- NANOG - lists.nanog.org

Re: Abuse procedures... Reality Checks
by Scott Weeks 11 Apr '07

11 Apr '07

--- rsk(a)gsp.org wrote: On Wed, Apr 11, 2007 at 03:44:01PM -0400, Warren Kumari wrote: > The same thing happens with things like abuse -- it is easy to deal > with abuse on a small scale. It is somewhat harder on a medium scale > and harder still on a large scale -- the progression from small to > medium to large is close to linear. : First, I don't buy this. I think dealing with abuse is *much* : easier for large operations than small. The original email I sent was about *how* you deal with it. J. Oquendo vociferously defended his position when he finally got around to saying, "...if someone cannot get out somewhere, they're obviously going to get in touch with me as to why. Once this is done, it is explained [...] I've always contacted someone [...] after about 3 attempts at getting someone to assess their network..." I said this doesn't scale even to hundreds of thousands of customers much less higher numbers. There are definitely scaling issues with this method of dealing with abuse. You can't just hire more phone monkeys linearly to the number of customers you have. <snip> : Second, I don't really care how hard it is. It's YOUR network, YOU : built it, YOU plugged it into our Internet: therefore, however hard : it is, it's YOUR problem. Fix it. Not always. I have inherited various networks over the years that were already built by folks that didn't care. You do the best you can to get it to as good a network as possible, but you never completely reach the goal of "good". Additionally, upper management gives or takes away manpower many times without the understanding of what 'should' be done to be a good netizen and this defines how much effort can be spent on fixing the problems. The only thing a person can really do is quit and move on. That's not always an option. There're very few interesting-to-operate networks here in Hawaii. So, you focus on the top priorities: keeping the current customers and getting more by operating the network in as efficient a manner as possible. Myself, I work outside business hours to try to be a good guy, fix stuff and serve the Hawaiian community in an altruistic manner, but there's only so much stuff one person can do. <snip> scott

1 0

Re: Abuse procedures... Reality Checks
by Scott Weeks 11 Apr '07

11 Apr '07

: if someone cannot get out somewhere, they're obviously : going to get in touch with me as to why. Once this is : done, it is explained : I've always contacted someone : after about 3 attempts at getting someone to assess : their network I know from experience this doesn't scale into the hundreds of thousands of customers and can only imagine the big ass eyeball network's scalability issues... scott --- sil(a)infiltrated.net wrote: From: "J. Oquendo" <sil(a)infiltrated.net> To: nanog(a)merit.edu Cc: Warren Kumari <warren(a)kumari.net> Subject: Re: Abuse procedures... Reality Checks Date: Wed, 11 Apr 2007 13:49:40 -0400 Warren Kumari wrote: > > So, I have always wondered -- how do you customers really react when > they can no longer reach www.example.com, a site hosted a few IPs away > from www.badevilphisher.net? And do you really think that you blocking > them is going to make example.com contact their provider to get things > fixed? > You confused two things. 1) I do my best to stop malicious traffic from leaving my network. With this said, if someone cannot get out somewhere, they're obviously going to get in touch with me as to why. Once this is done, it is explained to them that either their machine, or a machine on their network was doing something fuzzy therefore they were blocked. Most are actually thankful that it was pointed out to them as opposed to having to wait for Security Company X to update its virus/spamware definitions. 2) I do not block getting TO company X at first signs of garbage coming into my network from them. I've always contacted someone to some degree so don't misconstrue my actions as "I block the first packets I see." On the contrary I only block CIDR's after about 3 attempts at getting someone to assess their network. After that, I begin with services. This is my network so this is how it pans out... Spam? A CIDR to my email ports are blocked. SSH brute forcing, etc., those ports are blocked. Network who's blocked on ports continues, everything is then blocked. > > Have you considered that being a little politer and not insulting > everyone on the list might be a more constructive way of getting your > point across -- if I were to call you a "big, fat, doodoo head" you > would probably be less receptive than if I didn't... > What does being polite and "matter of factly" have to do with administrators cleaning up their networks? Should I beg an administrator of some network to be polite and not refer me to their generic abuse desk who'll do nothing about the issue? I actually am a little too polite in the fact that 1) I'm doing network operators a favor pointing them out to rogue hosts on THEIR networks not mines. If they want to continue hosting said rogue idiots, their problem. I won't be allowing it into my range. If you knew me personally, or have dealt with me, I can guarantee you within minutes of you contacting me for something I would be on it. I as an admin/engineer whatever you want to call me would want to make sure that nothing internal to me is affecting anyone else since it is likely to make things more difficult for me if left unchecked. So on issues of politeness, I am being polite contacting people. I'm being double polite posting evil doing networks on my personal site so others can be aware that "These networks are infected. Here are there hosts if you want to block them." I do this on my own spare time, my own expense, and my own filtering of the denials of service that ensue when some botnet reject sees me post a percentage of his botnet. So please don't my messages as anything other than "Hey... When is someone going to deal with this?" frustration targeted at those with the power to do actually something about it instead of waiting for someone else to take the first move. Analogy: You live in a house and sweep your property. Your neighbors don't. Would you stop sweeping your house? Would you keep your house dirty simply because the majority around you do? I'm sure if you convinced the most visible neighbor to make a change, the others would follow suit. Heck in some areas those neighbors who didn't comply would face fines after some point. Why not bring this chain of thought to a network you maintain/manage. As for documentation on this... There is PLENTY of it. Why should I write another document no one would follow. If some can't follow normal standards set by governmental bodies (for lack of better terms), what makes you think someone would say "Gee... That Oquendo sure wrote a nice document... Let me follow it" How about following standards and using good old fashioned common sense. -- ==================================================== J. Oquendo http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x1383A743 sil . infiltrated @ net http://www.infiltrated.net The happiness of society is the end of government. John Adams

