- Security-wg - mailman.ripe.net

Recent Emails
by Brian Nisbet 16 May '25

16 May '25

Colleagues, Recently there have been some very off topic and repeated emails to the group from someone who was previously removed from the Anti-Abuse WG Mailing List for repeated unacceptable behaviour. After the first email we put them into moderation and they chose to deal with this by subscribing a new address and sending the same email. The Co-Chairs will be reinforcing the ban as it did not carry over. And temporarily we have put a moderation hold on subscribing to the mailing list, but hopefully we won't need that for too long. If you have any questions about this, please ask, but we won't be going back over the reasons for the ban in the first place. Thank you, Brian Co-Chair, RIPE Security WG Brian Nisbet (he/him) Head of Service Operations HEAnet CLG, Ireland's National Education and Research Network North Dock Two, 93-94 North Wall Quay, Dublin 1, D01 V8Y6 +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

1 0

Second post in NANOG
by elad＠afri.holdings 15 May '25

15 May '25

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hello, I kindly bring my following linked second post in NANOG to the attention of the RIPE community: https://lists.nanog.org/archives/list/nanog@lists.nanog.org/thread/25GSIL2G… Kind Regards, Elad -----BEGIN PGP SIGNATURE----- Version: ProtonMail wrsEARYKAG0FgmgmRrAJkAOTxlTETyIURRQAAAAAABwAIHNhbHRAbm90YXRp b25zLm9wZW5wZ3Bqcy5vcmeZxuCF42Y5ghWDY5XQRJjuBySZLBeyUbp675aY 082juRYhBIDKpTRODxrUC0u8qAOTxlTETyIUAACEDAD/ZxfZbIlbmMjFnUIY JeNLrfiZKdNWGsD/GSPQD3MRJ+4A/2q0GW9M1xTxWs56/6sGdZ6mWRcDxL7B nMMhpJ39bdMF =Dp/s -----END PGP SIGNATURE-----

1 0

Post in NANOG
by info＠netstyle.io 14 May '25

14 May '25

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hello, I kindly bring my following linked post in NANOG to the attention of the RIPE community: https://lists.nanog.org/archives/list/nanog@lists.nanog.org/thread/25GSIL2G… Kind Regards, Elad -----BEGIN PGP SIGNATURE----- Version: ProtonMail wsG5BAEBCgBtBYJoJHNXCZCAS+uEnipSW0UUAAAAAAAcACBzYWx0QG5vdGF0 aW9ucy5vcGVucGdwanMub3JncpnCjtqDqw3hbUjc7g60Fq6RVx3RVpzEjxXI SYw6lvwWIQTD50Y2bI5NSOj/nnWAS+uEnipSWwAADCgP/RxcnOV09msZ7CPk jbJ8n6BKACQmOwzdTiqbU/cETyUj9ur868arK6iqVpt7U/MfmZ3ZF6LuIjs1 kz/8I69KewMpmKnsgu7v1yXlEY0WXubRix3KXoQsNFXm835SK2jgr7+rzyzU wzcYq8wlYRnfwAG4uyztEM76kmjl9Dql3q2E5UCk1hpLwPFOUjQmFwKYQKjx 7v9q2AKI+C24v15DwuubyT++FGMsAL9GQI9mJZ5S4wTaCmNj0Ma3/AFLnFbI +3ER5aiaGcbg8xVJHEHPXSbEJOxk3cjJxVm3fH44UOS7KZxdtA76/Jovfqqn 0uoB6HvRYhD66mU1GsQEGE2/HjAuYTSQYECOxcfTImtWelnqpg5N0y3Uyt9a v3LiskpP1Pw+xtoZK0ZqSGAB5SqROEFaGny3U5zALS4xI6T4Wqm4b2SgXwFx pFY1OnO/uA8iigHBNN85VcjXc1Vi3BX1rTGZil/JVkpoSZPP23Q90fvvp27p +7BQcpnmD7g/NyjCfjmylHG2Wx/rBBIPv8Q40aHfAy3EqDjMq6RZnNtWK1Iw miSAq+hfSiVhXL5wwMeZH8x7zS5sb8WbSU1fDViey3HpC5qUJU/wa31l2rnh /DqpINvlJ6XIzcXbdEWFV9kDGLkQvdiu7/PD88WDuWjoVvJepTeCiFc/siGc ConMBcs4 =kDGD -----END PGP SIGNATURE-----

1 0

Fwd: [comms-circle] [ripe-list] RIPE NCC Trust Portal Launched
by Dick Leaning 14 May '25

