<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<div class="moz-cite-prefix">On 17/2/22 17:29, Joly MacFie wrote:</div>
<div class="moz-cite-prefix"><br>
<blockquote type="cite">I can't quite grasp how something can be
both public and unknown.. Sounds like speculation to me. <br>
</blockquote>
Sure, but as presented the report also appears speculative. We
simply don't know at this point whether there was or was not
unauthorised access other than by Clario and neither does Clario.
ISoc presumably does either:</div>
<div class="moz-cite-prefix">
<ul>
<li> know, because either all or not all accesses were
authorised or Clario's; or</li>
<li>know that this is unknowable (because logging was turned
off)</li>
</ul>
but hasn't at this point shared this information. This is a
problematic situation for dozens of chapters, whether or not
anyone happens also to have information indicating active
exploitation.<br>
</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">- Roland</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">
<hr width="100%" size="2"><br>
</div>
<div class="moz-cite-prefix">On 17/2/22 17:29, Joly MacFie wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CAM9VJk1Ek4kY-4X9UCPk5+GsE--1M9ZOjsy4JaOvjUN=5jv6pA@mail.gmail.com">
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<div dir="ltr">
<div class="gmail_default" style="font-size:small">> It
states that it was publicly indexed, </div>
<div class="gmail_default" style="font-size:small"><br>
</div>
<div class="gmail_default" style="font-size:small">by an
"Unknown public search engine" </div>
<div class="gmail_default" style="font-size:small"><br>
</div>
<div class="gmail_default" style="font-size:small">I can't
quite grasp how something can be both public and unknown..
Sounds like speculation to me. </div>
<div class="gmail_default" style="font-size:small"><br>
</div>
<div class="gmail_default" style="font-size:small">What is more
likely is that Clario were methodically running pen tests on
AWS blobs, and got lucky.</div>
<div class="gmail_default" style="font-size:small"><br>
</div>
<div class="gmail_default" style="font-size:small">joly</div>
</div>
<br>
<div class="gmail_quote">
<div dir="ltr" class="gmail_attr">On Thu, Feb 17, 2022 at 4:07
AM Roland Turner via Chapter-delegates <<a
href="mailto:chapter-delegates@elists.isoc.org"
moz-do-not-send="true" class="moz-txt-link-freetext">chapter-delegates@elists.isoc.org</a>>
wrote:<br>
</div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px
0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div>
<div>On 17/2/22 16:39, Joly MacFie via Chapter-delegates
wrote:</div>
<div><br>
</div>
<blockquote type="cite">
<div dir="ltr">
<div dir="ltr">
<div class="gmail_default" style="font-size:small">As
reported by which 3rd parties? The <a
href="https://clario.co/blog/internet-society-member-data-breach/"
target="_blank" moz-do-not-send="true">Clario
statement</a> only says the data was unprotected,
not that it was exploited.</div>
</div>
</div>
</blockquote>
<p>It states that it was publicly indexed, which would
require very substantial unauthorised access, vs. merely
the potential exposure which has been reported so far.<br>
</p>
<p>Granted, it states somewhat confusingly that it was
publicly indexed by an "unknown" public search engine.
(How would they know that?)<br>
</p>
<p>- Roland</p>
<p><br>
</p>
<hr width="100%" size="2">
<p><br>
</p>
<blockquote type="cite">
<div dir="ltr">
<div dir="ltr">
<div class="gmail_default" style="font-size:small"><br>
</div>
<div class="gmail_default" style="font-size:small">j</div>
</div>
<br>
<div class="gmail_quote">
<div dir="ltr" class="gmail_attr">On Thu, Feb 17, 2022
at 3:33 AM Winthrop Yu via Chapter-delegates <<a
href="mailto:chapter-delegates@elists.isoc.org"
target="_blank" moz-do-not-send="true"
class="moz-txt-link-freetext">chapter-delegates@elists.isoc.org</a>>
wrote:<br>
</div>
<blockquote class="gmail_quote" style="margin:0px 0px
0px 0.8ex;border-left:1px solid
rgb(204,204,204);padding-left:1ex">
<div>
<p>On 17 Feb 2022 10:13 am, Joly MacFie wrote:<br>
</p>
<blockquote type="cite">
<div dir="ltr">
<div style="font-size:small">While I concur
with concerns about the transparency, I will
just say that there is a difference between
a breach and a detected vulnerability, so
let's not get ahead of ourselves.</div>
<div style="font-size:small"><br>
</div>
</div>
</blockquote>
<p>If the vulnerability were unexploited that
