Hello, On Tue, Jan 15, 2013 at 7:31 AM, Eugeniu Patrascu <eugen@imacandi.net> wrote:

On Tue, Jan 15, 2013 at 12:49 AM, Ronald F. Guilmette <rfg@tristatelogic.com> wrote:

...

After a careful investigation, I am of the opinion that each of the following 18 ASNs was registered (via RIPE) with fradulent information purporting to represent the identity of the true registrant, and that in fact, all 18 of these ASNs were registered by a single party, apparently as part of a larger scheme to provide IP space to various snowshoe spammers.

As this email is regarding actions in Europe by RIPE, you may get a better response from contacts in the RIPE region. I notice that you have been cross posting this message (though not responding on list to replies), for example to the RIPE NCC Anti-Abuse Working Group (http://www.ripe.net/ripe/groups/wg/anti-abuse) - a great place to start. Although you have already been told this elsewhere, your best step after contacting the Romanian CIRT is likely to be following the reporting procedure for the provision of untruthful information to the RIPE NCC at http://www.ripe.net/contact/reporting-procedure, which is a well defined procedure. RIPE NCC will investigate any report submitted though this procedure; there is a flowchart at this web address that clearly explains what will happen. If you ever need to find the contact details for a European CSIRT, the centralised "Trusted Introducer" is normally the place to start. Their website can be found at https://www.trusted-introducer.org. As this list is the North America Network Operators Group, it's unlikely that much in they way of action by RIPE NCC, Romanian authorities or other relevant authorities within the EU will happen as a result of a post here. I hope this helps get you in touch with the right people to help. Best wishes, Alex

Hi,

...

is likely to be following the reporting procedure for the provision of untruthful information to the RIPE NCC at http://www.ripe.net/contact/reporting-procedure, which is a well defined procedure. RIPE NCC will investigate any report submitted though this procedure; there is a flowchart at this web address that clearly explains what will happen.

See above. I have done a great deal of work on this already. I leave it to other interested parties to file wharever additional reports they might feel are warranted or appropriate.

Sorry, but you post this information on public mailing lists where it can be discussed but where no action can be taken, and then refuse to post it to the single organisation that actually *can* do something with it? Nobody else will take your research and submit it to a third party. It's your research: either you submit it to the RIPE NCC and action will be taken where appropriate, or you don't and then your research will be forgotten and nothing will be done... It's just one form to fill in. Thanks, Sander

Hi,

I'm having more than a little deja vu here - Romanian LIRs have come up on this list (leave alone nanog, or various other RIPE lists) more than once in this context. In fact

Yes, but like I said: talk on lists is not enough

There is an apparent pattern of large scale misuse of resources here, with a complex reporting procedure that puts the onus on the complainant to perform validation

Filling in one web form is a complex reporting procedure? The form only contains: - the reason (probably "Violation of RIPE Policies and RIPE NCC Procedures" or "Provision of untruthful information to the RIPE NCC") - one of the relevant resources (can be an address, ASN or organisation object from the RIPE database) "In order to identify the natural or legal person responsible". - a text field where you can copy&paste your report - your contact details - one checkbox "I confirm that the information I provide is correct and to the best of my knowledge" - one checkbox "I allow the RIPE NCC to forward my report and attachments to the party the report is about." - a captcha They add a note that your contact details will never be shared with a third party, only the content of your report. They also provide a nice flowchart that shows how they will handle the report, which basically comes down to: Report-submitted -> report-accepted -> start-investigation. I really can't see how this is a "complex reporting procedure that puts the onus on the complainant to perform validation". They don't ask for validation, only that you provide correct information on which they can base their investigation.

that, given complaints of a widespread problem, RIPE staff is much better qualified (not to mention, paid for their time) to do themselves, on a proactive basis.

They do proactive audits and they do verification/validation of the information people write in the reports. They will take action on complaints of a widespread problem. They just need the proper information through the official channels, which in this case is a not-so-complicated web form... Cheers, Sander

On Tue, Jan 15, 2013 at 11:36:04PM +0100, Sander Steffann wrote:

Sorry, but you post this information on public mailing lists where it can be discussed but where no action can be taken [...]

That's not exactly correct. Lots of people on this list are perfectly capable of taking a variety of actions (based on this information) should they choose to do so. I have. I do not understand why you're so adamant about sending this information to an organization primarily distinguished by its incompetence and negligence. If they were actually DOING THEIR JOBS in even minimally diligent fashion, then Ron wouldn't needed to write that note or do the research behind it, because this wouldn't be happening. ---rsk

On Wed, Jan 16, 2013 at 10:07:40AM -0500, Todd Underwood wrote:

no one seriously believes that the RIPE NCC (which is managed by all of its members) is primarily distinguished by their incompetence and negligence.

