[anti-abuse-wg] Abuse auto responders & Legacy resources

Hi Everyone,

Just when you thought it was safe to go in the water again..[1]
(I did not expect to be posting again in 2017 :) )

Currently many people are not bothering to even monitor Abuse-C email
boxes. 

As a real world example: 163.172.0.0 - 163.172.255.255

Right now, multiple Online SAS resources (in a bot net) is
attempting to brute force web cms and there is no easy way to:

Report the abuse or Notify the resource 'owner' - effectively the
abuse-c has become useless and non relevant and it makes no difference 
that abuse-c exists as it is not monitored and means absolutely nothing.

Legacy resources do this quite often and with everything:

The argument is that new policies do not have to apply to legacy
resources as these are somehow 'special' or 'old' or not relevant to
policies.

Legacy resources are actually MORE responsible for new policies than
"new" resources. As legacy resources are OLD, outdated and not in line
with the modern, new and present issues facing the Internet as a whole.

So, my point is that as far as abuse is concerned: Policies should
target legacy resources much more directly and with much more
relevance as quite frequently, policy delinquency is directly tied
and related to mostly legacy resources.

Then, with regards the practical example: ONLINESAS-MNT's legacy range:
  
So, the choices are: drop everything from the range - firewall only the
affected port and spend our resources on tracking only the affected ip
numbers (which with the eventual advent of ipv6 will make absolutely no
sense) or simply just to dev/null everything from the entire range.

What should concern abuse admins is that practically, the simplest,
cheapest, easiest and most effective method is just to null the entire
range.

If we all start doing that, the planet will become less and less
connected, 
except through the large peers with adequate resources to actively
filter on a short term basis only the precise bot nets for that slice
of time.

ONLINESAS-MNT has configured an autoresponder that basically tells
anyone sending mail there that they have to create an account on the
company website, submit a ticket after figuring out how the web
platform works, then interact with the system etc.

Of course reporting abuse to ONLINESAS-MNT is so resource intensive,
takes so long and is so involved that it is not done.

My point is that ONLINESAS-MNT is not alone. managing abuse is a cost.
Large companies want to make money - but they want to spend as little
as possible to make that money.

They are all the same.

Avoiding a working abuse-c is a simple and easy way to cut down on your
abuse management costs.

In my opinion, this is a very bad practice and it does render the whole
abuse-c as non functional anyway.

As more and more companies figure out how they can avoid managing
abuse, with no/limited blowback, they will all probably start doing
exactly that - this will render abuse-c as pointless and futile as it
will mean nothing - and it also devalues much of what RIPE/RIR does to
ensure some sort of responsibility for maintaining functional data.

It is patently pointless to have a resource record, like abuse-c - if
it means absolutely nothing.

Andre


--
[1] Peter Benchley - JAWS 2
Just as an additional over share - I live by the ocean and yesterday
morning 
we (me and my family) swam in close proximity to some great white
sharks 
(the lifeguards then closed the beach) - beautiful creatures.