[anti-abuse-wg] Draft Anti-Abuse Working Group Minutes - RIPE 60

Richard Cox wrote:

 > RIPE has no role to punish network abusers.  RIPE should have a role
 > to take appropriate action against those who abuse RIPE's resources.
 > That would include providing false identity or configuration details
 > in connection with a request for network resources.  Those are the
 > cases where revocation of those resources is needed - and of course
 > the routing data would then have to be removed as a result.

And there we are again.

If we do not extend RIPEs responsibility and the RIPE regulations
so that the members are responsible for using RIPE resources
without abuse and RIPE NCC has therefor no responsibility to monitor
abuse, there will be no revocation.

And because we will never have a definition of abuse, there
will be no change in the regulations and no demand to RIPE NCC
handle this.

Conclusion: because RIPEs members are not willing to
take responsibility and abuse will continue forever.

And we only can work here to make protection easier
for those, who want to do something for themselv.
But thats only a cure, not a solution ...

 > What is worth bearing in mind is that a revoked allocation should show
 > up in IP-WHOIS as REVOKED for a given period of time after revocation.
 > Otherwise we get the vexing situation where an abuser asks an ISP to
 > route his IP block and tells the ISP, when they check RIPE's WHOIS and
 > see "not found", "Oh dear, looks like the RIPE database isn't working.
 >
 > "Revoked" must be clearly visible.  For example, nobody really knows

Good idea.

 > why AS43074 and 193.109.246.0/23 are no longer in the RIPE database.
 > But AS43074 (announcing 193.109.246.0/23) is being routed by STARNET

Well, thats clearly a mistake of STARNET then.
You should talk to them, if STARNET is one of your upstream providers.
The should really filter there routes against route objects.

None, of our upstream providers does route this network.

 > in Moldova and bringing you all the lovely Zeus malware and similar.
 >
 >    Network          Next Hop      Path
 > *> 193.109.246.0/23 208.74.64.40  3257 31252 43074 i
 >
 > Unfortunately removing rDNS etc won't stop that malware spreading.

True, but revocation of route objects does.


Kind regards, Frank
--
PHADE Software - PowerWeb                       http://www.powerweb.de
Inh. Dipl.-Inform. Frank Gadegast             mailto:frank at powerweb.de
Schinkelstrasse 17                                fon: +49 33200 52920
14558 Nuthetal OT Rehbruecke, Germany             fax: +49 33200 52921
======================================================================
Public PGP Key available for frank at powerweb.de