4 3

RE: Abuse procedures... Reality Checks
by Azinger, Marla 11 Apr '07

11 Apr '07

I have to disagree. SWIP is not meaningless. In my company some functions related to sending a SWIP are automated, but my company has people on staff who know that it is happening and what it means. And I talk with plenty of other companies that fall into the same boat. In short I find this one comment below to be argumentive and full of conjecture. Regards Marla Azinger Frontier Communications -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of michael.dillon(a)bt.com Sent: Monday, April 09, 2007 1:39 PM To: nanog(a)merit.edu Subject: RE: Abuse procedures... Reality Checks > I would have to respectfully disagree with you. When network > operators do due diligence and SWIP their sub-allocations, they > (the sub-allocations) should be authoritative in regards to things > like RBLs. How do you tell when they have actually done "due diligence". Existence of a SWIP record is essentially meaningless in this day and age. Many people do them automatically and there may well be nobody left on staff who knows that this is happening or what it all means. --Michael Dillon

8 13

RE: Abuse procedures... Reality Checks
by Frank Bulk 11 Apr '07

11 Apr '07

Comcast is known to emit lots of abuse -- are you blocking all their networks today? Frank -----Original Message----- From: Frank Bulk Sent: Tuesday, April 10, 2007 7:43 AM To: nanog(a)merit.edu Subject: Re: Abuse procedures... Reality Checks On Sat, Apr 07, 2007 at 09:50:34PM +0000, Fergie wrote: > I would have to respectfully disagree with you. When network > operators do due diligence and SWIP their sub-allocations, they > (the sub-allocations) should be authoritative in regards to things > like RBLs. After thinking it over: I partly-to-mostly agree. In principal, yes. In practice, however, [some] negligent network operators have built such long and pervasive track records of large-scale abuse that their allocations can be classified into two categories: 1. Those that have emitted lots of abuse. 2. Those that are going to emit lots of abuse. In such cases, I'm not inclined to wait for (2) to become reality. ---Rsk

2 1

New RIPE NCC IPv4 blocks pingable addresses
by Alex Le Heux 10 Apr '07

10 Apr '07

[Apologies for duplicate emails] Dear Colleages, The IANA recently allocated the IPv4 address ranges 92/8 and 93/8 to the RIPE NCC. The following pingable addresses are now available in these blocks: 92.192.0.1 92.255.248.1 93.192.0.1 93.255.248.1 More information regarding the debogonising project can be found here: http://www.ris.ripe.net/debogon/ Best regards, Alex Le Heux RIPE NCC IP Resource Analyst

