- anti-abuse-wg - mailman.ripe.net

Re: [anti-abuse-wg] fake abuse lists
by Marilson 28 May '17

28 May '17

On May 26 Andre wrote: > (you can also change your own, if you like - you can even install a plugin called nivo slider, with an outdated version > and see what bots come around whahahaha) Many thanks for your tip but I do not have that kind of problem. I do not have a website and I do not need email marketing. In the very small city that I live in, with 12 million inhabitants (more than 21 million in the Metropolitan Region of Sao Paulo), my professional contact is always with the owner of the company, never with employees. And they've known me since the 80's and they know what I do and how I do. > Anyway - just so I understand you correctly, the reason that this > http://spfbl.net/en/dnsbl/ > crowd lists IPs has NOTHING to do with actual abuse - but either to do with the fact that you are Google/Hetzner.de or because they collect and believe > published version numbers? or they "think" you may be doing abuse? I did not know my English is so bad. I do not know spfbl.net and I do not use information from anti-spam companies because my research is more appropriate than yours. You are rambling and have a bad habit of judging who you do not know. Information about your WordPress outdated I got into https://sitecheck.sucuri.net/results/ox.co.za It is interesting to note that from yesterday to today, your website went from "high risk", according to Sucuri.net, to "low risk" (what nonsense!) and your WorldPress is updated with version 4.7.5. You can make the joke you want with the versions, but you ran to update your WorldPress, yesterday or today. About virtual or real honeynets, make contact WITH SPFBL.NET and help them! They are your colleagues. Do you like to prejudge? Buy a crystal ball! Marilson From: ox Sent: Friday, May 26, 2017 7:52 AM To: Marilson Cc: anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] fake abuse lists On Fri, 26 May 2017 05:24:51 -0300 "Marilson" <marilson.mapa(a)gmail.com> wrote: > > look at the headers of this email, check my hetzner.de IP number > > and then do the same for other reporting systems... > BTW, your WordPress is outdated (under 4.7.5). Website outdated means > "high risk" and can be listed by mistake. ;) > > About virtual or real honeynets, make contact and help them! > just in case you are correct and there are people that believe version info on scams websites :) - i have changed the version info (you can also change your own, if you like - you can even install a plugin called nivo slider, with an outdated version - and see what bots come around whahahaha) About helping honeynets/traps/scamtraps: Anyway - just so I understand you correctly, the reason that this http://spfbl.net/en/dnsbl/ crowd lists IPs has NOTHING to do with actual abuse - but either to do with the fact that you are Google/Hetzner.de or because they collect and believe published version numbers? or they "think" you may be doing abuse? This is hard to believe? are you sure? Andre

2 1

Re: [anti-abuse-wg] fake abuse lists
by Marilson 26 May '17

26 May '17

> look at the headers of this email, check my hetzner.de IP number and then do the same for other reporting systems... OMG, you are using Hetzner.de as a sender! An ISP with a dirty history of repression of press freedom and defense of spammers and arrogant political psychopaths. Using Hetzner's IP is a risk, for sure. Your IP is clean... NOW! You're right. You are involved with criminal enterprise, but you are pointing in the wrong direction. BTW, your WordPress is outdated (under 4.7.5). Website outdated means "high risk" and can be listed by mistake. ;) About virtual or real honeynets, make contact and help them! Marilson From: ox Sent: Friday, May 26, 2017 1:57 AM To: Marilson Cc: anti-abuse-wg(a)ripe.net Subject: Re: [anti-abuse-wg] fake abuse lists On Fri, 26 May 2017 01:14:24 -0300 "Marilson" <marilson.mapa(a)gmail.com> wrote: > The SPFBL.net is not a criminal enterprise. It's just another > competitor of you and it's welcome considering the criminal attitudes > of companies like Spamcop and Netcraft. > Weird that they would suddenly list me for abuse, whereas there has been no abuse... And, after checking, they are listing many honeynets, reporting systems and others, also... look at the headers of this email, check my hetzner.de IP number and then do the same for other reporting systems... all listed. coincidence? No. - Criminal Enterprise or criminals in their enterprise or some other low life scummy type behavior... > http://www.nic.br/videos/ver/gter-42-spfbl-aplicacao-p2p-para-prevencao-de-… > > The SPFBL.net aims to be a collaborative system to combat spam. A > cooperative system: users share alerts against spammers through a > reputation mechanism. I hope they succeed because the Brazilian > population is tired of being the victim of damn ISPs. But take care, > consider this with a grain of salt, after all they are... Brazilians. > > Marilson > > From: anti-abuse-wg-request(a)ripe.net > Sent: Thursday, May 25, 2017 7:00 AM > To: anti-abuse-wg(a)ripe.net > Subject: anti-abuse-wg Digest, Vol 66, Issue 8 > > Send anti-abuse-wg mailing list submissions to > anti-abuse-wg(a)ripe.net > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.ripe.net/mailman/listinfo/anti-abuse-wg > or, via email, send a message with subject or body 'help' to > anti-abuse-wg-request(a)ripe.net > > You can reach the person managing the list at > anti-abuse-wg-owner(a)ripe.net > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of anti-abuse-wg digest..." > > > Today's Topics: > > 1. fake abuse lists (ox) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Thu, 25 May 2017 07:20:58 +0200 > From: ox <andre(a)ox.co.za> > To: anti-abuse-wg(a)ripe.net > Subject: [anti-abuse-wg] fake abuse lists > Message-ID: <mailman.2.1495706402.1949.anti-abuse-wg(a)ripe.net> > Content-Type: text/plain; charset=US-ASCII > > Hello, > > Can anyone share any experiences with: http://spfbl.net/en/dnsbl/ > > It seems that they list servers that are used to file complaints with > Spamcop and other blacklists - as "spam" servers... > > They do not de-list these servers, ever, and it seems like a criminal > enterprise or services designed to 'punish' or list complainants or > victims? > > there are of course other 'fake' / non maintained and worthless > blacklists, like abuse-att.net etc etc. but these generally do not go > out of their way to punish victims... > > What is the best way to fight criminal enterprises that enter data > streams and 'hide' / market etc as ethical service providers? > > Andre > > > > End of anti-abuse-wg Digest, Vol 66, Issue 8 > ********************************************