Really? Then why, pray tell, haven't they made it a practice to routinely (let's say, once a month) ask the people over at Spamhaus: "Hey folks, do you see anything wonky in the space we manage?" and then act immediately and decisively on what they get back for an answer? I don't want to speak for Spamhaus, but I suspect that they would be delighted to provide that response, particularly if it led to swift and effective action to make the problem(s) go away. And while I don't always agree with their positions, I've *rarely* found mistakes in their research: they're thorough. (So's Ron, by the way.) This isn't complicated. This isn't expensive. This doesn't require new technology or anything fancy. It's basic due diligence. Yet it clearly hasn't happened. Why the hell not? We live in a time when abuse is epidemic. It's costing us a fortune, and I don't just mean in financial terms, although certainly that's bad enough all by itself. But it doesn't just magically fall out of the sky and land on our servers or routers, or at port 25 on our mail servers. It comes from *somewhere*, and it does so on *somebody's* watch. And when it does so on a chronic and systemic basis, surely it is reasonable to ask questions like "Why, if we can so clearly see it arriving at our operation, can they not see it leaving theirs?" or "Why aren't people paying attention to the primary/most useful sources of information about their own operations?" So it's (well past) time to stop giving people a pass for looking the other way or failing to look at all. It's my, your, and everyone's professional responsibility to do everything we possibly can to prevent the networks, hosts, and resources we run from being part of the problem. So yeah: "incompetence" and "negligence" are the best words I can find to describe failure to do that. What would you call it? ---rsk

On Wed, Jan 16, 2013 at 10:54 AM, Rich Kulawiec <rsk@gsp.org> wrote:

On Wed, Jan 16, 2013 at 10:07:40AM -0500, Todd Underwood wrote:

...

no one seriously believes that the RIPE NCC (which is managed by all of its members) is primarily distinguished by their incompetence and negligence.

Really? Then why, pray tell, haven't they made it a practice to routinely (let's say, once a month) ask the people over at Spamhaus: "Hey folks, do you see anything wonky in the space we manage?" and then act immediately and decisively on what they get back for an answer?

I don't want to speak for Spamhaus, but I suspect that they would be delighted to provide that response, particularly if it led to swift and effective action to make the problem(s) go away. And while I don't always agree with their positions, I've *rarely* found mistakes in their research: they're thorough. (So's Ron, by the way.)

This isn't complicated. This isn't expensive. This doesn't require new technology or anything fancy. It's basic due diligence. Yet it clearly hasn't happened. Why the hell not?

Hi Rich, Since this is NANOG, not a forum which represents Internet activities on the Continent, perhaps a better set of questions would be: 1. Has SPAMHAUS attempted to feed relevant portions of their knowledge into ARIN's reporting system for fraudulent registrations and, 2. Understanding that ARIN can only deal with fraudulent registrations, not any other kind of bad-actor behavior, are there improvements to ARIN's process which would help SPAMHAUS and similar organizations feed ARIN actionable knowledge? Regards, Bill Herrin -- William D. Herrin ................ herrin@dirtside.com bill@herrin.us 3005 Crane Dr. ...................... Web: <http://bill.herrin.us/> Falls Church, VA 22042-3004

On Wed, Jan 16, 2013 at 11:39:14AM -0500, William Herrin wrote:

1. Has SPAMHAUS attempted to feed relevant portions of their knowledge into ARIN's reporting system for fraudulent registrations and,

I don't know the answer to that.

2. Understanding that ARIN can only deal with fraudulent registrations, not any other kind of bad-actor behavior, are there improvements to ARIN's process which would help SPAMHAUS and similar organizations feed ARIN actionable knowledge?

Yes. All ARIN (public) data should be immediately downloadable in bulk by anyone who wishes to access it. No registration, no limits, no nothing. As I pointed out here a couple of weeks ago (see below), query rate-limiting measures such as RIPE currently employs are not only pointless but counterproductive: the bad guys already have (or can have) the data any time they wish, but the good guys can't. I suggest a daily rsync'able snapshot of the whole enchilada in whatever form(s) is/are appropriate: text, XML, tarball, etc. Of course I was responding to something from RIPE, but this applies everywhere. It's 2013. The bad guys have had the means to easily bypass stuff like this for about a decade, if not longer. It's not only silly to keep pretending they don't, but it's limiting: some of the best techniques we have for spotting not only fraudulent registrations, but other patterns of abuse, work best when given as much data as possible. (It's really quite impressive what you can find with "grep", if you have enough data in the right form.) (Incidentally, the same thing is true of all domain registration data. The namespace, like network space, is a public resource, therefore anyone using any of it must be publicly accountable.) Here's what I said at the time, generalize/modify appropriately:

Subject: Re: RIPE Database Proxy Service Issues

On Wed, Jan 02, 2013 at 05:00:14PM +0100, Axel Pawlik wrote:

...

