<html>
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
  </head>
  <body>
    <div class="moz-cite-prefix">On 17/2/22 17:29, Joly MacFie wrote:</div>
    <div class="moz-cite-prefix"><br>
      <blockquote type="cite">I can't quite grasp how something can be
        both public and unknown.. Sounds like speculation to me. <br>
      </blockquote>
      Sure, but as presented the report also appears speculative. We
      simply don't know at this point whether there was or was not
      unauthorised access other than by Clario and neither does Clario.
      ISoc presumably does either:</div>
    <div class="moz-cite-prefix">
      <ul>
        <li> know, because either all or not all accesses were
          authorised or Clario's; or</li>
        <li>know that this is unknowable (because logging was turned
          off)</li>
      </ul>
      but hasn't at this point shared this information. This is a
      problematic situation for dozens of chapters, whether or not
      anyone happens also to have information indicating active
      exploitation.<br>
    </div>
    <div class="moz-cite-prefix"><br>
    </div>
    <div class="moz-cite-prefix">- Roland</div>
    <div class="moz-cite-prefix"><br>
    </div>
    <div class="moz-cite-prefix">
      <hr width="100%" size="2"><br>
    </div>
    <div class="moz-cite-prefix">On 17/2/22 17:29, Joly MacFie wrote:<br>
    </div>
    <blockquote type="cite"
cite="mid:CAM9VJk1Ek4kY-4X9UCPk5+GsE--1M9ZOjsy4JaOvjUN=5jv6pA@mail.gmail.com">
      <meta http-equiv="content-type" content="text/html; charset=UTF-8">
      <div dir="ltr">
        <div class="gmail_default" style="font-size:small">> It
          states that it was publicly indexed, </div>
        <div class="gmail_default" style="font-size:small"><br>
        </div>
        <div class="gmail_default" style="font-size:small">by an
          "Unknown public search engine" </div>
        <div class="gmail_default" style="font-size:small"><br>
        </div>
        <div class="gmail_default" style="font-size:small">I can't
          quite grasp how something can be both public and unknown..
          Sounds like speculation to me. </div>
        <div class="gmail_default" style="font-size:small"><br>
        </div>
        <div class="gmail_default" style="font-size:small">What is more
          likely is that Clario were methodically running pen tests on
          AWS blobs, and got lucky.</div>
        <div class="gmail_default" style="font-size:small"><br>
        </div>
        <div class="gmail_default" style="font-size:small">joly</div>
      </div>
      <br>
      <div class="gmail_quote">
        <div dir="ltr" class="gmail_attr">On Thu, Feb 17, 2022 at 4:07
          AM Roland Turner via Chapter-delegates <<a
            href="mailto:chapter-delegates@elists.isoc.org"
            moz-do-not-send="true" class="moz-txt-link-freetext">chapter-delegates@elists.isoc.org</a>>
          wrote:<br>
        </div>
        <blockquote class="gmail_quote" style="margin:0px 0px 0px
          0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
          <div>
            <div>On 17/2/22 16:39, Joly MacFie via Chapter-delegates
              wrote:</div>
            <div><br>
            </div>
            <blockquote type="cite">
              <div dir="ltr">
                <div dir="ltr">
                  <div class="gmail_default" style="font-size:small">As
                    reported by which 3rd parties? The <a
                      href="https://clario.co/blog/internet-society-member-data-breach/"
                      target="_blank" moz-do-not-send="true">Clario
                      statement</a> only says the data was unprotected,
                    not that it was exploited.</div>
                </div>
              </div>
            </blockquote>
            <p>It states that it was publicly indexed, which would
              require very substantial unauthorised access, vs. merely
              the potential exposure which has been reported so far.<br>
            </p>
            <p>Granted, it states somewhat confusingly that it was
              publicly indexed by an "unknown" public search engine.
