- Security-wg - mailman.ripe.net

Call For Submissions - Security WG @ RIPE 93
by Brian Nisbet 21 Aug '26

21 Aug '26

Dear Colleagues, I hope you're having a great summer! As the temperatures cool a little in Europe our thoughts turn to autumn and RIPE 93 in Sofia. Our Security Working Group session is currently scheduled for Tuesday, 27 October 2026 at 16:00 (UTC +2) Since RIPE 91 we are now using Pretalx for this purpose. Please submit your proposals ideally by 18 September 2026 via: https://pretalx.ripe.net/ripe-93/cfp When submitting, please keep in mind: - Talk type: This field is not relevant for our WG – you may simply choose “Talk”. - Track: Please select "Security WG". - Duration: Indicate the total time you will need, including Q&A. More information on how to submit a talk can be found here: https://ripe93.ripe.net/present/call-for-presentations/ If you have questions about potential topics or the session in general, or think you may not make that deadline, please contact us at security-wg-chairs(a)ripe.net As usual, both in-person and remote participation in the working group will be possible. We look forward to your submissions. Best regards, Brian, Tobias, Markus Brian Nisbet (he/him) Head of Service Operations Asiera (formerly HEAnet), Ireland's National Research and Education Network North Dock One, 93-94 North Wall Quay, Dublin 1, D01 V8Y6 +35316609040 brian.nisbet(a)asiera.ie www.heanet.ie<http://www.heanet.ie> www.asiera.ie<https://www.asiera.ie/> Registered in Ireland, No. 275301. CRA No. 20036270

1 0

Abuse mailboxes are increasingly no longer monitored and are being replaced by (bad) forms
by Max Grobecker 17 Aug '26

17 Aug '26

Hello, I hope this is the right list to discuss. I'm seeing more and more providers auto-responding to abuse reports mailed to their "abuse-mailbox" address, stating that this mailbox will not be monitored and urging you to use some form on their website. And often enough, those forms are either only usable for very specific types of abuse or they are just tedious to use and sometimes I suddenly don't want to report spam or phishing anymore to that specific provider when I see a form with 20+ input fields. Besides that, it renders automatic reports useless, even those that are meant to be automatically processable (i.e., containing information as XARF). (Surely, automated reports are a very special topic, but as a provider we are grateful to receive prompt reports of abuse on our network.) This raises the questions: Is there – at least for the RIPE region – any sort of requirement to accept/process abuse reports by mail? While I'm sometimes a bit "pissed" about how bad reporting forms can be, I understand why providers might not want to maintain abuse mailboxes anymore (the amount of spam sent towards these addresses is hilariously large) and instead rely on forms with captchas to tackle this problem. So I'm wondering: Would there be a benefit for building some standardized HTTP API with an authentication system, that would allow providers to automatically send authenticated abuse reports to other providers? That could work in a similar way like DKIM does: The sending provider needs to publish a private key somewhere in the RIPE database, signs the report, and the receiving provider would be able to immediately verify that signature. And if you get a ton of false reports or even spam from a specific provider you can still filter these out based on the sender information in the signature. I would like to hear your opinion on this, or maybe there already *are* solutions I just don't know about yet (besides from manually reporting 20-30 phishing mails a day over 30 different forms). Thanks and greetings Max

22 116

Apologies
by Niall O'Reilly 31 Jul '26

31 Jul '26

Dear WG, I sent a reply to Denis yesterday using "Reply All", but inadvertently from an address which isn't subscribed to this list. As a result, my message wasn't archived, and Denis's reply to it started a separate thread. Since Denis's reply included mine entirely, I'll not risk further confusion or inconvenience by resending to have it archived. Please accept my apologies. /Niall

1 0

Re: Abuse mailboxes are increasingly no longer monitored and are being replaced by (bad) forms
by denis walker 30 Jul '26

