<div dir="ltr"><div class="gmail_default" style="font-size:small">> It states that it was publicly indexed, </div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">by an "Unknown public search engine" </div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">I can't quite grasp how something can be both public and unknown.. Sounds like speculation to me. </div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">What is more likely is that Clario were methodically running pen tests on AWS blobs, and got lucky.</div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">joly</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, Feb 17, 2022 at 4:07 AM Roland Turner via Chapter-delegates <<a href="mailto:chapter-delegates@elists.isoc.org">chapter-delegates@elists.isoc.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div>
<div>On 17/2/22 16:39, Joly MacFie via
Chapter-delegates wrote:</div>
<div><br>
</div>
<blockquote type="cite">
<div dir="ltr">
<div dir="ltr">
<div class="gmail_default" style="font-size:small">As reported
by which 3rd parties? The <a href="https://clario.co/blog/internet-society-member-data-breach/" target="_blank">Clario statement</a> only says the
data was unprotected, not that it was exploited.</div>
</div>
</div>
</blockquote>
<p>It states that it was publicly indexed, which would require very
substantial unauthorised access, vs. merely the potential exposure
which has been reported so far.<br>
</p>
<p>Granted, it states somewhat confusingly that it was publicly
indexed by an "unknown" public search engine. (How would they know
that?)<br>
</p>
<p>- Roland</p>
<p><br>
</p>
<hr width="100%" size="2">
<p><br>
</p>
<blockquote type="cite">
<div dir="ltr">
<div dir="ltr">
<div class="gmail_default" style="font-size:small"><br>
</div>
<div class="gmail_default" style="font-size:small">j</div>
</div>
<br>
<div class="gmail_quote">
<div dir="ltr" class="gmail_attr">On Thu, Feb 17, 2022 at 3:33
AM Winthrop Yu via Chapter-delegates <<a href="mailto:chapter-delegates@elists.isoc.org" target="_blank">chapter-delegates@elists.isoc.org</a>>
wrote:<br>
</div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div>
<p>On 17 Feb 2022 10:13 am, Joly MacFie wrote:<br>
</p>
<blockquote type="cite">
<div dir="ltr">
<div style="font-size:small">While I concur with
concerns about the transparency, I will just say
that there is a difference between a breach and a
detected vulnerability, so let's not get ahead of
ourselves.</div>
<div style="font-size:small"><br>
</div>
</div>
</blockquote>
<p>If the vulnerability were unexploited that distinction
may hold. If, as reported by 3rd parties, there is ISOC
member data out there, then clearly there was a breach.
In any case, i believe notification requirements apply,
here in our jurisdiction if not in yours. <br>
<br>
</p>
<blockquote type="cite">
<div dir="ltr">
<div style="font-size:small">What does seem odd is the
length of time between the discovery and the
reaction.</div>
<div style="font-size:small"><br>
</div>
</div>
</blockquote>
<p>ISOC HQ told us to expect more information
(clarification, details, etc.), we waited patiently as
is proper. Should chapters have done otherwise -- speak
now or forever hold your peace? :) <br>
</p>
<p><br>
WYn<br>
</p>
<br>
<blockquote type="cite">
<div class="gmail_quote">
<div dir="ltr" class="gmail_attr">On Wed, Feb 16, 2022
at 7:35 PM Winthrop Yu via Chapter-delegates <<a href="mailto:chapter-delegates@elists.isoc.org" target="_blank">chapter-delegates@elists.isoc.org</a>>
wrote:<br>
</div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div>
<p>Olivier, we don't need press releases or
"updates". <br>
</p>
<p>At the very least, we need: <br>
</p>
<p>a) a clear, comprehensive yet concise official
statement from ISOC HQ regarding the breach. <br>
</p>
<p>b) including whether ISOC HQ has notified <b>all</b>
its global members (which would include the
individual members of chapters).</p>
<p>That above is a bare minimum. Then we will have
to check that against any obligations the
chapter itself may have under local law. And we
may subsequently need further clarification /
statements from ISOC HQ. <br>
</p>
<p>WYn<br>
</p>
<p><br>
</p>
<div>On 17 Feb 2022 1:45 am, Olivier MJ
Crépin-Leblond via Chapter-delegates wrote:<br>
</div>
<blockquote type="cite"> Am I the only one in
Chapter Delegates mailing list who received and
read the email from Christine Saegesser
explaining the problem with MemberNova and
referring to:<br>
<br>
"As we noted in our prior email, after we
learned of the issue, we launched an
investigation. The investigation is continuing,
and we will provide more details when we have
more information to share. Going forward,
updates will be posted at <a href="http://updates.internetsociety.org" target="_blank">updates.internetsociety.org</a>,
and we encourage you to check there for
additional information. The membership password
to access this website is ISOC-AMS-Updates (case
sensitive)."<br>
<br>
Or is the problem that there does not appear to
have been any updates since 21st January 2021?<br>
<br>
Kindest regards,<br>
<br>
Olivier<br>
<br>
<br>
<div>On 16/02/2022 14:54, Veni Markovski via
Chapter-delegates wrote:<br>
</div>
<blockquote type="cite"> <font face="Helvetica,
Arial, sans-serif">+1 to the request for
more clarity; our members need to be
informed, and I don't want to share on
social media a link to an article on some
website. There should be something at <a href="http://isoc.org" target="_blank">isoc.org</a>, and
in the news section there's only one press
release from 2022 - on February 4. <br>
<br>
Also, it's not a good thing to find out from
a publication about some of the details (I
assume not all of them)...<br>
<br>
v/<br>
</font><br>
<div>On 2/16/22 04:19, Roland Turner via
Chapter-delegates wrote:<br>
</div>
<blockquote type="cite">
<div>Andrew,</div>
<div><br>
</div>
<div>Could we have a little more clarity on
this please? Chapter members in multiple
jurisdictions may have notification
obligations arising from this.</div>
<div><br>
</div>
<div><br>
</div>
<div>The <a href="https://updates.internetsociety.org/" target="_blank">Jan
21</a> update states:</div>
<div>
<blockquote type="cite">Fortunately, we
have still not seen any instances of
malicious access to member data as a
result of this issue.</blockquote>
</div>
<div><br>
</div>
<div>This appears a little unclear to me on
two important fronts:</div>
<div><br>
</div>
<div><b>"have not seen"</b></div>
<div><br>
</div>
<div>An adversarial read of this is the
rather horrifying idea that access logging
was not turned on, so you (and MemberNet)
haven't the faintest idea whether there
were any unauthorised accesses, which
would certainly allow you say that you
hadn't seen any unauthorised accesses but
wouldn't mean that there weren't any, even
at a reasonable level of confidence.