              (How would they know that?)<br>
            </p>
            <p>- Roland</p>
            <p><br>
            </p>
            <hr width="100%" size="2">
            <p><br>
            </p>
            <blockquote type="cite">
              <div dir="ltr">
                <div dir="ltr">
                  <div class="gmail_default" style="font-size:small"><br>
                  </div>
                  <div class="gmail_default" style="font-size:small">j</div>
                </div>
                <br>
                <div class="gmail_quote">
                  <div dir="ltr" class="gmail_attr">On Thu, Feb 17, 2022
                    at 3:33 AM Winthrop Yu via Chapter-delegates <<a
                      href="mailto:chapter-delegates@elists.isoc.org"
                      target="_blank" moz-do-not-send="true"
                      class="moz-txt-link-freetext">chapter-delegates@elists.isoc.org</a>>
                    wrote:<br>
                  </div>
                  <blockquote class="gmail_quote" style="margin:0px 0px
                    0px 0.8ex;border-left:1px solid
                    rgb(204,204,204);padding-left:1ex">
                    <div>
                      <p>On 17 Feb 2022 10:13 am, Joly MacFie wrote:<br>
                      </p>
                      <blockquote type="cite">
                        <div dir="ltr">
                          <div style="font-size:small">While I concur
                            with concerns about the transparency, I will
                            just say that there is a difference between
                            a breach and a detected vulnerability, so
                            let's not get ahead of ourselves.</div>
                          <div style="font-size:small"><br>
                          </div>
                        </div>
                      </blockquote>
                      <p>If the vulnerability were unexploited that
                        distinction may hold. If, as reported by 3rd
                        parties, there is ISOC member data out there,
                        then clearly there was a breach. In any case, i
                        believe notification requirements apply, here in
                        our jurisdiction if not in yours. <br>
                        <br>
                      </p>
                      <blockquote type="cite">
                        <div dir="ltr">
                          <div style="font-size:small">What does seem
                            odd is the length of time between the
                            discovery and the reaction.</div>
                          <div style="font-size:small"><br>
                          </div>
                        </div>
                      </blockquote>
                      <p>ISOC HQ told us to expect more information
                        (clarification, details, etc.), we waited
                        patiently as is proper. Should chapters have
                        done otherwise -- speak now or forever hold your
                        peace? :) <br>
                      </p>
                      <p><br>
                        WYn<br>
                      </p>
                      <br>
                      <blockquote type="cite">
                        <div class="gmail_quote">
                          <div dir="ltr" class="gmail_attr">On Wed, Feb
                            16, 2022 at 7:35 PM Winthrop Yu via
                            Chapter-delegates <<a
                              href="mailto:chapter-delegates@elists.isoc.org"
                              target="_blank" moz-do-not-send="true"
                              class="moz-txt-link-freetext">chapter-delegates@elists.isoc.org</a>>
                            wrote:<br>
                          </div>
                          <blockquote class="gmail_quote"
                            style="margin:0px 0px 0px
                            0.8ex;border-left:1px solid
                            rgb(204,204,204);padding-left:1ex">
                            <div>
                              <p>Olivier, we don't need press releases
                                or "updates". <br>
                              </p>
                              <p>At the very least, we need: <br>
                              </p>
                              <p>a)  a clear, comprehensive yet concise
                                official statement from ISOC HQ
                                regarding the breach. <br>
                              </p>
                              <p>b)  including whether ISOC HQ has
                                notified <b>all</b> its global members
                                (which would include the individual
                                members of chapters).</p>
                              <p>That above is a bare minimum. Then we
                                will have to check that against any
                                obligations the chapter itself may have
                                under local law. And we may subsequently
                                need further clarification / statements
                                from ISOC HQ. <br>
                              </p>
                              <p>WYn<br>
                              </p>
                              <p><br>
                              </p>
                              <div>On 17 Feb 2022 1:45 am, Olivier MJ
                                Crépin-Leblond via Chapter-delegates
                                wrote:<br>
                              </div>
                              <blockquote type="cite"> Am I the only one
                                in Chapter Delegates mailing list who
                                received and read the email from
                                Christine Saegesser explaining the
                                problem with MemberNova and referring
                                to:<br>
                                <br>
                                "As we noted in our prior email, after
                                we learned of the issue, we launched an
                                investigation. The investigation
                                is continuing, and we will provide more
                                details when we have more information to
                                share. Going forward, updates will
                                be posted at <a
                                  href="http://updates.internetsociety.org"
                                  target="_blank" moz-do-not-send="true">updates.internetsociety.org</a>,
                                and we encourage you to check there for
