Registration and validation of "abuse-c" and "abuse-mailbox"

Original Language Español Date Published 05/03/2018 Last Modified 19/02/2018
Last Call for Comments Period Does not apply Date Ratified Does not apply Implementation Date Does not apply
Status Under discussion Download TXT PDF XML DOCX
See other versions 1.0 2.0 (compare)

Authors

Name: Jordi Palet Martinez
Email: jordi.palet@consulintel.es
Organization: The IPv6 Company

Proposal Data

Policy Type: LACNIC
Id: LAC-2018-5
Last version: 2
Presentations:

Summary

The current (ASN) policy is not clear regarding the obligation to register an abuse contact (abuse-c) or its specific format, nor as to whether this applies to other whois records.

As a result, some LIRs may not have this contact information registered for their resources. In fact, there are even cases of LIRs that use a non-existent mailbox or one that is not actively monitored.

In practice, this contact becomes ineffective to report abuses and generally gives rise to security issues and costs for the victims.

This proposal aims to solve the problem and ensure the existence of a proper abuse-c contact and the process for its utilization.

Rationale

The Internet community is based on collaboration. In many cases, however, this is not enough and we all need to be able to contact those LIRs which may be experiencing a problem in their networks and may not be aware of the situation.

This proposal creates a new section in the Policy Manual to solve this problem by means of a simple, periodic verification, and establishes the basic rules for performing such verification and thus avoids unnecessary costs to third parties who need to contact the persons responsible for solving the abuses of a specific network.

The proposal guarantees that the cost of processing the abuse falls on the LIR whose client is causing the abuse (and from whom they receive financial compensation for the service), instead of falling on the victim, as would be the case if they had to resort to the courts, thus avoiding costs (lawyers, solicitors, etc.) and saving time for both parties.

For this, the abuse-c attribute – which has so far only been referenced for the "aut-num" object – becomes mandatory in the "inetnum" and "inetnum6" objects, as well as in any others that may be used in the future. This attribute is an abuse contact, which must contain at least the "abuse-mailbox" attribute.

Text

Current text: N/A

New text:

12. Registration and validation of "abuse-c" and "abuse-mailbox"

12.1. Description of "abuse-c" and "abuse-mailbox"
All resources allocated by LACNIC must include a mandatory "abuse-c" contact attribute (abuse contact) in their corresponding WHOIS entry, with at least one valid, monitored and actively managed email inbox (abuse-mailbox) intended for receiving manual or automatic reports regarding abusive behavior, security issues, and the like.

The "abuse-mailbox" attribute must be available in an unrestricted way via whois, APIs and future techniques.

Considering the hierarchical nature of IP address objects, child objects of those directly distributed by LACNIC may be covered by parent objects or they may have their own "abuse-c" attribute.

Following usual practices, other "e-mail" attributes may be included for other purposes.

12.2. About the "abuse-mailbox"

Emails sent to "abuse-mailbox" must require manual intervention by the recipient at some time, and may not be filtered, as in certain cases this might prevent the reception of the abuse reports, for example a case of spam, as it would include the spam message itself or URLs or content usually classified as spam.

The "abuse-mailbox" may initially send an automatic reply, for example, assigning a ticket number, applying classification procedures, requesting further information, etc. However, it may not require the use of a form, as this would imply that each company that needs to report cases of abuse (a task that is typically automated) would be forced to develop a specific interface for each case, which is neither feasible nor logical, as it would place the cost of processing the abuse on those who submit the claim and are therefore victims of the abuse, instead of being paid by the those whose client causes the abuse (and from whom they obtain income).

By way of information, it is worth noting that it is reasonable for the person reporting the abuse to do so from the start and in that first report, sending the logs, or a copy of the spam message (attaching an example of the spam email or its full headers) or similar evidence proving the abuse. Likewise, it is reasonable to expect that the initial auto-reply email will specify that the claim will not be processed unless such evidence has been submitted, thus allowing the sender the opportunity to repeat the submission and include the pertinent evidence. This allows automatic reporting, for example, via fail2ban, SpamCop or others, keeping costs at a minimum for both parties involved.

12.3. Objectives of "abuse-c"/"abuse-mailbox" validation

The procedure, which is to be developed by LACNIC, must meet the following objectives:

1) A simple process that guarantees its functionality and allows the helpdesks that deals with abuse reports to verify that validation requests actually come from LACNIC and not from third parties (which might involve security risks), avoiding, for example, a single "direct" URL for validation.

2) Avoid automated processing.

3) Confirm that the person performing the validation ensure that understands the procedure and the policy, that they regularly monitor the "abuse-mailbox", that measures are taken, and that the abuse report receives a response.

4) Validation period no longer than two (2) business days.

5) If validation fails, escalate to the LIR and set a new validation period not to exceed three (3) business days.

