<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<div class="moz-cite-prefix">Response from Clario (private email):</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">
<blockquote type="cite">Thanks for getting in touch!<br>
<br>
The instance in question was indexed by Grayhat Warfare search
engine. <br>
We hope you liked the article and found it useful. <br>
</blockquote>
</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">Additions to <a moz-do-not-send="true"
href="https://updates.internetsociety.org/faq/">ISoc's FAQ</a>
on this:</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">
<blockquote type="cite">Due to the nature of the configuration as
a public container, the logs do not contain sufficient
information to provide us with a complete record of data access.</blockquote>
Quite how this is possible is not clear to me (they're using a
hosting provider which loses logs constantly?).</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">
<blockquote type="cite">
<h5 class="has-text-color"
id="do-internet-society-chapter-leaders-have-any-legal-obligations-to-formally-notify-chapter-members-about-this-issue-or-provide-additional-information"
style="color:#085856">Do Internet Society chapter leaders have
any legal obligations to formally notify chapter members about
this issue or provide additional information?</h5>
<p>Given the nature of this issue, we can confirm that the
Internet Society is the data owner/data controller for any
member data that may have been publicly accessible. Because
the Internet Society is the data owner/data controller, any
legal obligations to provide notice would belong to the
Internet Society, as opposed to any chapters. We also notified
individual members directly of the issue.</p>
</blockquote>
</div>
<div class="moz-cite-prefix">This is an interesting claim,
particularly given that chapters are or can be separate legal
entities. I'm not yet sure what to make of it.</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">- Roland</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">
<hr width="100%" size="2"><br>
</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">On 17/2/22 18:23, Roland Turner wrote:<br>
</div>
<blockquote type="cite"
cite="mid:3923f962-9632-c189-74d8-f0265cd1244b@rolandturner.com">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<div class="moz-cite-prefix">On 17/2/22 17:29, Joly MacFie wrote:</div>
<div class="moz-cite-prefix"><br>
<blockquote type="cite">I can't quite grasp how something can be
both public and unknown.. Sounds like speculation to me. <br>
</blockquote>
Sure, but as presented the report also appears speculative. We
simply don't know at this point whether there was or was not
unauthorised access other than by Clario and neither does
Clario. ISoc presumably does either:</div>
<div class="moz-cite-prefix">
<ul>
<li> know, because either all or not all accesses were
authorised or Clario's; or</li>
<li>know that this is unknowable (because logging was turned
off)</li>
</ul>
but hasn't at this point shared this information. This is a
problematic situation for dozens of chapters, whether or not
anyone happens also to have information indicating active
exploitation.<br>
</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">- Roland</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">
<hr width="100%" size="2"><br>
</div>
<div class="moz-cite-prefix">On 17/2/22 17:29, Joly MacFie wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CAM9VJk1Ek4kY-4X9UCPk5+GsE--1M9ZOjsy4JaOvjUN=5jv6pA@mail.gmail.com">
<meta http-equiv="content-type" content="text/html;
charset=UTF-8">
<div dir="ltr">
<div class="gmail_default" style="font-size:small">> It
states that it was publicly indexed, </div>
<div class="gmail_default" style="font-size:small"><br>
</div>
<div class="gmail_default" style="font-size:small">by an
"Unknown public search engine" </div>
<div class="gmail_default" style="font-size:small"><br>
</div>
<div class="gmail_default" style="font-size:small">I can't
quite grasp how something can be both public and unknown..