2 2

Re: [anti-abuse-wg] fake abuse lists
by Marilson 26 May '17

26 May '17

The SPFBL.net is not a criminal enterprise. It's just another competitor of you and it's welcome considering the criminal attitudes of companies like Spamcop and Netcraft. http://www.nic.br/videos/ver/gter-42-spfbl-aplicacao-p2p-para-prevencao-de-… The SPFBL.net aims to be a collaborative system to combat spam. A cooperative system: users share alerts against spammers through a reputation mechanism. I hope they succeed because the Brazilian population is tired of being the victim of damn ISPs. But take care, consider this with a grain of salt, after all they are... Brazilians. Marilson From: anti-abuse-wg-request(a)ripe.net Sent: Thursday, May 25, 2017 7:00 AM To: anti-abuse-wg(a)ripe.net Subject: anti-abuse-wg Digest, Vol 66, Issue 8 Send anti-abuse-wg mailing list submissions to anti-abuse-wg(a)ripe.net To subscribe or unsubscribe via the World Wide Web, visit https://lists.ripe.net/mailman/listinfo/anti-abuse-wg or, via email, send a message with subject or body 'help' to anti-abuse-wg-request(a)ripe.net You can reach the person managing the list at anti-abuse-wg-owner(a)ripe.net When replying, please edit your Subject line so it is more specific than "Re: Contents of anti-abuse-wg digest..." Today's Topics: 1. fake abuse lists (ox) ---------------------------------------------------------------------- Message: 1 Date: Thu, 25 May 2017 07:20:58 +0200 From: ox <andre(a)ox.co.za> To: anti-abuse-wg(a)ripe.net Subject: [anti-abuse-wg] fake abuse lists Message-ID: <mailman.2.1495706402.1949.anti-abuse-wg(a)ripe.net> Content-Type: text/plain; charset=US-ASCII Hello, Can anyone share any experiences with: http://spfbl.net/en/dnsbl/ It seems that they list servers that are used to file complaints with Spamcop and other blacklists - as "spam" servers... They do not de-list these servers, ever, and it seems like a criminal enterprise or services designed to 'punish' or list complainants or victims? there are of course other 'fake' / non maintained and worthless blacklists, like abuse-att.net etc etc. but these generally do not go out of their way to punish victims... What is the best way to fight criminal enterprises that enter data streams and 'hide' / market etc as ethical service providers? Andre End of anti-abuse-wg Digest, Vol 66, Issue 8 ********************************************

2 1

fake abuse lists
by ox 25 May '17

25 May '17

Hello, Can anyone share any experiences with: http://spfbl.net/en/dnsbl/ It seems that they list servers that are used to file complaints with Spamcop and other blacklists - as "spam" servers... They do not de-list these servers, ever, and it seems like a criminal enterprise or services designed to 'punish' or list complainants or victims? there are of course other 'fake' / non maintained and worthless blacklists, like abuse-att.net etc etc. but these generally do not go out of their way to punish victims... What is the best way to fight criminal enterprises that enter data streams and 'hide' / market etc as ethical service providers? Andre