(By way of example, a detailed procedure is included in this policy proposal under "Additional Information")

12.4. Validation of "abuse-c"/"abuse-mailbox"

LACNIC will validate compliance with the items above, both when the "abuse-c" and/or "abuse-mailbox" attributes are created or updated, as well as periodically, not less than once every three months, and whenever LACNIC sees fit.

At the discretion of LACNIC, in general or in specific cases (for example, for confirmation in cases of escalation under 12.5), LACNIC may use domains other than lacnic.*, and even modify the subject and body of the message, in order to perform said validations more effectively.

Lack of compliance will imply a more exhaustive follow-up, in accordance with the relevant LACNIC policies / procedures, especially "7.1. Resource recovery.”

12.5. Escalation to LACNIC

To avoid fraudulent behavior (for example, an "abuse-mailbox" that only replies to LACNIC's emails, or to messages with a specific subject or content), or failure to comply with the remaining aspects of this policy (incorrect or lack of response to cases of abuse) and, therefore, to guarantee the quality of the services in the region with the resources allocated by LACNIC, a mailbox will be available (for example, "escalado-abusos@lacnic.net"), to escalate such situations, thus allowing for a re-validation (according to section 12.4 above) and even the intermediation by LACNIC and, where appropriate, the application of the relevant policies/procedures, especially “7.1. Resource recovery.”

Additional Information

Example of the validation procedure.

1) LACNIC initiates the validation automatically, sending TWO consecutive emails to the "abuse-mailbox".

2) These emails will be sent containing plain text only.

3) The first email will contain the URL where the validation is to be performed ("validacion.lacnic.net") and may contain information about the procedure, a brief summary of this policy, etc.

4) The second email will contain a unique alphanumeric validation code.

5) The person in charge of the "abuse-mailbox" must go to the URL and paste the code received in the second email in the form.

6) This URL must be designed in such a way that it prevents the use of an automated process (for example, "captcha"). In addition, it must contain a text that confirms that the person performing the validation understands the procedure and the policy, that they regularly monitor the "abuse-mailbox", that measures are taken to solve reported cases of abuse, and that the abuse report receives a response, with a "checkbox" that must be accepted in order to proceed.

7) The alphanumeric code will only be valid for a maximum of two working days.

8) If the code is not entered within that time, the system will mark the "abuse-c" as "temporarily invalid” and will alert LACNIC staff so that they can initiate a personalized follow-up with the LIR.

9) If no reply is received confirming that the situation has been corrected, after an additional period of three business days, the "abuse-c" will be permanently marked as "invalid".

10) The validation process will be repeated automatically (items 1 to 7 above). If satisfactory, the "abuse-c" will be marked as "valid"; otherwise it will be considered in breach of the policy.

Timetable

90 days, to be confirmed by LACNIC, a reasonable time frame to allow both the staff to develop the tool and the LIRs to update their abuse-c contacts.

References

A similar proposal is under discussion in the RIPE region, though at the date on which this proposal was submitted it had not yet reached consensus.

Public Comments by LACNIC Staff

LACNIC STAFF´S IMPACT ANALYSIS - Proposal LAC-2018-5 - version 2

LACNIC Staff's Interpretation of the Proposal
---------------------------------------------
Applicability
-----------
This proposal would apply to RIRs, requiring that they provide a valid abuse contact.

Modifications to the current text
---------------------------------
According to the modifications presented in policy proposal 2018-4, the Policy Manual would be modified as specified below.

• Addition of the following sections:
o 12. Registration and validation of "abuse-c" and "abuse-mailbox"
o 12.1. Description of "abuse-c" and "abuse-mailbox"
o 12.2. "abuse-mailbox” characteristics
o 12.3. Purpose of validating "abuse-c"/"abuse-mailbox"
o 12.4. Validation of "abuse-c"/"abuse-mailbox"
o 12.5. Escalation to LACNIC

• Section 12. Appendixes would be renumbered as section 13. Appendixes.


LACNIC Staff Comments

------------------------
• Sections 12.4 and 12.5 specify that “Lack of compliance will imply a more exhaustive follow-up, in accordance with the relevant LACNIC policies/procedures, especially 7.1. Resource recovery. However, it is not clear how LACNIC should proceed – whether policy 7.1 should be applied in every case.


• It should be noted that in order to implement this proposal LACNIC would need to invest new resources to handle those cases requiring follow-up. 


• This proposal makes reference to inetnum6 objects. LACNIC's whois only references inetnum objects, both for IPv4 and IPv6.


• LACNIC recommends not numbering the Appendix, but instead including it as A. (appendix). The purpose of this recommendation is to avoid having to update appendix numbers each time a section is added to the manual, as this could potentially result in errors due to the large number of references to the appendix (section 12) that appear throughout the text of the Policy Manual.

Impact of the policy on the registration system and address management
-------------------------------------------------------------------------
This proposal would involve developing a process to automatically monitor abuse-c and abuse-mailbox.

Privacy Policy