Sounds like speculation to me. </div>
<div class="gmail_default" style="font-size:small"><br>
</div>
<div class="gmail_default" style="font-size:small">What is
more likely is that Clario were methodically running pen
tests on AWS blobs, and got lucky.</div>
<div class="gmail_default" style="font-size:small"><br>
</div>
<div class="gmail_default" style="font-size:small">joly</div>
</div>
<br>
<div class="gmail_quote">
<div dir="ltr" class="gmail_attr">On Thu, Feb 17, 2022 at 4:07
AM Roland Turner via Chapter-delegates <<a
href="mailto:chapter-delegates@elists.isoc.org"
moz-do-not-send="true" class="moz-txt-link-freetext">chapter-delegates@elists.isoc.org</a>>
wrote:<br>
</div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px
0.8ex;border-left:1px solid
rgb(204,204,204);padding-left:1ex">
<div>
<div>On 17/2/22 16:39, Joly MacFie via Chapter-delegates
wrote:</div>
<div><br>
</div>
<blockquote type="cite">
<div dir="ltr">
<div dir="ltr">
<div class="gmail_default" style="font-size:small">As
reported by which 3rd parties? The <a
href="https://clario.co/blog/internet-society-member-data-breach/"
target="_blank" moz-do-not-send="true">Clario
statement</a> only says the data was
unprotected, not that it was exploited.</div>
</div>
</div>
</blockquote>
<p>It states that it was publicly indexed, which would
require very substantial unauthorised access, vs. merely
the potential exposure which has been reported so far.<br>
</p>
<p>Granted, it states somewhat confusingly that it was
publicly indexed by an "unknown" public search engine.
(How would they know that?)<br>
</p>
<p>- Roland</p>
<p><br>
</p>
<hr width="100%" size="2">
<p><br>
</p>
<blockquote type="cite">
<div dir="ltr">
<div dir="ltr">
<div class="gmail_default" style="font-size:small"><br>
</div>
<div class="gmail_default" style="font-size:small">j</div>
</div>
<br>
<div class="gmail_quote">
<div dir="ltr" class="gmail_attr">On Thu, Feb 17,
2022 at 3:33 AM Winthrop Yu via Chapter-delegates
<<a
href="mailto:chapter-delegates@elists.isoc.org"
target="_blank" moz-do-not-send="true"
class="moz-txt-link-freetext">chapter-delegates@elists.isoc.org</a>>
wrote:<br>
</div>
<blockquote class="gmail_quote" style="margin:0px
0px 0px 0.8ex;border-left:1px solid
rgb(204,204,204);padding-left:1ex">
<div>
<p>On 17 Feb 2022 10:13 am, Joly MacFie wrote:<br>
</p>
<blockquote type="cite">
<div dir="ltr">
<div style="font-size:small">While I concur
with concerns about the transparency, I
will just say that there is a difference
between a breach and a detected
vulnerability, so let's not get ahead of
ourselves.</div>
<div style="font-size:small"><br>
</div>
</div>
</blockquote>
<p>If the vulnerability were unexploited that
distinction may hold. If, as reported by 3rd
parties, there is ISOC member data out there,
then clearly there was a breach. In any case,
i believe notification requirements apply,
here in our jurisdiction if not in yours. <br>
<br>
</p>
<blockquote type="cite">
<div dir="ltr">
<div style="font-size:small">What does seem
odd is the length of time between the
discovery and the reaction.</div>
<div style="font-size:small"><br>
</div>
</div>
</blockquote>
<p>ISOC HQ told us to expect more information
(clarification, details, etc.), we waited
patiently as is proper. Should chapters have
done otherwise -- speak now or forever hold
your peace? :) <br>
</p>
<p><br>
WYn<br>
</p>
<br>
<blockquote type="cite">
<div class="gmail_quote">
<div dir="ltr" class="gmail_attr">On Wed,
Feb 16, 2022 at 7:35 PM Winthrop Yu via
Chapter-delegates <<a
href="mailto:chapter-delegates@elists.isoc.org"
target="_blank" moz-do-not-send="true"
class="moz-txt-link-freetext">chapter-delegates@elists.isoc.org</a>>
wrote:<br>
</div>
<blockquote class="gmail_quote"
style="margin:0px 0px 0px
0.8ex;border-left:1px solid
rgb(204,204,204);padding-left:1ex">
<div>
<p>Olivier, we don't need press releases
or "updates". <br>
</p>
<p>At the very least, we need: <br>