2 1

RE: Abuse procedures... Reality Checks
by Frank Bulk 10 Apr '07

10 Apr '07

> On Sat, Apr 07, 2007 at 02:31:25PM -0500, Frank Bulk wrote: > > I understand your frustration and appreciate your efforts to contact the > > sources of abuse, but why indiscriminately block a larger range of IPs than > > what is necessary? > > 1. There's nothing "indiscriminate" about it. > > I often block /24's and larger because I'm holding the > *network* operators responsible for what comes out of > their operation. Define network operator: the AS holder for that space or the operator of that smaller-than-slash-24 sub-block? If the problem consistently comes from /29 why not just leave the block in and be done with it? I guess this begs the question: Is it best to block with a /32, /24, or some other range? Sounds a lot like throwing something against the wall and seeing what sticks. Or vigilantism. > If they can't hold the outbound abuse down to a minimum, then > I guess I'll have to make up for their negligence on my end. Sure, block that /29, but why block the /24, /20, or even /8? Perhaps your (understandable) frustration is preventing you from agreeing with me on this specific case. Because what you usually see is an IP from a /20 or larger and the network operators aren't dealing with it. In the example I gave it's really the smaller /29 that's the culprit, it sounds like you want to punish a larger group, perhaps as large as an AS, for the fault of smaller network. > I don't care why it happens -- they should have thought through > all this BEFORE plugging themselves in and planned accordingly. > ("Never build something you can't control.") Agreed. > > Neither I nor J. Oquendo nor anyone else are required to > spend our time, our money, and our resources figuring out which > parts of X's network can be trusted and which can't. It's not that hard, the ARIN records are easy to look up. Figuring out that network operator has a /8 that you want to block based on 3 or 4 IPs in their range requires just as much work. > It is entirely X's responsibility to make sure that its _entire_ > network can be permitted the privilege of access to ours. > And (while I don't wish to speak for anyone else), > I think we're prepared to live with a certain amount of low-level, > transient, isolated noise. Noise like that is inevitable part of the job. > We are not prepared to live with persistent, systemic attacks > that are not dealt with even *after* complaints are > filed. (Which shouldn't be necessary anyway: if we can see inbound > hostile traffic to our networks, surely X can see it outbound from > theirs. Unless X is too stupid, cheap or lazy to look. Packets do > not just fall out of the sky, y'know?) Smaller operators, like those that require just a /29, often don't have that infrastructure. Those costs, as I'm sure you aware, are passed on to companies like yourself that have to maintain their own network's security. Again, block them, I say, just don't swallow others up in the process. > 2. "necessary" is a relative term. > > Example: I observed spam/spam attempts from 3,599 hosts on > pldt's network during January alone. I've blocked > everything they have, because I find it *necessary* > to not wait for the other N hosts on their network > to pull the same stunt. I've found it *necessary* to take > many other similar measures as well because my time, > money and resources are limited quantities, so I must > expend them frugally while still protecting the operation > from overtly hostile networks. That's my point: you want to spend time dealing with the other 8 networks because you blacked them, out, too? > That requires pro-active measures and it requires ones > that have been proven to be effective. > > If X, for some value of X, is unhappy about this, then X should have > thought of that before permitting large amounts of abuse to escape > its operation over an extended period of time. Had X done its job > to a baseline level of professionalism, then this issue would not > have arisen, and we'd all be better off for it. Agreed, but economics usually dictate otherwise. > So. If you (generic you) can't keep your network from being > a persistent and systemic abuse source, then unplug it. Now. They want to run a business, too. So when you blacklist they will end up calling you asking for mercy, telling you that it's been cleaned up. Inevitably something/someone gets infected, you black them out, rinse, repeat. > If on other hand, you decide to stick around anyway while letting the > crap flow: no whining when other people find it necessary to > take steps to defend themselves from your incompetence. > > ---Rsk