To prevent the automatic harvesting of personal information (real names, email addresses, phone numbers) from the RIPE Database, there are PERSON and ROLE object query limits defined in the RIPE Database Acceptable Use Policy. This is set at 1,000 PERSON or ROLE objects per IP address per day. Queries that result in more than 1,000 objects with personal data being returned result in that IP address being blocked from carrying out queries for that day.

1. The technical measures you've outlined will not prevent, and have not prevented, anyone from automatically harvesting the entire thing. Anyone who owns or rents, for example, a 2M-member botnet, could easily retrieve the entire database using 1 query per IP address, spread out over a day/week/month/whatever. (Obviously more sophisticated approaches immediately suggest themselves.)

Of course a simpler approach might be to buy a copy from someone who already has.

I'm not picking on you, particularly: all WHOIS operators need to stop pretending that they can protect their public databases via rate-limiting. They can't. The only thing that they're doing is preventing NON-abusers from acquiring and using bulk data.

2. This presumes that the database is actually a target for abusers. I'm sure for some it is. But as a source, for example, of email addresses, it's a poor one: the number of addresses per thousand records is relatively small and those addresses tend to belong to people with clue, making them rather suboptimal choices for spamming/phishing/etc.

Far richer targets are available on a daily basis simply by following the dataloss mailing list et.al. and observing what's been posted on pastebin or equivalent. These not only include many more email addresses, but often names, passwords (encrypted or not), and other personal details. And once again, the simpler approach of purchasing data is available.

3. Of course answering all those queries no doubt imposes significant load. Happily, one of the problems that we seem to have pretty much figured out how to solve is "serving up many copies of static content" because we have tools like web servers and rsync.

So let me suggest that one way to make this much easier on yourselves is to export a (timestamped) static snapshot of the entire database once a day, and let the rest of the Internet mirror the hell out of it. Spreads out the load, drops the pretense that rate-limiting accomplishes anything useful, makes all the data available to everyone equally, and as long as everyone is aware that it's a snapshot and not a real-time answer, would probably suffice for most uses. (It would also come in handy during network events which render your service unreachable/unusable in whole or part, e.g., from certain parts of the world. Slightly-stale data is way better than no data.)

Please, please someone go to http://meemsy.com/videos/add/24 and create 'Hitler reacts to the fraudulent Romanian ASNs' After that we can move on. :=) ~C. On 1/16/13 2:01 PM, Matthew Petach wrote:

I'll bet Hitler would have used his real name on the whois entries.

There. Now I think we're done.

Matt On Jan 16, 2013 7:09 AM, "Todd Underwood" <toddunder@gmail.com> wrote:

...

...

I do not understand why you're so adamant about sending this information to an organization primarily distinguished by its incompetence and negligence. If they were actually DOING THEIR JOBS in even minimally diligent fashion, then Ron wouldn't needed to write that note or do the research behind it, because this wouldn't be happening.

this kind of mostly unfounded vitriole is silly and damages your credibility.

no one seriously believes that the RIPE NCC (which is managed by all of its members) is primarily distinguished by their incompetence and negligence.

i believe this conversation has now gotten to the <plonk> stage. can someone compare them to hitler so that we can move on?

cheers,

t

In message <CALgc3C7n0Hy80qLBcQ8tZrvGuaVsVrcEneYaYKomUUy58p3rEw@mail.gmail.com>, Eugeniu Patrascu <eugen@imacandi.net> wrote:

Jump.ro is a very active LIR and domain registry on the Romanian market and is "selling" ASNs to whomever is interested...

I do see that JUMP.RO is ``very active''. I do not know who they have actually given all of this IP space to. Do you? If so, then by all means, please don't keep us in suspense. Please do share that information. (I have also seen that JUMP.RO has puffed up its own resume, claiming on its home page to have over 12,000 customers. but from where I am sitting, it looks more like a tiny little ISP with only two /24s of its own, and perhaps only a few handfuls of customers, many of whom, it seems, are spammers.)

and facilitates allocations of PI netblocks to those who can justify them.

JUMP.RO also ``facilitates'' IP block allocations to _themselves_, apparently.

It might come as a surprise to you, but in Romania there are a lot of companies (even very small ones) with their own ASN and PI netblocks.