</p>
<p>a) a clear, comprehensive yet
concise official statement from ISOC
HQ regarding the breach. <br>
</p>
<p>b) including whether ISOC HQ has
notified <b>all</b> its global
members (which would include the
individual members of chapters).</p>
<p>That above is a bare minimum. Then we
will have to check that against any
obligations the chapter itself may
have under local law. And we may
subsequently need further
clarification / statements from ISOC
HQ. <br>
</p>
<p>WYn<br>
</p>
<p><br>
</p>
<div>On 17 Feb 2022 1:45 am, Olivier MJ
Crépin-Leblond via Chapter-delegates
wrote:<br>
</div>
<blockquote type="cite"> Am I the only
one in Chapter Delegates mailing list
who received and read the email from
Christine Saegesser explaining the
problem with MemberNova and referring
to:<br>
<br>
"As we noted in our prior email, after
we learned of the issue, we launched
an investigation. The investigation
is continuing, and we will provide
more details when we have
more information to share. Going
forward, updates will be posted at <a
href="http://updates.internetsociety.org" target="_blank"
moz-do-not-send="true">updates.internetsociety.org</a>,
and we encourage you to check
there for additional information. The
membership password to access
this website is ISOC-AMS-Updates (case
sensitive)."<br>
<br>
Or is the problem that there does not
appear to have been any updates since
21st January 2021?<br>
<br>
Kindest regards,<br>
<br>
Olivier<br>
<br>
<br>
<div>On 16/02/2022 14:54, Veni
Markovski via Chapter-delegates
wrote:<br>
</div>
<blockquote type="cite"> <font
face="Helvetica, Arial,
sans-serif">+1 to the request for
more clarity; our members need to
be informed, and I don't want to
share on social media a link to an
article on some website. There
should be something at <a
href="http://isoc.org"
target="_blank"
moz-do-not-send="true">isoc.org</a>,
and in the news section there's
only one press release from 2022 -
on February 4. <br>
<br>
Also, it's not a good thing to
find out from a publication about
some of the details (I assume not
all of them)...<br>
<br>
v/<br>
</font><br>
<div>On 2/16/22 04:19, Roland Turner
via Chapter-delegates wrote:<br>
</div>
<blockquote type="cite">
<div>Andrew,</div>
<div><br>
</div>
<div>Could we have a little more
clarity on this please? Chapter
members in multiple
jurisdictions may have
notification obligations arising
from this.</div>
<div><br>
</div>
<div><br>
</div>
<div>The <a
href="https://updates.internetsociety.org/"
target="_blank"
moz-do-not-send="true">Jan 21</a>
update states:</div>
<div>
<blockquote type="cite">Fortunately,
we have still not seen any
instances of malicious access
to member data as a result of
this issue.</blockquote>
</div>
<div><br>
</div>
<div>This appears a little unclear
to me on two important fronts:</div>
<div><br>
</div>
<div><b>"have not seen"</b></div>
<div><br>
</div>
<div>An adversarial read of this
is the rather horrifying idea
that access logging was not
turned on, so you (and
MemberNet) haven't the faintest
idea whether there were any
unauthorised accesses, which
would certainly allow you say
that you hadn't seen any
unauthorised accesses but
wouldn't mean that there weren't
any, even at a reasonable level
of confidence. Hopefully this is
not the case!</div>
<br>
<div><b>"malicious access"</b></div>
<div><br>
</div>
<div>The relevant question is not
whether any accesses could be
described as malicious, but
simply whether they were
unauthorised. An adversarial
read of this is that there were
unauthorised accesses, but
because you don't have much
information about the
unauthorised accessers you not
in a position to say that they
were acting maliciously, however
this would tell us nothing about
whether there had been
unauthorised access. Again,
hopefully this is not the case!</div>
<div><br>
</div>
<div><br>
</div>
<div>To address both concerns, are
you able to confirm that:</div>
<div>
<div>