30 Jul '26

Hi Niall On Thu, 30 Jul 2026, 13:41 Niall O'Reilly, <niall+ripe(a)no8.be> wrote: > On 30 Jul 2026, at 0:38, denis walker wrote: > > I propose a simplified, two-article baseline framework for an Anti-Abuse > Policy under the Policy Development Process (PDP): > > - Article 1: For the purposes of RIPE Address Policy, "Network Abuse" > is > > defined by the technical threat classifications maintained under the > European Union Cybercrime framework (specifically DDoS, malware hosting, > phishing networks and systemic spam botnet distribution). > > - Article 2: RIPE address space must not be systematically utilized to > > facilitate Network Abuse as defined in Article 1. > > As a (metaphorical) piece of string, this is admirably short. > > I think just one more article might be needed, referring to > the responsiveness required of the abuse contact. > Article 3: In the absence of an acknowledgment, abuse reports will be considered delivered once sent. The resource holder must take action within nnn. Those with more knowledge than i on how much work is involved to address a complaint within large and small organisations can fill in the 'nnn'. It could be left as 'a reasonable time frame'. But then it becomes judgemental. Cheers Denis I hope that no more will be needed. > > /Niall >

1 0

RIPE 92 Security WG Draft Minutes
by Brian Nisbet 22 Jun '26

22 Jun '26

Colleagues, Please find below the draft minutes of our meeting in Edinburgh. If anyone has any corrections, before 12:00 CEST on Friday 26th June, please let the Co-Chairs know, otherwise they will be posted to the WG website. ----- Security Working Group Minutes RIPE 92 Tuesday, 19 May 2026 16:00 - 17:30 (UTC +1) Chairs: Tobias Knecht, Brian Nisbet, Markus de Brün Scribe: Ed Shryane Status: Draft The recordings and presentations are available at: https://ripe92.ripe.net/programme/meeting-plan/sessions/79/ The stenography transcript is available at: https://ripe92.ripe.net/programme/meeting-plan/sessions/79/transcript/ Security WG RIPE 92 Intro Brian Nisbet welcomed everyone to the WG session. The minutes from RIPE 91 were approved as there were no comments. LEA report 2025 and eEvidence implementation Franca Bosompim, RIPE NCC Presentation on the RIPE NCC’s LEA report 2025 and the implementation of eEvidence regulation. Franca, Senior Legal Counsel for the RIPE NCC, presented the 2025 LEA transparency report. In 2025, the RIPE NCC received 99 requests from LEAs, eight of which were binding requests from Dutch LEAs. Most requests came from France and the U.S. Dick Leaning, RIPE NCC, came on stage to expand further on the LEA Transparency report. The RIPE NCC’s Learning and Development department provided training to 700 LEA staff and the goal is for LEAs to make requests which are in scope as this saves time for them and for the RIPE NCC. Next Franca moved to the e-evidence package which is due to be transposed into Dutch law in 2027. This consists of the e-evidence regulation and directive. The regulation applies to the RIPE NCC, because it offers IP numbering services in the EU. Subscriber data is e-evidence data that applies to the RIPE NCC. Traffic data or content data is not held by the RIPE NCC, because it doesn’t provide communication services. IP addresses are not explicitly included in the regulation, but as part of subscriber data. The RIPE NCC has objection rights to an order in certain cases. Requests must be kept confidential, and members are not notified of an order. Alex de Joode, AMS-IX, said that Brussels had an opinion that the starting date would be 18 August, and if the Dutch were not ready, the RIPE NCC would also not be given extra time. Leo Vegoda, PeeringDB, asked about the confidentiality requirement and whether reports would be added to future transparency reports. Franca said that the RIPE NCC were investigating and would reply to the mailing list. Alex de Joode further clarified that the amount of reports were not confidential, but the RIPE NCC would not yet know what exactly they would be allowed to report. Residential Proxies and Infecting Infrastructure Working Session Leslie Daigle Leslie Daigle summarised a Global Cyber Alliance roundtable on the growing challenge of residential proxies and infected infrastructure. Attack traffic has increased significantly since October 2024, with residential proxies making malicious activity difficult to detect and mitigate. Participants agreed that traditional IP-blocking approaches did not scale, particularly with the widespread use of carrier-grade NAT. The workshop identified control-plane mitigation as a more promising approach, with next steps including a report outlining concrete actions and the development of a pilot project. Merike Kaeo, Co-chair of the NetSec Working Group said they have been working on this topic for the past six to eight months, and that it would be useful to collaborate with FIRST, and ISPs globally who were part of that initiative and discussion. Stephen Farrell, Trinity College Dublin, asked which major AI companies were the largest funders. Leslie replied that she was not going to name them, but there were attempts to circumvent blocks on large-scale scraping of content. Nils Trampel, University of Chemnitz, pointed out there was also an intentional use of residential proxies by users who sell their bandwidth, and they saw some abuse in a university setting from someone who unintentionally informed them of this