7 7

4 Byte AS deployment
by Jac Kloots 10 Apr '07

10 Apr '07

FYI: SURFnet has setup a 4 byte AS using Quagga and is currently announcing 2 prefixes originating from AS3.5 IPv4: 145.125.0.0/20 (Worldwide visible) http://www.ris.ripe.net/cgi-bin/lg/index.cgi?rrc=RRC001&query=12&arg=%5C.5 IPv6: 2001:610:160::/48 (Only visible to the RIPE RIS project and is part of a full feed from AS3.5) http://www.ris.ripe.net/cgi-bin/lg/index.cgi?rrc=RRC001&query=16&arg=2001%3… I guess this IPv6 prefix is the first prefix announced from a 4byte AS. Regards, Jac -- Jac Kloots Network Services SURFnet bv The Netherlands

1 0

RE: Abuse procedures... Reality Checks
by Robert Bonomi 09 Apr '07

09 Apr '07

> From: "Frank Bulk" <frnkblk(a)iname.com> > Subject: RE: Abuse procedures... Reality Checks > Date: Sat, 7 Apr 2007 16:20:59 -0500 > > > If they can't hold the outbound abuse down to a minimum, then > > I guess I'll have to make up for their negligence on my end. > > Sure, block that /29, but why block the /24, /20, or even /8? Perhaps your > (understandable) frustration is preventing you from agreeing with me on this > specific case. Because what you usually see is an IP from a /20 or larger > and the network operators aren't dealing with it. In the example I gave > it's really the smaller /29 that's the culprit, it sounds like you want to > punish a larger group, perhaps as large as an AS, for the fault of smaller > network. BLUNT QUESTIONS: *WHO* pays me to figure out 'which parts' of a provider's network are riddled with problems and 'which parts' are _not_? *WHO* pays me to do the research to find out where the end-user boundaries are? *WHY* should _I_ have to do that work -- If the 'upstream provider' is incapable of keeping _their_own_house_ clean, why should I spend the time trying to figure out which of their customers are 'bad guys' and which are not? A provider *IS* responsible for the 'customers it _keeps_'. And, unfortunately, a customer is 'tarred by the brush' of the reputation of it's provider. > Smaller operators, like those that require just a /29, often don't have that > infrastructure. Those costs, as I'm sure you aware, are passed on to > companies like yourself that have to maintain their own network's security. > Again, block them, I say, just don't swallow others up in the process. If the _UPSTREAM_ of that 'small operator' cannot 'police' its own customers, Why should _I_ absorb the costs that _they_ are unwilling to internalize? If they want to sell 'cheap' service, but not 'doing what is necessary', I see no reason to 'facilitate' their cut-rate operations. Those who buy service from such a provider, 'based on cost', *deserve* what they get, when their service "doesn't work as well" as that provided by the full-price competition. _YOUR_ connectivity is only as good as the 'reputation' of whomever it is that you buy connectivity from. You might want to consider _why_ the provider *keeps* that 'offensive' customer. There would seem to be only a few possible explanations: (1) they are 'asleep at the switch', (2) that customer pays enough that they can 'afford' to have multiple other customers who are 'dis-satisfied', or who may even leave that provider, (3) they aren't willing to 'spend the money' to run a clean operation. (_None_ of those seems like a good reason for _me_ to spend extra money 'on behalf of' _their_ clients.)

16 19

RE: Abuse procedures... Reality Checks
by Frank Bulk 09 Apr '07

09 Apr '07

The managed services they currently offer don't include egress filtering (L3 to L7) on their business customer's networks. >From the discussion here it sounds like that naked pipes, even if properly SWIPed, ought not to be sold, but that all traffic should be checked on the way out. It sounds like a good idea, but I'm guessing few network operators do that for their customer networks, whether that's due to lack of centralization or cost. Frank -----Original Message----- From: Frank Bulk Sent: Monday, April 09, 2007 3:49 PM To: 'nanog(a)merit.edu' Subject: RE: Abuse procedures... Reality Checks > If they're properly SWIPed why punish the ISP for networks > they don't even > operate, that obviously belong to their business customers? How can you tell that they don't operate a network from SWIP records? Seems to me that lots of network operators sell "managed services" to businesses which means that the network operator is the one operating the business customers' networks. Let's face it, the whole SWIP system and whois directory concept was poorly implemented way back in the 1980s and it is completely inadequate on an Internet that is thousands of times larger than it was when SWIP and whois were first developed. How many of you were aware that whois was originally intended to record all users of the ARPAnet from each site so that networking departments could justify the funds they were spending on high-speed 56k frame relay links? --Michael Dillon

