I believe that in many (this one in particular) cases the upstream
networks do not:
1) get
2) have
relevant information in a useful format about abuse/use of their
downstream networks. When I was at AS701 there were consistently folks
who'd say this or that customer is obviously bad, why hadn't we
disconnected them? When looking through abuse tickets for issues we
could bring to management as ammo for disconnection often a majority
of complaints related to the customer in question were not complete,
didn't have enough information, didn't have ANY information in them.
How can we, as a community get better at providing complete and useful
information (ip, timestamp+timezone, act-that-caused-ire)
How can we, as a community, get better at tying together the bits and
pieces that are one issue? (atrivo/intercage/ukrtelecom/hostfresh)
As an interesting aside, there were many occasions of the last 4 years
where some horrible virus/trojan/malware thing got rolling on the
internets, tracking it back was fairly simple (for the C&C or
distribution site) to AS27595... often folks reporting the issue would
say things like:
"Oh, that's ukrtelecom, they are in the Ukraine, too bad we can't get
hands on the server/router/code/subpoena them..."
"Oh, that's something living in hostfresh, in ASPAC, gosh it'd be nice
if the FBI/HTC-group could get there and give the provider some
trouble..."
oddly in many/all of these cases the IP space might have tracked back
to somewhere not ARIN related, but an actual traceroute ended inside
AS27595. So, tying together these incidents with more complete
information would have potentially given the upstreams, or even 27595
if they are to be believed as being in the right and just framed by
their bad customers (not my belief, but...), more actionable
intelligence about their customer(s) and the ability to make an
informed decision (at a management/legal level).
-Chris
(thanks)
This is a set of topics I'd love to see handled in the SP Security
BOF.
On Mon, Sep 29, 2008 at 11:12 AM, Warren Kumari <[email protected]>
wrote:
Hi all,
NANOG 44 is fast approaching and once again we are looking for
topics for
the ISP Security BOF.
If you have any security related topics that you would like to hear
about,
not hear about, or (best of all) speak about, please let me know as
soon as
possible...
This is your chance to air your views --- slides are welcome but not
required.
Danny McPherson and I are going to be moderating this year...
W