[anti-abuse-wg] 2019-04 Discussion Phase (Validation of "abuse-mailbox")

Vernon Schryver’s FUSSP is still relevant since what, 2000 or so?

--srs
________________________________
From: anti-abuse-wg <anti-abuse-wg-bounces at ripe.net> on behalf of Richard Clayton <richard at highwayman.com>
Sent: Friday, May 1, 2020 6:28:42 AM
To: anti-abuse-wg at ripe.net <anti-abuse-wg at ripe.net>
Subject: Re: [anti-abuse-wg] 2019-04 Discussion Phase (Validation of "abuse-mailbox")

In message <DB7PR10MB215431CFDAB4554CBF6F9E85D6AA0 at DB7PR10MB2154.EURPRD1
0.PROD.OUTLOOK.COM>, Elad Cohen <elad at netstyle.io> writes

>    if I will have the honor of being
>    elected to the Ripe Board I will

[...]

>    At the source BGP router, for any ip packet with a source address
>    that is from the network of the source BGP router (lets call it
>    original ip packet) - the source BGP router will create a new ip
>    packet (lets call it tracking ip packet) with a new transport layer
>    protocol and with the same source address and with the same
>    destination address and with the same IP-ID such as the original ip
>    packet.

etc

this appears to be a technically inferior adaptation of a 20 year old
proposal from Steve Bellovin

        https://academiccommons.columbia.edu/doi/10.7916/D8FF406R

it got zero traction then because it treats the issue as technical
rather a complex security economics issue. Nothing, in my view, has
changed in twenty years.

>    Automatic prventation of IoT botnet infections:
>
>    - IoT botnets are based on default credentials,

only some of them -- many exploit unpatched insecure protocol
implementations

>    Automatic prventation of botnet C&C ip addresses:
>
>    - Botnets C&C are also a problem in the internet.
>    - This problem can be overcome using the following technical
>    addition: the 5 RIR's will operate end-users honeypots machines all
>    over the world

you should keep up with my academic work on detecting honeypots (we
found around 3000)...  yes they are valuable, no they are not a panacea
(and they are mainly poorly deployed... and we also found that many were
not patched up-to-date [shoemaker's children?])

>    Very soon I will post a single solution to all the following
>    problems: (implementation is fast and easy and I'll be very happy
>    to manage the implementation in case I will be elected to the Ripe
>    Board)
>    * Spoofed ip traffic
>    * Spoofed amplification ddos attacks
>    * BGP&RIR hijacking
>    * IoT botnet infections
>    * Botnet C&Cs

I'm disappointed that you aren't solving the spam problem as well

--
Dr Richard Clayton                               <richard.clayton at cl.cam.ac.uk>
Director, Cambridge Cybercrime Centre                mobile: +44 (0)7887 794090
Computer Laboratory, University of Cambridge, CB3 0FD   tel: +44 (0)1223 763570
-------------- next part --------------
An HTML attachment was scrubbed...
URL: </ripe/mail/archives/anti-abuse-wg/attachments/20200501/e00f1e58/attachment.html>