Hopefully this is not the case!</div>
<br>
<div><b>"malicious access"</b></div>
<div><br>
</div>
<div>The relevant question is not whether
any accesses could be described as
malicious, but simply whether they were
unauthorised. An adversarial read of this
is that there were unauthorised accesses,
but because you don't have much
information about the unauthorised
accessers you not in a position to say
that they were acting maliciously, however
this would tell us nothing about whether
there had been unauthorised access. Again,
hopefully this is not the case!</div>
<div><br>
</div>
<div><br>
</div>
<div>To address both concerns, are you able
to confirm that:</div>
<div>
<div>
<ol>
<li>access logging was turned on and
the logs were successfully secured;<br>
</li>
<li>the logs appear to be complete (in
this case "appear to" is fine; the
requirement is simply that there are
no unexplained gaps); and<br>
</li>
<li>all logged accesses are authorised
(i.e. because they were made by the
application server, not random
external IP addresses)</li>
</ol>
?<br>
</div>
<div><br>
</div>
</div>
<p><br>
</p>
<p>- Roland</p>
<p><br>
</p>
<hr width="100%" size="2"><br>
<div>On 16/2/22 15:41, Hank Nussbacher via
Chapter-delegates wrote:<br>
</div>
<blockquote type="cite">
<pre>In case you missed it:
<a href="https://www.infosecurity-magazine.com/news/internet-society-data-leaked/" target="_blank">https://www.infosecurity-magazine.com/news/internet-society-data-leaked/</a>
Regards,
Hank
_______________________________________________</pre>
</blockquote>
</blockquote>
</blockquote>
</blockquote>
</div>
</blockquote>
</div>
</blockquote>
</div>
_______________________________________________<br>
As an Internet Society Chapter Officer you are automatically
subscribed<br>
to this list, which is regularly synchronized with the
Internet Society Chapter Portal (AMS):<br>
<a href="https://admin.internetsociety.org/622619/User/Login" rel="noreferrer" target="_blank">https://admin.internetsociety.org/622619/User/Login</a><br>
View the Internet Society Code of Conduct: <a href="https://www.internetsociety.org/become-a-member/code-of-conduct/" rel="noreferrer" target="_blank">https://www.internetsociety.org/become-a-member/code-of-conduct/</a><br>
</blockquote>
</div>
<br clear="all">
<div><br>
</div>
-- <br>
<div dir="ltr">
<div dir="ltr">
<div>
<div dir="ltr">
<div>
<div>--------------------------------------<br>
Joly MacFie +1<span title="Call with Google Voice">2185659365</span> </div>
<div>--------------------------------------</div>
-</div>
</div>
</div>
</div>
</div>
</div>
<br>
<fieldset></fieldset>
<pre>_______________________________________________
As an Internet Society Chapter Officer you are automatically subscribed
to this list, which is regularly synchronized with the Internet Society Chapter Portal (AMS):
<a href="https://admin.internetsociety.org/622619/User/Login" target="_blank">https://admin.internetsociety.org/622619/User/Login</a>
View the Internet Society Code of Conduct: <a href="https://www.internetsociety.org/become-a-member/code-of-conduct/" target="_blank">https://www.internetsociety.org/become-a-member/code-of-conduct/</a>
</pre>
</blockquote>
<p><br>
</p>
</div>
_______________________________________________<br>
As an Internet Society Chapter Officer you are automatically subscribed<br>
to this list, which is regularly synchronized with the Internet Society Chapter Portal (AMS):<br>
<a href="https://admin.internetsociety.org/622619/User/Login" rel="noreferrer" target="_blank">https://admin.internetsociety.org/622619/User/Login</a><br>
View the Internet Society Code of Conduct: <a href="https://www.internetsociety.org/become-a-member/code-of-conduct/" rel="noreferrer" target="_blank">https://www.internetsociety.org/become-a-member/code-of-conduct/</a><br>
</blockquote></div><br clear="all"><div><br></div>-- <br><div dir="ltr" class="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div>--------------------------------------<br>Joly MacFie +1<span title="Call with Google Voice">2185659365</span> </div><div>--------------------------------------</div>-</div></div></div></div></div>