AFRINIC: The Saga Continues

Mailman List Mirror (Read Only)
1

For the benefit of those of you who may have been living in caves
for the past two months, I would like to share the following links
regarding a massive fraud that appears to have been perpetrated by
at least one AFRINIC insider. (It has still not been definitively
determined if he had help or not.)

https://mybroadband.co.za/news/internet/330379-how-internet-resources-worth-r800-million-were-stolen-and-sold-on-the-black-market.html

https://krebsonsecurity.com/2019/12/the-great-50m-african-ip-address-heist/

https://www.theregister.co.uk/2019/12/17/another_afrinic_scandal/

https://mybroadband.co.za/news/security/335226-here-are-the-police-charges-filed-in-the-great-african-ip-address-heist.html

I hate to say that I told you so, but I told you so. I reported right
here on the NANOG list, in both 2016 and 2017, that there was quite a
lot of funny business going on down in Africa. Nobody listened and
there was no meaningful investigation whatsoever by anybody until I
took it upon myself, starting in July of last year, to finally get to
the bottom of this colossal mess.

Here are links to my old public posts relating to this:

November, 2016:
https://mailman.nanog.org/pipermail/nanog/2016-November/089164.html
https://mailman.nanog.org/pipermail/nanog/2016-November/089232.html
https://lists.afrinic.net/pipermail/rpd/2016/006129.html

August, 2017:
https://mailman.nanog.org/pipermail/nanog/2017-August/091821.html
https://mailman.nanog.org/pipermail/nanog/2017-August/091954.html
https://mailman.nanog.org/pipermail/nanog/2017-August/092092.html

AFRINIC supposedly began an investigation of these matters as early
as last April (2019), but here's the funny thing: Not a single person
from AFRINIC, or from any other part of what passes for "Internet
governance" ever contacted me or asked a single question of me about
any of this. I can only infer from this that nobody involved in
this so-called investigation had any real or burning interest in
gathering all of the relevant facts.

In light of the facts that have now come out in the press, AFRINIC is
still, allegedly, "investigating" and now, even nearly two months
after the story broke in the press, AFRINIC has still not even reclaimed
100% of the valuable IPv4 space that was provably stolen from their
own free pool. (Various online criminal enterprises are continuing
to use that IPv4 space aqs we speak.) Worse yet, AFRINIC has done
nothing whatsoever to address the problem of the large number of
AFRINIC legacy /16 blocks that got stolen via some clever internal
manipulation of AFRINIC's own WHOIS record. Those manipulations, and
the benefits from them have flowed to various parties who are now all
too well known, including one who previosuly made a brief guest apperance
right here on this mailing list.

In fact, that party has just recently found a brand new helpful and
compliant small-time hosting provider in India to route for him the
stolen 165.25.0.0/16 block, which is and has been "liberated" from
its rightful owners, i.e. the City of Cape Town, South Africa.

    https://bgp.he.net/AS393960#_prefixes
    https://bgp.he.net/net/165.25.8.0/22#_whois

Note that whereas AS393960 claims to be located in my own state of
California, is is not incorporated here. It -is- incorporated in the
state of Wyoming, but the owner and CEO, by his own admission, is
actually located in Pune, India:

    https://in.linkedin.com/in/kushalraha

(That small detail did not, of course, prevent ARIN, in its infinite
wisdom, from giving the the proprietor of this place his own AS, two
IPv4 /22 blocks and one IPv4 /24 block, all apparently on the basis of
his tissue-thin Wyoming shell company. But I digress.)

Anyway, I just wanted you all to be aware of all of these fun facts.

Like I always say, just another day in paradise.

Regards,
rfg

2

Hi there,

Thank you Ronald, I also heard of governance issue in AFRINIC by some people during the last RIPE meeting so the word is spreading. Now is there any other /16 impacted to your knowledge ? Would be worth pushing to have them in as many Drop list as possible maybe :slight_smile:

I took the liberty to forward your message in FRnoG list (giving you credit of course), as France do have access to AFRINIC via the French indies Isles. Hope you don't mind

3

In message <ff4bd087-2a84-b9d9-6f5b-715826a35aa6@brenac.eu>,

Thank you Ronald, I also heard of governance issue in AFRINIC by some
people during the last RIPE meeting so the word is spreading. Now is
there any other /16 impacted to your knowledge ? Would be worth pushing
to have them in as many Drop list as possible maybe :slight_smile:

As reported in Jan Vermeulen's article on the web site mybroadband.co.za
published December 4, there has been, and continues to be a large number
of blocks, both "legacy" blocks and other blocks, that were stolen from
the Afrinic free pool. These blocks are of varying sizes, generally /16
blocks but also some larger ones as well as a few smaller ones.

The list of affected legacy blocks from Jan's article are as follows:

196.10.64.0/19
196.10.61.0/24
196.10.62.0/23
160.121.0.0/16
155.235.0.0/16
152.108.0.0/16
155.237.0.0/16
169.129.0.0/16
165.25.0.0/16
160.122.0.0/16
168.80.0.0/15
165.3.0.0/16
165.4.0.0/16
165.5.0.0/16
160.115.0.0/16

In addition to all of the above, I have some reason to believe that the
following additional legacy block WAS (past tense) stolen, but has now
been reclaimed by, and ressigned to its rightful modern owner:

152.108.0.0/16

It is highly probable that there are other and additional legacy blocks
that have also been stolen. I have been prevented from fully completing
my research work on this part of the problem by ongoing stonewalling by
Afrinic. Specifically, despite Afrinic having a defined protocol whereby
legitimate researchers may request confidential access to the unredacted
Afrinic WHOIS data base for legitimate research purposes... a protocol
and a process which is fully supported and operational at all of the other
four global RIRs... Afrinic has, for reasons unknown, elected to only
provide redacted versions of its WHOIS data base which are identical
to what may be obtained at any time, and without any special protocol,
directly from Afrinic's FTP server (via anonymous FTP). Because the
accurate identification of stolen Afrinic legacy blocks involves the
careful analysis of the *unredacted* contact person: records, access to
only the redacted data base is of no value whatsoever in the task of
identifying stolen Afrinic legacy blocks.