                                additional information. The membership
                                password to access this website
                                is ISOC-AMS-Updates (case sensitive)."<br>
                                <br>
                                Or is the problem that there does not
                                appear to have been any updates since
                                21st January 2021?<br>
                                <br>
                                Kindest regards,<br>
                                <br>
                                Olivier<br>
                                <br>
                                <br>
                                <div>On 16/02/2022 14:54, Veni Markovski
                                  via Chapter-delegates wrote:<br>
                                </div>
                                <blockquote type="cite"> <font
                                    face="Helvetica, Arial, sans-serif">+1
                                    to the request for more clarity; our
                                    members need to be informed, and I
                                    don't want to share on social media
                                    a link to an article on some
                                    website. There should be something
                                    at <a href="http://isoc.org"
                                      target="_blank"
                                      moz-do-not-send="true">isoc.org</a>,
                                    and in the news section there's only
                                    one press release from 2022 - on
                                    February 4.  <br>
                                    <br>
                                    Also, it's not a good thing to find
                                    out from a publication about some of
                                    the details (I assume not all of
                                    them)...<br>
                                    <br>
                                    v/<br>
                                  </font><br>
                                  <div>On 2/16/22 04:19, Roland Turner
                                    via Chapter-delegates wrote:<br>
                                  </div>
                                  <blockquote type="cite">
                                    <div>Andrew,</div>
                                    <div><br>
                                    </div>
                                    <div>Could we have a little more
                                      clarity on this please? Chapter
                                      members in multiple jurisdictions
                                      may have notification obligations
                                      arising from this.</div>
                                    <div><br>
                                    </div>
                                    <div><br>
                                    </div>
                                    <div>The <a
                                        href="https://updates.internetsociety.org/"
                                        target="_blank"
                                        moz-do-not-send="true">Jan 21</a>
                                      update states:</div>
                                    <div>
                                      <blockquote type="cite">Fortunately,
                                        we have still not seen any
                                        instances of malicious access to
                                        member data as a result of this
                                        issue.</blockquote>
                                    </div>
                                    <div><br>
                                    </div>
                                    <div>This appears a little unclear
                                      to me on two important fronts:</div>
                                    <div><br>
                                    </div>
                                    <div><b>"have not seen"</b></div>
                                    <div><br>
                                    </div>
                                    <div>An adversarial read of this is
                                      the rather horrifying idea that
                                      access logging was not turned on,
                                      so you (and MemberNet) haven't the
                                      faintest idea whether there were
                                      any unauthorised accesses, which
                                      would certainly allow you say that
                                      you hadn't seen any unauthorised
                                      accesses but wouldn't mean that
                                      there weren't any, even at a
                                      reasonable level of confidence.
                                      Hopefully this is not the case!</div>
                                    <br>
                                    <div><b>"malicious access"</b></div>
                                    <div><br>
                                    </div>
                                    <div>The relevant question is not
                                      whether any accesses could be
                                      described as malicious, but simply
                                      whether they were unauthorised. An
                                      adversarial read of this is that
                                      there were unauthorised accesses,
                                      but because you don't have much
                                      information about the unauthorised
                                      accessers you not in a position to
                                      say that they were acting
                                      maliciously, however this would
                                      tell us nothing about whether
                                      there had been unauthorised
                                      access. Again, hopefully this is
                                      not the case!</div>
                                    <div><br>
                                    </div>
                                    <div><br>
                                    </div>
                                    <div>To address both concerns, are
                                      you able to confirm that:</div>
                                    <div>