<ol>
<li>access logging was
turned on and the logs
were successfully secured;<br>
</li>
<li>the logs appear to be
complete (in this case
"appear to" is fine; the
requirement is simply that
there are no unexplained
gaps); and<br>
</li>
<li>all logged accesses are
authorised (i.e. because
they were made by the
application server, not
random external IP
addresses)</li>
</ol>
?<br>
</div>
<div><br>
</div>
</div>
<p><br>
</p>
<p>- Roland</p>
<p><br>
</p>
<hr width="100%" size="2"><br>
<div>On 16/2/22 15:41, Hank
Nussbacher via Chapter-delegates
wrote:<br>
</div>
<blockquote type="cite">
<pre>In case you missed it:
<a href="https://www.infosecurity-magazine.com/news/internet-society-data-leaked/" target="_blank" moz-do-not-send="true" class="moz-txt-link-freetext">https://www.infosecurity-magazine.com/news/internet-society-data-leaked/</a>
Regards,
Hank
_______________________________________________</pre>
</blockquote>
</blockquote>
</blockquote>
</blockquote>
</div>
</blockquote>
</div>
</blockquote>
</div>
_______________________________________________<br>
As an Internet Society Chapter Officer you are
automatically subscribed<br>
to this list, which is regularly synchronized with
the Internet Society Chapter Portal (AMS):<br>
<a
href="https://admin.internetsociety.org/622619/User/Login"
rel="noreferrer" target="_blank"
moz-do-not-send="true"
class="moz-txt-link-freetext">https://admin.internetsociety.org/622619/User/Login</a><br>
View the Internet Society Code of Conduct: <a
href="https://www.internetsociety.org/become-a-member/code-of-conduct/"
rel="noreferrer" target="_blank"
moz-do-not-send="true"
class="moz-txt-link-freetext">https://www.internetsociety.org/become-a-member/code-of-conduct/</a><br>
</blockquote>
</div>
<br clear="all">
<div><br>
</div>
-- <br>
<div dir="ltr">
<div dir="ltr">
<div>
<div dir="ltr">
<div>
<div>--------------------------------------<br>
Joly MacFie +1<span title="Call with
Google Voice">2185659365</span> </div>
<div>--------------------------------------</div>
-</div>
</div>
</div>
</div>
</div>
</div>
<br>
<fieldset></fieldset>
<pre>_______________________________________________
As an Internet Society Chapter Officer you are automatically subscribed
to this list, which is regularly synchronized with the Internet Society Chapter Portal (AMS):
<a href="https://admin.internetsociety.org/622619/User/Login" target="_blank" moz-do-not-send="true" class="moz-txt-link-freetext">https://admin.internetsociety.org/622619/User/Login</a>
View the Internet Society Code of Conduct: <a href="https://www.internetsociety.org/become-a-member/code-of-conduct/" target="_blank" moz-do-not-send="true" class="moz-txt-link-freetext">https://www.internetsociety.org/become-a-member/code-of-conduct/</a>
</pre>
</blockquote>
<p><br>
</p>
</div>
_______________________________________________<br>
As an Internet Society Chapter Officer you are automatically
subscribed<br>
to this list, which is regularly synchronized with the
Internet Society Chapter Portal (AMS):<br>
<a
href="https://admin.internetsociety.org/622619/User/Login"
rel="noreferrer" target="_blank" moz-do-not-send="true"
class="moz-txt-link-freetext">https://admin.internetsociety.org/622619/User/Login</a><br>
View the Internet Society Code of Conduct: <a
href="https://www.internetsociety.org/become-a-member/code-of-conduct/"
rel="noreferrer" target="_blank" moz-do-not-send="true"
class="moz-txt-link-freetext">https://www.internetsociety.org/become-a-member/code-of-conduct/</a><br>
</blockquote>
</div>
<br clear="all">
<div><br>
</div>
-- <br>
<div dir="ltr" class="gmail_signature">
<div dir="ltr">
<div>
<div dir="ltr">
<div>
<div>--------------------------------------<br>
Joly MacFie +1<span title="Call with Google Voice">2185659365</span> </div>
<div>--------------------------------------</div>
-</div>
</div>
</div>
</div>
</div>
</blockquote>
<p><br>
</p>
</blockquote>
<p><br>
</p>
</body>
</html>