1 0

Re: Abuse procedures... Reality Checks
by J. Oquendo 09 Apr '07

09 Apr '07

Pete Templin wrote: > > John R Levine wrote: > >> I don't have PI space, but I do have a competent ISP so I've never >> had any >> mail problems due to adjacent addresses. > > Having a competent ISP isn't a guarantee of exemption...only a > contributor. As evidenced by the discussion, some people choose the > scope of their wrath arbitrarily. > > pt > Frank Bulk wrote: > Sounds a lot like throwing something against the wall and > seeing what sticks. Or vigilantism. Vigilatism would be me causing offender's router to flap out of existence. Matthew Black wrote: > Um, with that reasoning, why not just block the whole /0 and > be done with it? Why should filtering on this level have to be done. Why not prevent one's own users from sending out bad traffic. I can see why large provider would have an issue with this, but how about using IDS' on the way out as well. This way not one machine on your network can harm another machine on your own for starters, and someone elses. Sound too Zen. > Why not get yourself some sort of IDS/IPS > system or fully firewall your hosts. What happens when this isn't an option. What do you do when managing networks on budgets that didn't call for extra equipment. Should I let a network of mine get compromised for the sake of not having enough in the budget, or should I explain to the client after the compromise, "well you really didn't give me enough money." That will sure teach him a thing or two about technology they 1) don't care about 2) won't understand no matter how much its explained. Maybe I can repeat this to myself while I file unemployment papers. > If you have a spam problem, get an e-mail security > appliance which uses reputation filtering to reject > connections? And for those clients whose budgets constraints prevented this? Should I a) allow them to receive thousands of Viagra messages b) allow their logfiles to fill with thousands of entries and false positives on SSH attacks c) allow viruses and worms to make my job more difficult. I never stated my solution was a "best practice". I stated what I've been doing and strangely its been effective for me. Yes I do have to answer to clients on why THEIR clients, friends, etc have their providers blocked, and after it is explained to them along with logfiles to support my blocks, my clients are right behind me in blocking ranges. To me it isn't the automated blocking isn't that hard to do, that's what shell scripting is for and I have no problems blocking huge blocks (/8's) if need be. As I stated, if I can take the time to make sure nothing malicious is leaving my networks - which altogether is now comprised of about a /16 if I added all ranges up - then why can't some of these other networks do the same. Especially the ones who can actually afford to go out and drop a couple of thousand, even hundreds of thousands on so called security products. If I can do it via ACL's, Linux boxes, syslog, etc., without incurring more costs to my clients, surely some of you bigger cats can do the same. I look at is a bad policy, laziness, and lack of a clue or two. And I sincerely mean this in the utmost non-disrespectful logical - call it how I see it manner. No reason to have filth leaving your network. If it does its because of bureaucratic BS (policies), lack of how to administrate a network correctly or laziness. Maybe my next step will be to post some of the emails from admins who were contacted and responded with the same old "Oh our abuse desk is right now it." Or some other generic crap, all the while my net is getting hit up. Or to re-state the strangeness coming from a response from a CISSP in NASA: "We were doing test on our network which is why your machine was getting bruteforced..." Oh really? On a side note, kudos to those who do take the time to respond, and to those who actually take a minute or two to digest it all in after I've rambled on for too long... Next thread anyone ;) -- ==================================================== J. Oquendo http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x1383A743 sil . infiltrated @ net http://www.infiltrated.net The happiness of society is the end of government. John Adams * J. Oquendo <sil(a)infiltrated.net>

1 0