                                      <div>
                                        <ol>
                                          <li>access logging was turned
                                            on and the logs were
                                            successfully secured;<br>
                                          </li>
                                          <li>the logs appear to be
                                            complete (in this case
                                            "appear to" is fine; the
                                            requirement is simply that
                                            there are no unexplained
                                            gaps); and<br>
                                          </li>
                                          <li>all logged accesses are
                                            authorised (i.e. because
                                            they were made by the
                                            application server, not
                                            random external IP
                                            addresses)</li>
                                        </ol>
                                        ?<br>
                                      </div>
                                      <div><br>
                                      </div>
                                    </div>
                                    <p><br>
                                    </p>
                                    <p>- Roland</p>
                                    <p><br>
                                    </p>
                                    <hr width="100%" size="2"><br>
                                    <div>On 16/2/22 15:41, Hank
                                      Nussbacher via Chapter-delegates
                                      wrote:<br>
                                    </div>
                                    <blockquote type="cite">
                                      <pre>In case you missed it:

<a href="https://www.infosecurity-magazine.com/news/internet-society-data-leaked/" target="_blank" moz-do-not-send="true" class="moz-txt-link-freetext">https://www.infosecurity-magazine.com/news/internet-society-data-leaked/</a>


Regards,

Hank

_______________________________________________</pre>
                                    </blockquote>
                                  </blockquote>
                                </blockquote>
                              </blockquote>
                            </div>
                          </blockquote>
                        </div>
                      </blockquote>
                    </div>
                    _______________________________________________<br>
                    As an Internet Society Chapter Officer you are
                    automatically subscribed<br>
                    to this list, which is regularly synchronized with
                    the Internet Society Chapter Portal (AMS):<br>
                    <a
                      href="https://admin.internetsociety.org/622619/User/Login"
                      rel="noreferrer" target="_blank"
                      moz-do-not-send="true"
                      class="moz-txt-link-freetext">https://admin.internetsociety.org/622619/User/Login</a><br>
                    View the Internet Society Code of Conduct: <a
                      href="https://www.internetsociety.org/become-a-member/code-of-conduct/"
                      rel="noreferrer" target="_blank"
                      moz-do-not-send="true"
                      class="moz-txt-link-freetext">https://www.internetsociety.org/become-a-member/code-of-conduct/</a><br>
                  </blockquote>
                </div>
                <br clear="all">
                <div><br>
                </div>
                -- <br>
                <div dir="ltr">
                  <div dir="ltr">
                    <div>
                      <div dir="ltr">
                        <div>
                          <div>--------------------------------------<br>
                            Joly MacFie  +1<span title="Call with Google
                              Voice">2185659365</span> </div>
                          <div>--------------------------------------</div>
                          -</div>
                      </div>
                    </div>
                  </div>
                </div>
              </div>
              <br>
              <fieldset></fieldset>
              <pre>_______________________________________________
As an Internet Society Chapter Officer you are automatically subscribed
to this list, which is regularly synchronized with the Internet Society Chapter Portal (AMS):
<a href="https://admin.internetsociety.org/622619/User/Login" target="_blank" moz-do-not-send="true" class="moz-txt-link-freetext">https://admin.internetsociety.org/622619/User/Login</a>
View the Internet Society Code of Conduct: <a href="https://www.internetsociety.org/become-a-member/code-of-conduct/" target="_blank" moz-do-not-send="true" class="moz-txt-link-freetext">https://www.internetsociety.org/become-a-member/code-of-conduct/</a>
</pre>
            </blockquote>
            <p><br>
            </p>
          </div>
          _______________________________________________<br>
          As an Internet Society Chapter Officer you are automatically
          subscribed<br>
          to this list, which is regularly synchronized with the
          Internet Society Chapter Portal (AMS):<br>
          <a href="https://admin.internetsociety.org/622619/User/Login"
            rel="noreferrer" target="_blank" moz-do-not-send="true"
            class="moz-txt-link-freetext">https://admin.internetsociety.org/622619/User/Login</a><br>
          View the Internet Society Code of Conduct: <a
            href="https://www.internetsociety.org/become-a-member/code-of-conduct/"
            rel="noreferrer" target="_blank" moz-do-not-send="true"
            class="moz-txt-link-freetext">https://www.internetsociety.org/become-a-member/code-of-conduct/</a><br>
        </blockquote>
      </div>
      <br clear="all">
      <div><br>
      </div>
      -- <br>
      <div dir="ltr" class="gmail_signature">
        <div dir="ltr">
          <div>
            <div dir="ltr">
              <div>
                <div>--------------------------------------<br>
                  Joly MacFie  +1<span title="Call with Google Voice">2185659365</span> </div>
                <div>--------------------------------------</div>
                -</div>
            </div>
          </div>
        </div>
      </div>
    </blockquote>
    <p><br>
    </p>
  </body>
</html>