use, and asked for more research into this. Leslie agreed and asked what one does this with this information once identified. Brian Nisbet replied that such services would break AUPs of Universities in the National Research Network. The Moving Parts of Copyright and Cybercrime Lee Kent, beIN Lee Kent from beIN gave an update on what they have been doing over the past 12 months and some of the research they had taken on board. Non-compliant content providers cause a significant issue for rights holders. As part of that ecosystem they looked at the hosting infrastructure. By non-compliance they meant a no response to email or no action to comply with takedown requests from copyright owners. It is very much a small group of operators they have this narrowed down to. He provided a breakdown of different types of hosting content, of which live TV streaming fairly down on the list at 3%, the majority of hosted content was phishing, malicious use and malware. beIN wanted legal clarity on the obligation of hosting providers to take down live content in real time. On top of the digital services act, the EU was looking at a number of options to mitigate these risks. Critical issue of live piracy of audiovisual content. They are looking for collaboration and help across the Internet ecosystem. There were no questions or comments. The €30 attack box: inside the Android TV botnet ecosystem Jérôme Meyer Jérôme Meyer, a security researcher at Nokia, examined the rise of Android TV-based botnets and residential proxies, which now play a major role in large-scale DDoS attacks. He explained that low cost Android TV devices often arrive already compromised, allowing attackers to build botnets that can generate terabit-scale attacks and provide access to residential networks. Meyer stressed that operators should look beyond attack traffic and focus on detecting command-and-control activity. He concluded that network-edge disruption can be effective, but requires coordinated action from operators. Lutz Donnerhacke, IKS Service GmbH, said that they had an ISP running numerous NAT devices and have had the same problems. They noticed that their devices were being broken and that they looked for outgoing packets without an active connection, and generated statistics which helped them track down devices in customer networks. He said he is interested to hear from others in how they detect such devices. Jérôme replied that they have observed that a lot of proxy exit nodes were very chatty, and have a lot of long-lived TCP connections, and a combination of these two behaviours was a good way to detect proxy nodes. Victor Guerrero, VGS, said they were suffering this on the server side. They had a large customer base and they had begun to see large traffic coming from Brazil since last August. They blocked traffic from America but then the attacks started to come from Africa. He asked for ideas on how to detect this pattern before it hits the server. He said they could block traffic once there was at least one ping to the server and they were not attacking the infrastructure, but the server. He added that it can generate requests from 30,000 IPs in less than 5 minutes. It’s impossible to deal with that in an effective way, and that he is open to ideas. Jérôme replied that they should not single out Brazil and although it’s the top source of traffic, it was really from everywhere. It was trivial to rotate between tens of thousands of IP addresses and there had been efforts to characterise the traffic that was proxied through those nodes. He added that there may be a way to have a signal do some detection. Trust but Verify: An Assessment of Vulnerability Tagging Services Szu-Chun Huang, TU Delft Szu-Chun Huang presented research evaluating the accuracy of three Internet vulnerability tagging services. The study compared reports against independent vulnerability scans and controlled testing using intentionally vulnerable systems. The results revealed significant discrepancies between the services, raising concerns about the completeness and reliability of vulnerability reports used to assess Internet security risks. There were no questions or comments. Security WG RIPE 92 Outro Brian Nisbet A.O.B. There was no other business. Agenda for RIPE 93 Brian then closed the session and encouraged the audience to use the Security Working Group mailing list for discussion. Brian Nisbet (he/him) Head of Service Operations Asiera (formerly HEAnet), Ireland's National Research and Education Network North Dock Two, 93-94 North Wall Quay, Dublin 1, D01 V8Y6 +35316609040 brian.nisbet(a)asiera.ie www.heanet.ie<http://www.heanet.ie> www.asiera.ie<https://www.asiera.ie/> Registered in Ireland, No. 275301. CRA No. 20036270

1 0

New on RIPE Labs: What We Learned from a Multi-Service Vulnerability Disclosure
by Eleonora Petridou 10 Jun '26

10 Jun '26

Dear colleagues, Following the conversation at RIPE 92 around Sasha Romijn's presentation on our bug bounty program, I've written a RIPE Labs article about some of the practical lessons that came out of the recent coordinated vulnerability disclosure: https://labs.ripe.net/author/eleonora-petridou/what-we-learned-from-a-multi… Kind regards, Eleonora -- [image: This is Eleonora Petridou's card. Their email is epetridou(a)ripe.net. Their phone number is +31 6 55225554. Their phone number is +31 20 535 4444.] <https://hihello.me/p/d9c852ea-239c-4453-a05a-39552bc9e194?sharer_id=UAhnsts…>