14 May '25

Morning - As I mentioned in my presentation yesterday during the security WG session at RIPE 90 - am keen to get feedback from the working group on how we can make sure the Trust Portal - Law enforcement and competent Authority section, is meaningful. What is missing for example - what materials, documents do we need to add, should there be a FAQ’s etc Any ideas/suggestions, can you please email me direclty dleaning(a)ripe.net <mailto:dleaning@ripe.net> Kind Regards Dick > Begin forwarded message: > > From: Eleonora Petridou <epetridou(a)ripe.net> > Subject: [comms-circle] [ripe-list] RIPE NCC Trust Portal Launched > Date: 8 May 2025 at 12:19:03 GMT+1 > To: ripe-list(a)ripe.net > > Dear colleagues, > > We have launched a new Trust Portal to provide greater transparency into our operations and to help members and stakeholders better understand how we manage our security, compliance, and governance: > https://trust.ripe.net/ > > The portal provides a comprehensive overview of how we protect the confidentiality, integrity, and availability of our services. It includes key policies and processes covering information security, data protection, vulnerability management, and incident response. It also highlights our compliance with frameworks like SOC 2 for RPKI services, our progress toward ISO 27001 certification, and adherence to GDPR and other relevant EU regulations. > > For law enforcement and other competent authorities, the Trust Portal also provides guidance on how to request information from the RIPE NCC, and links to other useful supporting information. > > We invite you to explore the Trust Portal, and welcome any feedback as we continue improving our transparency. Email security(a)ripe.net <mailto:security@ripe.net> if you would like to know more. > > Kind regards, > > Eleonora Petridou > Chief Information Security Officer > RIPE NCC > > ----- > To unsubscribe from this mailing list or change your subscription options, please visit: https://mailman.ripe.net/mailman3/lists/ripe-list.ripe.net/ > As we have migrated to Mailman 3, you will need to create an account with the email matching your subscription before you can change your settings. > More details at: https://www.ripe.net/membership/mail/mailman-3-migration/

1 0

Fw: [ripe-list] RIPE NCC Trust Portal Launched
by Brian Nisbet 08 May '25

08 May '25

Folks, In case there are people here who aren't on the RIPE List, I wanted to ensure you were aware of the launch of the NCC Trust Portal. Brian Brian Nisbet (he/him) Head of Service Operations HEAnet CLG, Ireland's National Education and Research Network North Dock Two, 93-94 North Wall Quay, Dublin 1, D01 V8Y6 +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270 ________________________________ From: Eleonora Petridou <epetridou(a)ripe.net> Sent: Thursday 8 May 2025 12:19 To: ripe-list(a)ripe.net <ripe-list(a)ripe.net> Subject: [ripe-list] RIPE NCC Trust Portal Launched CAUTION[External]: This email originated from outside of the organisation. Do not click on links or open the attachments unless you recognise the sender and know the content is safe. Dear colleagues, We have launched a new Trust Portal to provide greater transparency into our operations and to help members and stakeholders better understand how we manage our security, compliance, and governance: https://trust.ripe.net/ The portal provides a comprehensive overview of how we protect the confidentiality, integrity, and availability of our services. It includes key policies and processes covering information security, data protection, vulnerability management, and incident response. It also highlights our compliance with frameworks like SOC 2 for RPKI services, our progress toward ISO 27001 certification, and adherence to GDPR and other relevant EU regulations. For law enforcement and other competent authorities, the Trust Portal also provides guidance on how to request information from the RIPE NCC, and links to other useful supporting information. We invite you to explore the Trust Portal, and welcome any feedback as we continue improving our transparency. Email security(a)ripe.net<mailto:security@ripe.net> if you would like to know more. Kind regards, Eleonora Petridou Chief Information Security Officer RIPE NCC

1 0

Fancy testing an email authentication protocol? Fix-forwarding
by Alessandro Vesely 02 May '25

