- ncc-services-wg - mailman.ripe.net

Re: [ncc-services-wg] RIPE NCC Security Update
by Eleonora Petridou 25 Mar '24

25 Mar '24

Dear Aleksi, Peter, and all, Thank you for your emails, currently our efforts are focused on the first phase of deploying mandatory two-factor authentication (2FA). This first phase will include functionality to migrate 2FA to a new device. The second phase is scheduled for the following quarters, and this is where we will look at expanding the authentication choices for 2FA. We will definitely consider your suggestions as we evaluate the possible options we can provide. Regards, Eleonora, Chief Information Security Officer RIPE NCC > ---------------------------------------------------------------------- > > Message: 1 > Date: Wed, 20 Mar 2024 19:09:23 +0200 > From: Aleksi Suhonen <ripe-ml-2024(a)ssd.axu.tm> > To: ncc-services-wg(a)ripe.net > Subject: Re: [ncc-services-wg] RIPE NCC Security Update > Message-ID: <9a980621-f64d-4d42-bac4-6a4e3109cf0e(a)ssd.axu.tm> > Content-Type: text/plain; charset=UTF-8; format=flowed > > Hi colleagues, > > On 3/19/24 9:59 AM, Eleonora Petridou wrote: >> We have also strengthened password requirements and added a reminder >> to enable 2FA when users log in to their RIPE NCC Access accounts. >> This is an interim measure until mandatory 2FA is rolled out. Our >> roadmaps have been updated to expedite the rollout of mandatory >> two-factor authentication: > > The current policy does not allow for having the same OTP code on two > different mobile phones at the same time, so the only way to migrate to > a new phone is to turn off 2FA completely and then turn it back on again > to get a QR code for the new phone. > > When 2FA becomes mandatory, it cannot be turned off, am I right? > > What is the plan to enable the moving to a new phone or other > authenticator device? > > Best Regards, > > -- > Aleksi Suhonen / Axu TM Oy > Internetworking Consulting > > > > ------------------------------ > > Message: 2 > Date: Wed, 20 Mar 2024 14:03:39 -0400 > From: Peter Potvin <peter(a)accuris.ca> > To: Aleksi Suhonen <ripe-ml-2024(a)ssd.axu.tm> > Cc: ncc-services-wg(a)ripe.net > Subject: Re: [ncc-services-wg] RIPE NCC Security Update > Message-ID: > <CAC0MiJpKwc6Bh+L-kLf+QjwBvDN9W-yhifsweYkgV6R03bUUUQ(a)mail.gmail.com> > Content-Type: text/plain; charset="utf-8" > > This is a very good point, and I can see where the issue would occur when > the OTP application used doesn't support migration to a new device (which > some don;t in my experience). Another thing I (among other network > operators) would like to see is the implementation of support for WebAuthn > and multiple hardware keys. It's not solely sufficient in my opinion to > have only a single method of 2FA possible, so the support of different > types of 2FA would be great to have implemented prior to 2FA becoming > mandatory. > > Kind regards, > Peter Potvin > > > On Wed, Mar 20, 2024 at 1:09?PM Aleksi Suhonen <ripe-ml-2024(a)ssd.axu.tm> > wrote: > >> Hi colleagues, >> >> On 3/19/24 9:59 AM, Eleonora Petridou wrote: >>> We have also strengthened password requirements and added a reminder >>> to enable 2FA when users log in to their RIPE NCC Access accounts. >>> This is an interim measure until mandatory 2FA is rolled out. Our >>> roadmaps have been updated to expedite the rollout of mandatory >>> two-factor authentication: >> >> The current policy does not allow for having the same OTP code on two >> different mobile phones at the same time, so the only way to migrate to >> a new phone is to turn off 2FA completely and then turn it back on again >> to get a QR code for the new phone. >> >> When 2FA becomes mandatory, it cannot be turned off, am I right? >> >> What is the plan to enable the moving to a new phone or other >> authenticator device? >> >> Best Regards, >> >> -- >> Aleksi Suhonen / Axu TM Oy >> Internetworking Consulting >> >> -- >> >> To unsubscribe from this mailing list, get a password reminder, or change >> your subscription options, please visit: >> https://lists.ripe.net/mailman/listinfo/ncc-services-wg >> > > ***********************************************