1 0

Draft Agenda - Security WG @ RIPE 92
by Brian Nisbet 06 May '26

06 May '26

Colleagues, Please find below the draft agenda for our session at RIPE 92 in Edinburgh. The Security WG will be meeting on Tuesday afternoon at 16:00 WEST/UTC +1 both physically and online. We have a pretty packed agenda for this meeting, but if there is something vital you need to talk to the WG about, please contact security-wg-chairs(a)ripe.net and let us know and we'll see! A. Administrative Matters * Welcome * Scribe, Chat, Stenography * MeetEcho, Mic & Chat Etiquette * Ratings Where Appropriate * Approve Minutes from RIPE 91 * New Meeting System - Pretalx * Finalise agenda * Code of Conduct B. Update * B.1. Recent List Discussion * B.2. RIPE NCC LEA Transparency Report & eEvidence Implementation - Athene Fragkouli, RIPE NCC C. Policies - *C.1. D. Interactions - *D.1. Residential Proxies and Infecting Infrastructure Working Session - Leslie Daigle, Global Cyber Alliance E. Presentation - *E.1. The Moving Parts of Copyright and Cybercrime, Lee Kent, BEIN *E.2. The €30 attack box: inside the Android TV botnet ecosystem - Jérôme Meyer, Nokia Deepmind *E.3. Trust but Verify: An Assessment of Vulnerability Tagging Services - Szu-Chun Huang, TU Delft X. A.O.B. Z. Agenda for RIPE 93 The agenda will go up on the RIPE 92 website once the Co-Chairs do the necessary bits and bobs and then the meeting team does its magic. Looking forward to seeing lots of you in person and online in Edinburgh! Brian, Marcus, Tobias Brian Nisbet (he/him) Head of Service Operations Asiera (formerly HEAnet), Ireland's National Research and Education Network North Dock Two, 93-94 North Wall Quay, Dublin 1, D01 V8Y6 +35316609040 brian.nisbet(a)asiera.ie www.heanet.ie<http://www.heanet.ie> www.asiera.ie<https://www.asiera.ie/> Registered in Ireland, No. 275301. CRA No. 20036270

1 0

@EXT: Europol EC3 Cyber Innovation Forum 2026 - Call-for-Proposals
by Iovini, Emanuele 10 Apr '26

10 Apr '26

Dear Security Working Group, I hope this e-mail finds you well. I'm Emanuele Iovini and I work at Europol the European Cybercrime Centre (EC3). I believe it could be valuable to share this message here. Among many initiatives in Europe, EC3 launched a Cyber Innovation Forum (CIF) that brings together law enforcement, policymakers, industry, and academia to explore cutting-edge approaches to cybercrime investigation and prevention. The forum aims to foster collaboration, share practical innovations, and shape the future response to cybercrime. The EC3 Policy and Development team just announced a Call-for-Proposals for the EC3 Cyber Innovation Forum 2026 (CIF2026). The aim of the Call-for-Proposals is to find original and impactful ideas that support law enforcement innovation in cybercrime investigation, prevention, and resilience. Are invited, including but not limited to: * Tools and technologies supporting cybercrime detection, investigation, attribution, and disruption; * Research papers and applied studies with operational, strategic, or policy relevance; * Investigative techniques and methodologies, including cross-border and multi-stakeholder approaches; * Legislation, regulatory frameworks, and legal analysis related to cybercrime and digital evidence; * Policies, strategies, and best practices for prevention, capacity building, and public-private cooperation; * Case studies and lessons learned from real-world operations or implementations. Submissions may be conceptual, technical, operational, legal, or policy-oriented, provided they offer clear value to the cybercrime ecosystem. Proposals can be submitted until Friday, 19 June 2026 at 23:59 (CET - Amsterdam time). The CIF2026 will take place the second week of October 2026 (date to be confirmed). More information can be found in the link below: https://www.europol.europa.eu/about-europol/european-cybercrime-centre-ec3/… I will also be in Edinburgh for RIPE92 from the 19th to the 21th of May if anyone wants to chat in person with me. Best regards, Emanuele _____________________________________________ Emanuele Iovini O3-21 Prevention and Outreach Team - E-Governance Specialist Europol - European CyberCrime Centre (EC3) Tel: 31 70 3531246 * M: +31 615398740 emanuele.iovini(a)europol.europa.eu<mailto:emanuele.iovini@europol.europa.eu> www.europol.europa.eu<http://www.europol.europa.eu/> _____________________________________________