Regardless of whether that assertion is true or false, it has no bearing whatsoever on the specific issue and the specific ASNs and the specific IP address blocks that I have reported on here. I will repeat myself, so as to be completely clear. The 18 specific ASNs I reported on, together with their associated IPv4 address blocks, were all registered, via RIPE, with fradulent information.

...

AS16011 (fiberwelders.ro) AS28822 (creativitaterpm.ro) AS48118 (telecomhosting.ro) AS49210 (rom-access.ro) AS50659 (grandnethost.com) AS57131 (speedconnecting.ro) AS57133 (nordhost.ro) AS57135 (fastcable.ro) AS57176 (bucovinanetwork.ro) AS57184 (kaboomhost.ro) AS57415 (highwayinternet.ro) AS57695 (effidata.ro) AS57724 (id-trafic.ro) AS57738 (mclick.ro) AS57786 (hosting-www.ro) AS57837 (romtechinnovation.ro) AS57906 (momy.ro) AS57917 (nature-design.ro)

from all those websites it looks like they are all hosting companies.

Yes. Indeed. The web sites associated with all of the above domain names have indeed been made to _look_ like they are all legitimate hosting companies. I'm so glad that you noticed.

have you tried calling the numbers listed on the WHOIS registrant information on the ASN and you couldn't get to any one ?

That is a good idea. Why don't you try it and report back here and let us know your results. Personally, I have much better things to do with my time (and my money) that to waste any of it making pointless long-distance overseas phone calls to pseudo-companies that I am already 100% convinced are simply fradulent and fictitious. But since you yourself seem to be geographically in that area... AND since you probably speak Romanian about 100,000% better than I do, by all means, I encourage you to try to reach some human, i.e. ANY human at any of these (fictitious) places who might be able to disprove the assertions that I have made here, and repeated elsewhere. Good luck.

If you really believe that all those ASNs listed by you above are only used to host spammers...

Sir, I am not in the habit of risking either my reputation or my legal safety by posting allegations on the NANOG list which I have anything less than the highest confidence in. To do so would be foolish in the extreme, and in multiple dimensions.

...then by all means please contact alerts@cert-ro.eu - that is the Romanian CERT

Thank you but no. This is another task that you have tried to assign to me... also of entirely questionable usefulness... that I also personally elect not to waste any of my precious minutes on this earth pursuing. But please, feel free to do yourself the (pointless) tasks that you have attempted to assign to me. Please feel free to contact the Romanian CERT yourself. (If you manage to find anyone within that organization that has ever done _anything_ to materially improve the safety or security of the Internet, then please do send me that person's name so that I can send it on to the Guinness World Records people and let them know that such a person does exist after all.)

...as they are active...

Oh yes! I am quite sure they are. As are the particles shown in the simulation on this page: http://en.wikipedia.org/wiki/Brownian_motion Very active indeed!

and will investigate the allegations you make.

What exactly would be the point of that? They are not Internet Police, and I rather doubt that they have any control over RIPE's allocation processes for number resources. (On the other hand, if I am wrong, and if the people at the Romanian CERT actually *are* the Internet Police, then please do let me know immediately. In that case, I have some vastly more serious matters to discuss with them, specifically the massive fake pharmacy operations that are run out of your country *and* the propensity of the specific crooks behind those oper- ations for stealing and using the credit card numbers of at least hundreds and more probably thousands of unsuspecting Americans. But I digress.)

So far I do not know a single web hosting company that it's customers never spammed anyone :)

I confess that I cannot deduce whether your obtuse inability to differentiate between the occasional spammer and an entire /14 full of them is genuine or an act. If genuine, you have my sympathy. Regards, rfg

In message <CAP-guGVs-kCYoSkNNs+v8R1gDKBpmkuuFM1eNgqvhqh0pR0gCA@mail.gmail.com> William Herrin <bill@herrin.us> wrote:

What is your goal here?

Primarily to inform. Forewarned is forearmed. Wouldn't you agree?

Is there some action that any particular NANOG participant should take based on your opinion?

Dropping all route announcements from the 18 fraudlent ASNs I listed, together with all those from AS2876, and avoiding propagating any of said routes to any other parties would, I think, be an altogether prudent step for all concerned. Unless of couse your are hosting one or more spam research organizations that are eager to collect as much spam as possible. Regards, rfg P.S. It is most probably unnecessary to worry about blocking route announcements relating to any of the separate set of five bogus ASNs documented here: http://www.spamhaus.org/rokso/evidence/ROK9107/world-company-register-eu-bus... It is unnecessary to block any such route announcements because owing to the good work Spamhaus did already in publicising these other five "rogue" ASNs... which also got all of their IP space from JUMP.RO... none of them is even announcing routes anymore. (Well, at least that's what it looks like from where I am sitting.)