1 0

RIPE NCC Security Update
by Eleonora Petridou 20 Mar '24

20 Mar '24

Dear colleagues, We would like to share some updates regarding security measures available to RIPE NCC members. We have now introduced a feature that shows LIR administrators whether or not two-factor authentication (2FA) has been enabled by users on their LIR account. This feature allows LIR administrators greater insight into the security measures being implemented within their teams. Please note that only admins have access to this feature. We have also strengthened password requirements and added a reminder to enable 2FA when users log in to their RIPE NCC Access accounts. This is an interim measure until mandatory 2FA is rolled out. Our roadmaps have been updated to expedite the rollout of mandatory two-factor authentication: https://www.ripe.net/support/documentation/quarterly-planning/business-appl… The rollout is currently planned to take place towards the end of Q1 2024. Additionally, we have increased our efforts to actively identify leaked credentials available online and to reset those passwords. The password reset process for any credentials identified as leaked through our monitoring system has been automated. We urge all members to be mindful of their password security and to enable two-factor authentication. Please follow our security recommendations: - Review your LIR account(s), restrict access to necessary personnel only and remove former employee accounts. - Make use of our new feature and ensure that all users on your account enable two-factor authentication. - If you use a password management tool, we recommend that you enable data breach monitoring for your own credentials. Kind regards, Eleonora Petridou Chief Information Security Officer RIPE NCC

3 2

NCC Services WG at RIPE 88
by Rob Evans 19 Mar '24

19 Mar '24

Hello dear WG participants, We are just a day over nine weeks until the RIPE NCC Services working group will meet at RIPE 88 in Krakow, Poland. If you have any topics you wish to present, or discussions you think we should have, please let the chairs know via <ncc-services-wg-chairs(a)ripe.net>. See you in Poland! Cheers, Rob, Bijal, Janos

1 0

Email Delivery from the RIPE NCC
by Fergal Cunningham 14 Mar '24

14 Mar '24

Dear all, We're working to improve email delivery from the RIPE NCC, especially in light of new requirements from the big email providers. I just published an article about this on RIPE Labs: https://labs.ripe.net/author/fergalc/enhancing-email-delivery-at-the-ripe-n… Any thoughts or comments are of course welcome. Kind regards, Fergal Cunningham Head of Membership Engagement RIPE NCC

1 0

Re: [ncc-services-wg] The redesigned www.ripe.net is now live
by Petrit Hasani 22 Jan '24

22 Jan '24

Dear Randy, Thank you for your report. We have investigated the reported issue. The issue is not as a result of the recent work carried out on the new ripe.net <http://ripe.net/> website. Your AS number submission receives an error due to the “AS-“ prefix which is not allowed to be used in an as-name. The “AS-“ prefix is is a reserved prefix for AS SET in accordance with RFC 2622: Routing Policy Specification Language (RPSL): https://datatracker.ietf.org/doc/html/rfc2622#section-2 RFC 2622: Routing Policy Specification Language (RPSL) datatracker.ietf.org The error message received in the request form does not properly clarify it, creating confusion, so we will look to fix it as soon as possible. Please do not hesitate to contact us if you have any questions or concerns. Kind regards, Petrit Hasani RIPE NCC > On 22 Jan 2024, at 16:12, Petrit Hasani <phasani(a)ripe.net> wrote: > > Dear Randy, > > Thank you for reporting the bug. > > We will look into it and hope to resolve it as soon as possible. > > I will contact you once a fix has been deployed. > > Please do not hesitate to contact us if you have any other questions or concerns. > > Kind regards, > > Petrit Hasani > RIPE NCC > >> On 20 Jan 2024, at 21:28, Randy Bush <randy(a)psg.com <mailto:randy@psg.com>> wrote: >> >>> Date: Fri, 19 Jan 2024 13:16:42 +0100 >>> If you visit www.ripe.net today, you might notice some changes. >> >> deploy on friday afternoon and go home for the weekend. i think that is >> covered pretty early in the textbook. >> >> <ripe-asn.jpg> >> which i can fudge past by skipping the hyphens, but then i submit the AS >> allocation form and get >> >> <ripe-ouch.jpg> >> was a show stopper. and it reproduces. with safari and firefox. and >> when i go to re-do, it has not saved the data i entered. >> >> randy-- >> >> To unsubscribe from this mailing list, get a password reminder, or change your subscription options, please visit: https://lists.ripe.net/mailman/listinfo/ncc-services-wg