distinction may hold. If, as reported by 3rd
parties, there is ISOC member data out there,
then clearly there was a breach. In any case, i
believe notification requirements apply, here in
our jurisdiction if not in yours. <br>
<br>
</p>
<blockquote type="cite">
<div dir="ltr">
<div style="font-size:small">What does seem
odd is the length of time between the
discovery and the reaction.</div>
<div style="font-size:small"><br>
</div>
</div>
</blockquote>
<p>ISOC HQ told us to expect more information
(clarification, details, etc.), we waited
patiently as is proper. Should chapters have
done otherwise -- speak now or forever hold your
peace? :) <br>
</p>
<p><br>
WYn<br>
</p>
<br>
<blockquote type="cite">
<div class="gmail_quote">
<div dir="ltr" class="gmail_attr">On Wed, Feb
16, 2022 at 7:35 PM Winthrop Yu via
Chapter-delegates <<a
href="mailto:chapter-delegates@elists.isoc.org"
target="_blank" moz-do-not-send="true"
class="moz-txt-link-freetext">chapter-delegates@elists.isoc.org</a>>
wrote:<br>
</div>
<blockquote class="gmail_quote"
style="margin:0px 0px 0px
0.8ex;border-left:1px solid
rgb(204,204,204);padding-left:1ex">
<div>
<p>Olivier, we don't need press releases
or "updates". <br>
</p>
<p>At the very least, we need: <br>
</p>
<p>a) a clear, comprehensive yet concise
official statement from ISOC HQ
regarding the breach. <br>
</p>
<p>b) including whether ISOC HQ has
notified <b>all</b> its global members
(which would include the individual
members of chapters).</p>
<p>That above is a bare minimum. Then we
will have to check that against any
obligations the chapter itself may have
under local law. And we may subsequently
need further clarification / statements
from ISOC HQ. <br>
</p>
<p>WYn<br>
</p>
<p><br>
</p>
<div>On 17 Feb 2022 1:45 am, Olivier MJ
Crépin-Leblond via Chapter-delegates
wrote:<br>
</div>
<blockquote type="cite"> Am I the only one
in Chapter Delegates mailing list who
received and read the email from
Christine Saegesser explaining the
problem with MemberNova and referring
to:<br>
<br>
"As we noted in our prior email, after
we learned of the issue, we launched an
investigation. The investigation
is continuing, and we will provide more
details when we have more information to
share. Going forward, updates will
be posted at <a
href="http://updates.internetsociety.org"
target="_blank" moz-do-not-send="true">updates.internetsociety.org</a>,
and we encourage you to check there for
additional information. The membership
password to access this website
is ISOC-AMS-Updates (case sensitive)."<br>
<br>
Or is the problem that there does not
appear to have been any updates since
21st January 2021?<br>
<br>
Kindest regards,<br>
<br>
Olivier<br>
<br>
<br>
<div>On 16/02/2022 14:54, Veni Markovski
via Chapter-delegates wrote:<br>
</div>
<blockquote type="cite"> <font
face="Helvetica, Arial, sans-serif">+1
to the request for more clarity; our
members need to be informed, and I
don't want to share on social media
a link to an article on some
website. There should be something
at <a href="http://isoc.org"
target="_blank"
moz-do-not-send="true">isoc.org</a>,
and in the news section there's only
one press release from 2022 - on
February 4. <br>
<br>
Also, it's not a good thing to find
out from a publication about some of
the details (I assume not all of
them)...<br>
<br>
v/<br>
</font><br>
<div>On 2/16/22 04:19, Roland Turner
via Chapter-delegates wrote:<br>
</div>
<blockquote type="cite">
<div>Andrew,</div>
<div><br>
</div>
<div>Could we have a little more
clarity on this please? Chapter
members in multiple jurisdictions
may have notification obligations
arising from this.</div>
<div><br>
</div>
<div><br>
</div>
<div>The <a
href="https://updates.internetsociety.org/"
target="_blank"
moz-do-not-send="true">Jan 21</a>
update states:</div>
<div>
<blockquote type="cite">Fortunately,
we have still not seen any
instances of malicious access to
member data as a result of this
issue.</blockquote>
</div>
<div><br>
</div>
<div>This appears a little unclear
to me on two important fronts:</div>
<div><br>
</div>
<div><b>"have not seen"</b></div>
<div><br>
</div>
<div>An adversarial read of this is
the rather horrifying idea that
access logging was not turned on,
so you (and MemberNet) haven't the
faintest idea whether there were
any unauthorised accesses, which
would certainly allow you say that
you hadn't seen any unauthorised
accesses but wouldn't mean that
there weren't any, even at a
reasonable level of confidence.