1 0

Re: Call For Agenda Items - Security WG @ RIPE 92
by Lee Kent 02 Apr '26

02 Apr '26

Dear Brian, I hope all is well? I’m trying to access Pretalx to submit a proposal to speak at the Security WG; however, I keep getting an error. I have informed RIPE NCC, but in case the issue is not resolved before the deadline, can I be added to the proposal list manually? Regards, Lee [cid:bein_new_dec8_2016_998e31e6-b00f-4b69-84be-4b299ec5c5b3.png] Lee Kent Content Protection Manager [cid:mail_4cd8140c-195b-42e5-87d4-d70d62158c45.png] kentl(a)bein.com<mailto:kentl@bein.com> [cid:phone_80b7ef20-49da-44f4-98a6-6f4435d85872.png] | [cid:mobile_7188e352-4077-43ce-9f23-9e46619fced0.png] +44 755 256 8291 | [cid:map_f64e4ac2-9790-4cfa-8777-430a29a07b98.png] London, UK [cid:EmailSignature_v4-01(2)_07ff29a7-9842-4bca-bde7-18c8483b4403.png]<https://www.beinmediagroup.com/activities/> www.beinmediagroup.com<http://www.beinmediagroup.com> This email is intended only for the use of the individual or entity named above and may contain information that is confidential and privileged. If you are not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this email is strictly prohibited. Opinions, conclusions and other information in this message that do not relate to the official business of our firm shall be understood as neither Given nor endorsed by it. [cid:env_f524e892-8b99-4f79-b11a-e4cc575f186e.png] Please consider environment before printing this email. From: Brian Nisbet <brian.nisbet(a)heanet.ie> Date: Wednesday, 25 February 2026 at 15:35 To: "security-wg(a)ripe.net" <security-wg(a)ripe.net> Subject: [Security-wg] Call For Agenda Items - Security WG @ RIPE 92 CAUTION: This email originated from outside of beIN. Do not click links or open attachments unless you recognize the sender and know the content is safe Colleagues, RIPE 92 is coming over the horizon and we would like to open the call for agenda items for the meeting. RIPE 92 will be taking place from the 18th - 22nd May 2026 in Edinburgh, Scotland. The Security WG session will be taking place at 16:00 UTC +1 on Tuesday 19th May. As with RIPE 91 (and beyond!), all plenary and working group proposals can be submitted through the same system, Pretalx. Please submit your proposals by 10th April 2026 via: https://pretalx.ripe.net/ripe-92/ marking them for the Security WG When submitting, please keep in mind: - Talk type: This field is not relevant for our WG – you may simply choose “Talk”. - Track: Please select "Security WG". - Duration: Indicate the total time you will need, including Q&A. More information on how to submit a talk can be found here: https://ripe92.ripe.net/present/how-to-submit-a-proposal/ The WG is interested in policy proposals, discussions, presentations and other formats that are relevant to us. These may touch of operational security matters, issues that people are seeing, legislation or regulation, emerging trends or the like. One potential area of interest is existing or emerging threats related to AI/LLMs, or tools in that area. This is not an opportunity for sales pitches or similar, rather to discuss and raise awareness about security related matters that are happening in the real world. If you have questions about potential topics or the session in general, feel free to reach us at security-wg-chairs(a)ripe.net. As usual, both in-person and remote participation in the working group will be possible. We look forward to your submissions. Best regards, Brian, Tobias, Markus Brian Nisbet (he/him) Head of Service Operations Asiera (formerly HEAnet), Ireland's National Education and Research Network North Dock Two, 93-94 North Wall Quay, Dublin 1, D01 V8Y6 +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie<http://www.heanet.ie> www.asiera.ie<https://www.asiera.ie/> Registered in Ireland, No. 275301. CRA No. 20036270 <p></p>

1 0

LEA Transparency Report 2025
by Theodoros Fyllaridis 31 Mar '26

31 Mar '26

Dear colleagues, We have published a transparency report that details the nature and number of requests we received from Law Enforcement Authorities in 2025. You can find the report at: https://www.ripe.net/publications/docs/ripe-854/ Kind regards, Theodoros Fyllaridis Legal Counsel RIPE NCC

1 0