2 2

The redesigned www.ripe.net is now live
by Phillip Oldham 20 Jan '24

20 Jan '24

Dear colleagues, If you visit www.ripe.net today, you might notice some changes. For the past few months, we’ve been working on redesigning ripe.net, and we released the new version yesterday at approximately 18:00 UTC+1. Here are some of the major changes: • The design of the website has changed • The content management system has been changed from Plone to Wagtail • We migrated servers to make this switch • The website is now significantly more mobile and tablet friendly • We are using a new search engine on the website, so search results should be more relevant, and we will be investing time to make this experience even better • Accessibility has been improved, and we aim to align with WCAG 2.1 standards as soon as possible • Visitors should see some performance improvements, and we aim to continue adding improvements for usability and energy efficiency • The RIPE community is more prominent and easy to access from the top-level navigation under “community”, and we are applying a new community design to community-related pages: https://www.ripe.net/community/ The overall navigation of the website has not been significantly altered to ensure a smooth transition. We will be making more changes to the navigation to improve readability and discoverability. Many of you shared input in a survey and some of you joined us for user interviews at RIPE 86 and for conversations following my presentation at RIPE 87. Thank you for helping us through this process. While we have launched the newly redesigned website, with over 8,000 web pages migrated to the new platform, we know there will be fixes and tweaks needed in the weeks to come. If you notice any issues or have feedback, please let us know on the forum: https://forum.ripe.net/t/www-ripe-net-redesign-is-live/820 For anything urgent, please email us at webmaster(a)ripe.net Kind regards, Phillip Oldham (he/him) <poldham(a)ripe.net> Manager, Web Services RIPE NCC Stationsplein 11, 1012 AB Amsterdam

2 2

RIPE NCC Access 2FA
by Peter Potvin 11 Jan '24

11 Jan '24

Dear List, I'm glad to see that RIPE NCC has followed in ARIN's footsteps regarding the enforcement of two-factor authentication. I have a few questions regarding this that I'm sure quite a few members of the NCC community also have. 1. Is this for all NCC Access accounts or only applicable to LIRs/end users with PI resources? 2. Will there be an option for multiple YubiKeys or U2F keys for authentication, asides from the current TOTP option? If so, is there an ETA for when this would be implemented? 3. Will RIPE NCC have secondary 2FA requirements for high-risk transactions like RPKI issuance/revocation and delegation, requiring users to re-authenticate when performing these actions? If so, would this change anything with regards to the API implementations? Regards, Peter Potvin | Executive Director ------------------------------------------------------------------------------ *Accuris Technologies Ltd.*

