filiz Yilmaz (RIPE NCC Policy Development Manager) made a clarification
on the effect of having different mechanisms among the RIRs and whether
they had LIR structures or not. She said the RIPE NCC membership might
understand some terms differently from people in other RIR regions. She
said the assignment window mechanism in the RIPE NCC service region
allowed LIRs some freedom to make assignments without RIPE NCC approval.
She said this means the RIPE NCC doesn’t see those requests as approval
requests. She said AfriNIC has an LIR system but not that assignment window.

Richard thanked Filiz and made the point that AfriNIC assigned a /20to
an entity that does not exist and it has not revoked the block even
though they have been informed. He said APNIC had previously had
problems with Whois accuracy but he does not see any problems there now.
He said the only RIRs where he saw problems were the RIPE NCC and LACNIC.

Brian thanked Richard for sharing a vast amount of knowledge.

C. Documents
•    C1. Updates to ripe-409
•    C2. Creation of New Documentation?

Brian said the rest of the agenda items would all be rolled into one
item from here.

Brian said there have been requests recently and discussions on the
mailing list asking why more things are not being done to stop these bad
guys, but in order for something to be done there needs to be a policy
formed that the rest of the community can give its feedback on.

He said that both he and Richard were looking to see in cooperation with
other working groups whether a policy could be put in place to improve
the situation.

He said there is often discussion on the mailing list but whenever there
is a call to form a policy, things go quiet. He said the co-chairs along
with the RIPE NCC staff were available to help formulate a policy
proposal document around anyone’s thoughts and wishes and this could
then be put to the community for feedback.

He said that part of all this is the intention to update the ripe 409
document, which is a BCP document on how to deal with spamming, and
changing it into a document that deals with a much wider amount of
network abuse. He said if there is anyone out there who wishes to help
with this then they should please let himself or Richard know.

Kostas Zorbadelos (OTE SA) said on the subject of BCP documents it would
be great to one that describes specific technical measures that ISPs can
use to help their situation. He said ripe 409 was a bit too high level
for this and he would like an arsenal of measures available to him that
he can use to attack the problems.

Brian said the minutes of this working group session would be published
to the list as soon as possible. He said they would also work with the
community to put in place a high level BCP document, a more technical
BCP document and work to see if there were specific policies that could
be proposed. He said himself and his co-chair would not be in a position
to do all this by themselves so there would also be a request for help
on the list. He said they would endeavour to get as much work done in
this regard by RIPE 59.

Richard said they would also need help from community members such as
Kostas to determine what the laws were in individual countries in the
RIPE region because a proposed measure might not be legal under the laws
of some countries. He asked the community to let the co-chairs know
about these laws so then they can go to governments and let them know
their laws are causing problems.

X. A.O.B.

There was no other business and Brian adjourned the working group
session at 15:35.