Here is the page on the Afrinic web site where they needlessly torment
legitimate researchers into believing that they will be able to get the
same kind of unredacted WHOIS data base access as is provided, upon
vetting and approval, by all of the other RIRs:

    How can I request for bulk whois data?

The list of blocks that appear to have been stolen from the Afrinic free
pool, as published in Jan's Dec 4 article are as follows:

"Infoplan"/"Network and Information Technology Limited":
196.16.0.0/14
196.4.36.0/22
196.4.40.0/22
196.4.44.0/23

"Cape of Good Hope Bank"/"CGHB":
165.52.0.0/14
137.171.0.0/16
160.184.0.0/16
168.211.0.0/16
192.96.146.0/24 -- NOTE!! -- 100% legitimate legacy allocation!

The following additional blocks had also been stolen from the Afrinic free
pool. I had informed Jan about these blocks also, but for some reason
these were not mentioned in Jan's Dec 4th article. (I assume that this
was simply a clerical oversight on Jan's part. I had given him quite
a lot of material to sort through.)

"ITC":
196.194.0.0/15
196.246.0.0/16
196.45.112.0/20
196.42.128.0/17
196.193.0.0/16

"Link Data Group":
160.255.0.0/16
196.62.0.0/16
198.54.232.0/24
196.207.64.0/18
196.192.192.0/18
160.181.0.0/16
213.247.0.0/19

As of this moment, Afrinic has properly reclaimed all of the "ITC" and
"Link Data Group" and "Cape of Good Hope Bank"/"CGHB" blocks. Those
blocks are now officially unregistered. I am informed and believe that
it is Afrinic's intent to place all of these blocks into a "quarantine"
status for a minimum of 1 year, which I think is entirely proper and
prudent, under the circumstances.

I have no explanation for why Afrinic has not yet reclaimed any of the
"Infoplan"/"Network and Information Technology Limited" blocks, especially
the 196.16.0.0/14 block. This is for me deeply troubling, as I have some
reason to believe that these blocks were stolen by a party or parties,
who were also Afrinic insiders, but people other than the one "insider"
perpetrator of these crimes who has already been identified by myself and
Jan, and who is now the subject of a police investigation in Mauritius.

I am not personally aware of any action that Afrinic has taken to try to
remediate the situation with regards to the stolen legacy blocks, as
listed above. These blocks all quite provably had their associated
person: contact records fiddled in the WHOIS data base in a manner so
as to redirect both emails and phone calls to either the perpetrators
or those others to whom the perpetrators had re-sold these stolen goods.

In fact, I am not even sure that Afrinic even has the capability to undo
the damage in the case of these legacy blocks and their fiddled contact
person: records. Quite obviously, proper remediation of the affected
person: records would involve restoring those to what they were before
they had been fradulently fiddled. Completion of that task is quite
obviously dependent upon Afrinic having access to historical backups of
its own WHOIS data base from as much as ten years ago. It is not at this
moment clear to me that Afrinic is even in possession of such historical
backups, and the fact that they have, as yet, made no apparent efforts to
remediate the fradulently fiddled person: records suggests to me that they
likely do not possess such backups.

Many of the legacy blocks and many parts of the blocks that were stolen
from the Afrinic free pool, both those that have been reclaimed and those
that haven't yet been reclaimed, continue to be routed by various parties
on behalf of the thieves and black market buyers of these blocks even as
we speak. I hope to be able to post a fully list of those routes and the
relevant ASNs that are providing the ongoing routing for various parts of
this mass of stolen booty in the very near future.

Regards,
rfg

4

Hi All,

http://ftp.afrinic.net/stats/afrinic/delegated-afrinic-extended-20200129

Another thing that stuck it’s head out today now. No ASN, nor IP prefixes allocated since 2019/05/15 is listed in the delegated text files. Our (and I am sure others) prefixes is now null routed at team CYMRU (contacted them, waiting for response).

Yesterday’s file was incomplete (looks like there were errors with the script perhaps), and today’s file is missing an enormous amount of data (1 ASN, 163 IPv4 allocations, and 272 IPv6 allocations). This is comparing the data file from 2020/01/29 (today) to 2020/01/27 (two days ago).

We also have a ticket with AfriNIC (no response yet), and when we called them there was no one “available” to assist.

5

Hi all,

I am still looking into the history of this issue, but presently, the
prefix Chris shared with us is not on our IPv4 BOGON list.

For those wanting to see the list, it is available in plain text here:

https://www.team-cymru.org/Services/Bogons/fullbogons-ipv4.txt

I welcome input on this as I look into the history a little more.

Cheers!

James

6

Hi James,

Just want to make this clear to NANOG as well - there’s no beef here. The priority was to get delisted.

The beef is with AfriNIC in this case :slight_smile: It’s not CYMRU’s fault. The datasets are incomplete.