1 0

Enforce 2FA for RIPE NCC Access account
by Benedikt Neuffer 04 Jan '24

04 Jan '24

Happy New Year, everyone! However, the year begins with some concerning news: RIPE NCC has announced a Security Breach Investigation[0]. It likely relates to the incident where Orange Spain lost credentials[1][2]. This topic has been discussed in the unofficial RIPE Telegram chat[3] and the German network community on Telegram[4], on the discussion mailing list[5][6] and a lot of more places. The primary issue in this case was the lack of 2FA usage. We must not allow ourselves to be distracted by the debate over weak passwords. Even strong passwords can be compromised. A while ago, I raised a concern with RIPE NCC about the inability to check if 2FA is activated for an account linked to a LIR. It’s also not possible to enforce 2FA for accounts associated with a maintainer object in RIPE DB. Unfortunately, there has been no progress or action taken on this matter yet. After some thought, I've come to the conclusion that RIPE NCC's services are so essential to the internet that enforcing 2FA for RIPE NCC Access accounts globally should be considered. So, I propose a discussion urging RIPE NCC to either enforce 2FA on RIPE NCC access accounts globally, allow a LIR to enforce 2FA for linked RIPE NCC Access accounts, or at the very least, provide visibility in the LIR portal to identify which linked accounts have not activated 2FA. To be honest, I don't get the impression that RIPE NCC takes the security of RIPE NCC Access accounts very seriously. How can we, as a community, influence RIPE NCC in this regard? Would it be possible, for example, to develop a policy in the RIPE NCC Services WG that enforces 2FA for RIPE NCC Access accounts? Kind Regards, Benedikt [0] https://www.ripe.net/publications/news/ripe-ncc-access-security-breach-inve… [1] https://twitter.com/Ms_Snow_OwO/status/1742357282917109928 [2] https://twitter.com/vxunderground/status/1742704099035160612?t=GkJ0_jiIGI3N… [3] https://t.me/ripe_chat [4] https://t.me/bgpde [5] https://www.ripe.net/ripe/mail/archives/ripe-list-unmoderated/2024-January/… [6] https://www.ripe.net/ripe/mail/archives/ripe-list-unmoderated/2024-January/… -- Karlsruher Institut für Technologie (KIT) Scientific Computing Center (SCC) Benedikt Neuffer Netze und Telekommunikation (NET) Büro CN: Hermann-von-Helmholtz-Platz 1 Gebäude 442 Raum 122 76344 Eggenstein-Leopoldshafen Büro CS: Zirkel 2 Gebäude 20.21 Raum 001.1 76131 Karlsruhe Telefon CN: +49 721 608-24502 Telefon CS: +49 721 608-46342 Fax: +49 721 608-47763 E-Mail: benedikt.neuffer(a)kit.edu Web: https://www.scc.kit.edu Sitz der Körperschaft: Kaiserstraße 12, 76131 Karlsruhe KIT – Die Forschungsuniversität in der Helmholtz-Gemeinschaft Signaturversion: 23.1.0 beta

9 12

Re: [ncc-services-wg] Enforce 2FA for RIPE NCC Access account (Hank Nussbacher)
by hmi＠ripe.net 04 Jan '24

04 Jan '24

Hi Hank, > On 04/01/2024 12:04, Benedikt Neuffer wrote: > > I believe I have found a bug in RIPE Portal 2FA access. To whom should > I report it? Feel free to send it to security [at] RIPE [dot] net. Cheers Hisham > > Thanks, > Hank

2 1

Security Breach: Please Enable Two-Factor Authentication
by Hans Petter Holen 04 Jan '24

04 Jan '24

Dear colleagues, In light of the recent incident where a RIPE NCC Access account was compromised, we urge you to review your own account security. ------------------------------- Two-Factor Authentication ------------------------------- If you have not already done so, enable two-factor authentication on your RIPE NCC Access account. Using two-factor authentication across all of your accounts can reduce your exposure to attacks like these. The guide for setting up two-factor authentication on your Access account can be found at: https://www.ripe.net/participate/member-support/ripe-ncc-access/two-step-ve… ------------------------------- Password Recommendations ------------------------------- We also encourage account holders to change their Access account password and follow these recommendations: - Avoid reusing passwords for login credentials. - Use a password manager to automatically create random passwords and store them. - If you use a SaaS based password management tool, enable dark web monitoring for your own credentials. If you choose to create your own password: - Use at least 14 characters to create a password. - Using passphrases can be helpful such as a favourite quote, fictional character name or line of song to greatly increase the length of the password while also making it easier to remember. We are currently investigating the compromise of the RIPE NCC Access account and continue to work with the account holder in question. We would also like to share that we are routinely responding to notifications of possible public breaches containing RIPE NCC Access accounts and actively resetting account passwords while notifying the account holders. In line with the previous resolution by the Executive Board, we are reporting all cases of attempted fraud to the Dutch authorities: https://www.ripe.net/about-us/executive-board/minutes/2017/minutes-110th-ex… Rest assured that the RIPE NCC is committed to taking the necessary steps to ensure the security of our services. We are currently investigating how we can change our roadmaps to make two-step verification mandatory for all RIPE NCC Access accounts as soon as possible and, in the longer term, offer a wider variety of verification mechanisms. If you suspect that your account might be impacted, please report it to security(a)ripe.net. Kind regards, Hans Petter Holen Managing Director and CEO, RIPE NCC

2 1