Hopefully this is not the case!</div>
<br>
<div><b>"malicious access"</b></div>
<div><br>
</div>
<div>The relevant question is not
whether any accesses could be
described as malicious, but simply
whether they were unauthorised. An
adversarial read of this is that
there were unauthorised accesses,
but because you don't have much
information about the unauthorised
accessers you not in a position to
say that they were acting
maliciously, however this would
tell us nothing about whether
there had been unauthorised
access. Again, hopefully this is
not the case!</div>
<div><br>
</div>
<div><br>
</div>
<div>To address both concerns, are
you able to confirm that:</div>
<div>
<div>
<ol>
<li>access logging was turned
on and the logs were
successfully secured;<br>
</li>
<li>the logs appear to be
complete (in this case
"appear to" is fine; the
requirement is simply that
there are no unexplained
gaps); and<br>
</li>
<li>all logged accesses are
authorised (i.e. because
they were made by the
application server, not
random external IP
addresses)</li>
</ol>
?<br>
</div>
<div><br>
</div>
</div>
<p><br>
</p>
<p>- Roland</p>
<p><br>
</p>
<hr width="100%" size="2"><br>
<div>On 16/2/22 15:41, Hank
Nussbacher via Chapter-delegates
wrote:<br>
</div>
<blockquote type="cite">
<pre>In case you missed it:
<a href="https://www.infosecurity-magazine.com/news/internet-society-data-leaked/" target="_blank" moz-do-not-send="true" class="moz-txt-link-freetext">https://www.infosecurity-magazine.com/news/internet-society-data-leaked/</a>
Regards,
Hank
_______________________________________________</pre>
</blockquote>
</blockquote>
</blockquote>
</blockquote>
</div>
</blockquote>
</div>
</blockquote>
</div>
_______________________________________________<br>
As an Internet Society Chapter Officer you are
automatically subscribed<br>
to this list, which is regularly synchronized with
the Internet Society Chapter Portal (AMS):<br>
<a
href="https://admin.internetsociety.org/622619/User/Login"
rel="noreferrer" target="_blank"
moz-do-not-send="true"
class="moz-txt-link-freetext">https://admin.internetsociety.org/622619/User/Login</a><br>
View the Internet Society Code of Conduct: <a
href="https://www.internetsociety.org/become-a-member/code-of-conduct/"
rel="noreferrer" target="_blank"
moz-do-not-send="true"
class="moz-txt-link-freetext">https://www.internetsociety.org/become-a-member/code-of-conduct/</a><br>
</blockquote>
</div>
<br clear="all">
<div><br>
</div>
-- <br>
<div dir="ltr">
<div dir="ltr">
<div>
<div dir="ltr">
<div>
<div>--------------------------------------<br>
Joly MacFie +1<span title="Call with Google
Voice">2185659365</span> </div>
<div>--------------------------------------</div>
-</div>
</div>
</div>
</div>
</div>
</div>
<br>
<fieldset></fieldset>
<pre>_______________________________________________
As an Internet Society Chapter Officer you are automatically subscribed
to this list, which is regularly synchronized with the Internet Society Chapter Portal (AMS):
<a href="https://admin.internetsociety.org/622619/User/Login" target="_blank" moz-do-not-send="true" class="moz-txt-link-freetext">https://admin.internetsociety.org/622619/User/Login</a>
View the Internet Society Code of Conduct: <a href="https://www.internetsociety.org/become-a-member/code-of-conduct/" target="_blank" moz-do-not-send="true" class="moz-txt-link-freetext">https://www.internetsociety.org/become-a-member/code-of-conduct/</a>
</pre>
</blockquote>
<p><br>
</p>
</div>
_______________________________________________<br>
As an Internet Society Chapter Officer you are automatically
subscribed<br>
to this list, which is regularly synchronized with the
Internet Society Chapter Portal (AMS):<br>
<a href="https://admin.internetsociety.org/622619/User/Login"
rel="noreferrer" target="_blank" moz-do-not-send="true"
class="moz-txt-link-freetext">https://admin.internetsociety.org/622619/User/Login</a><br>
View the Internet Society Code of Conduct: <a
href="https://www.internetsociety.org/become-a-member/code-of-conduct/"
rel="noreferrer" target="_blank" moz-do-not-send="true"
class="moz-txt-link-freetext">https://www.internetsociety.org/become-a-member/code-of-conduct/</a><br>
</blockquote>
</div>
<br clear="all">
<div><br>
</div>
-- <br>
<div dir="ltr" class="gmail_signature">
<div dir="ltr">
<div>
<div dir="ltr">
<div>
<div>--------------------------------------<br>
Joly MacFie +1<span title="Call with Google Voice">2185659365</span> </div>
<div>--------------------------------------</div>
-</div>
</div>
</div>
</div>
</div>
</blockquote>
<p><br>
</p>
</body>
</html>