02 May '25

Hi all, bear with me for a quick recap, please (or skip to the next paragraph.) SPF arose around 2000 and became popular within a few years. However, SPF breaks forwarding. So, as an authentication alternative, DomainKeys came along, which became DKIM in 2007. However, DKIM lacks a policy. It merely permits a domain "to claim some responsibility for a message". Policy discussions began in 2007 with DKIM Sender Signing Practices (SSP), which became ADSP in 2008, was published in 2009 and became historic in 2013. DMARC started in 2012, non-standard publication is in 2015, standard publication is expected later this year, after 11+ years of IETF discussion. However, DMARC breaks mailing lists. To address "the issues with indirect mail flows", the DMARC WG came up with the ARC protocol, 2019, a flop. A new protocol, codenamed DKIM2, is taking shape at the IETF now. It is intended to solve not only the mailing list problem, but also DKIM replay and the backscatter generated by provisionally accepted messages that are then bounced. However, DKIM2 is unlikely to become widespread quickly, in part because of the changes it requires at the SMTP level. The reason why ARC has not bee successful is that it isn't clear how to distinguish a legitimate forwarder from a malicious one, both of which ARC-seal. In fact, an attacker can produce an ARC set that is the last one after a chain composed of any domains she wants. IMHO, the only solution is to ask the recipient, for each forwarded flow, including mailing lists, whether it is wanted. I drafted a protocol for this, but I didn't have a chance to discuss it in the DMARC WG because, after years, it closed in a hurry. Other WGs or the ISE are not inclined to consider proposals that no one has implemented yet. So I'm looking for aspiring pioneers for this protocol (or at least figure out what would be wrong with it.) https://datatracker.ietf.org/doc/html/draft-vesely-fix-forwarding Fancy? Best Ale --

1 0

Abusive ASN
by Eric Schechter 29 Apr '25

29 Apr '25

Hello, there is a cloud provider with RIPE ASNs that is hosting all kinds of abusive content from port scanning to malware and doesnt respond to any abuse emails, they have been outed but pretend they are innocent I'm currently being port scanned by pfcloud.io IPs and they havent responded to a single abuse report in months can anything be done about this malicious host? https://x.com/pfcloudio/status/1877064925262012466

3 2

Draft Agenda: Security WG @ RIPE 90
by Brian Nisbet 23 Apr '25

23 Apr '25

Colleagues, The Security WG will be meeting at RIPE 90 in Lisbon this May. The session will be at 16:00 WEST (UTC +1) on Tuesday 13th May. The draft agenda is as follows: A. Administrative Matters * Welcome * Scribe, Chat, Stenography * MeetEcho, Mic & Chat Etiquette * Ratings Where Appropriate * Approve Minutes from RIPE 89 * Finalise agenda * Code of Conduct B. Update * B.1. Recent List Discussion * B.2. RIPE NCC LEA Transparency Report & Activities, Dick Leaning, RIPE NCC C. Policies - *C.1. D. Interactions - *D.1. "Europol Capacities and Effort Supporting Law Enforcement Against Cybercrime" Emanuele Iovini, Europol E. Presentation - *E.1. "INFERMAL: Inferential Analysis of Maliciously Registered Domains" Samaneh Tajali, ICANN X. A.O.B. Z. Agenda for RIPE 91 If you have any items you would like to raise or discuss at the meeting, please let us know at security-wg-chairs(a)ripe.net soon as there is limited time left in the agenda. Regards, Brian, Markus & Tobias Co-Chairs, Security WG Brian Nisbet (he/him) Head of Service Operations HEAnet CLG, Ireland's National Education and Research Network North Dock Two, 93-94 North Wall Quay, Dublin 1, D01 V8Y6 +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

1 1

LEA Transparency Report 2024
by Theodoros Fyllaridis 03 Apr '25

03 Apr '25

Dear colleagues, We have published a transparency report that details the nature and number of requests we received from Law Enforcement Authorities in 2024. You can find the report at: https://www.ripe.net/publications/docs/ripe-839/ . Kind regards, Theodoros Fyllaridis Legal Counsel RIPE NCC

6 9

Call For Agenda Items - Security WG @ RIPE 90
by Brian Nisbet 05 Mar '25

05 Mar '25

Colleagues, RIPE 90 - https://ripe90.ripe.net/ - will be taking place this May in Lisbon, and there will be a Security WG session at the meeting on the afternoon of Tuesday 13th May. Registration for the meeting, running from the 12th May - 16th May, is open. Markus, Tobias and I would invite people to submit topics for discussion, policy proposals, presentations for general enlightenment and, of course, work items for the working group. As a reminder, the charter of the new/evolved WG is here: https://www.ripe.net/community/wg/active-wg/security/ Speakers & presenters can either be present in Lisbon or come to us live via the Internet, but we would encourage physical attendance if possible. The Security WG session will be taking place on the 13th of May at 16:00 WEST (UTC +1). As always you can reach us at security-wg-chair(a)ripe.net Thanks, Brian Co-Chair RIPE Security WG Brian Nisbet (he/him) Service Operations Manager HEAnet CLG, Ireland's National Education and Research Network North Dock Two, 93-94 North Wall Quay, Dublin 1, D01 V8Y6 +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

1 0