1 0

WannaCry Ransomware
by Richard Leaning 23 May '17

23 May '17

Dear Colleagues, The European cybercrime centre at Europol have asked us to circulate the below. I hope you find it useful and please forward it on to anyone who you may think will benefit from it. Kind regards Richard Leaning External Relations RIPE NCC > Begin forwarded message: > > From: "O3 - European Cybercrime Centre (EC3)" <o3(a)europol.europa.eu> > Subject: @EXT: WannaCry Ransomware > Date: 14 May 2017 at 19:06:20 BST > Cc: "Amann, Philipp" <Philipp.Amann(a)europol.europa.eu>, Mounier, Grégory <gregory.mounier(a)europol.europa.eu>, "Sanchez, Maria" <maria.sanchez(a)europol.europa.eu>, "O372 Advisory Groups Support" <O372(a)europol.europa.eu> > > Dear AG members, > > As you are no doubt aware, we are currently experiencing an unprecedented ransomware attack at a global scale. The malware was detected on 12 May 2017 and has the capability to spread across networks taking advantage of a critical exploit in a popular communication protocol used by Windows systems. > > Many of you have already reached out and are actively involved in containing this threat. However, since we believe that the infection and propagation rate may go up on Monday when people return to their workplaces, we would like to ask you to please help us distribute information that can help contain this threat. To this end, we have compiled a list of recommendations and also prepared an infographic (see attachment). Please feel free to use this information for reaching out to your network and to complement your advice, if and where useful. > > Also, the No More Ransom (NMR) initiative, actively supported by many of you already, remains an essential source of information. Together with you and other partners, we will continue to update the information available via the NMR portal, so it is important to watch this space as well. > > If you want to share any other prevention, protection or awareness information with us, please do not hesitate to contact us. > > Thank you again for your continued support. > > Kind regards, > EC3 Outreach & Support > > -------------------------------- > > If you are a victim or have reason to believe that you could be a victim > > This is link provides some practical advice on how to contain the propagation of this type of ransomware: https://www.ncsc.gov.uk/guidance/ransomware-latest-ncsc-guidance <https://www.ncsc.gov.uk/guidance/ransomware-latest-ncsc-guidance> > > The most important step involves patching the Microsoft vulnerability (MS17-010): > https://technet.microsoft.com/en-us/library/security/ms17-010.aspx <https://technet.microsoft.com/en-us/library/security/ms17-010.aspx> > > A patch for legacy platforms is available here: > https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-w… <https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-w…> > > In instances where it is not possible to install the patch, manage the vulnerability becomes key. One way of doing this would be to disable the SMBv1 (Server Message Block) protocol: > https://support.microsoft.com/en-us/help/2696547 <https://support.microsoft.com/en-us/help/2696547> > and/or block SMBv1 ports on network devices [UDP 137, 138 and TCP 139, 445]. > > Another step would be to update endpoint security and AV solutions with the relevant hashes of the ransomware (e.g. via VirusTotal). > > If these steps are not possible, not starting up and/or shutting down vulnerable systems can also prevent the propagation of this threat. > > How to prevent a ransomware attack? > > Back-up! Back-up! Back-up! Have a backup and recovery system in place so a ransomware infection can’t destroy your personal data forever. It’s best to create at least two back-up copies on a regular basis: one to be stored in the cloud (remember to use a service that makes an automatic backup of your files) and one stored locally (portable hard drive, thumb drive, etc.). Disconnect these when you are done and store them separately from your computer. Your back-up copies will also come in handy should you accidentally delete a critical file or experience a hard drive failure. > Use robust antivirus software to protect your system from ransomware. Always use the latest virus definition/database and do not switch off the ‘heuristic’ functions as these help the solution to catch samples of ransomware (and other type of malware) that have not yet been formally detected. > Keep all the software on your computer up to date. When your operating system (OS) or applications release a new version, install it. If the software you use offers the option of automatic updating, enable it. > Trust no one. Literally. Any account can be compromised and malicious links can be sent from the accounts of friends on social media, colleagues or an online gaming <https://blog.kaspersky.com/teslacrypt-20-ransomware/9314/> partner. Never open attachments in emails from someone you don’t know. Similarly, don’t open attachments in emails from somebody you know but from whom you would not expect to receive such as message. Cybercriminals often distribute fake email messages that look very much like email notifications from an online store, a bank, the police, a court or a tax collection agency, luring recipients into clicking on a malicious link and releasing the malware into their system. If in doubt, call the sender at a trusted phone number to confirm the legitimacy of the message received. > Enable the ‘Show file extensions’ option in the Windows settings on your computer. This will make it much easier to spot potentially malicious files. Stay away from file extensions like ‘.exe’, ‘.com’, ‘.vbs’ or ‘.scr’. Cybercriminals can use several extensions to disguise a malicious file as a video, photo, or document (like hot-chics.avi.exe or report.doc.scr). > If you discover a rogue or unknown process on your machine, disconnect it immediately from the internet or other network connections (such as home Wi-Fi) — this will prevent the infection from spreading. > > > > > ******************* > > DISCLAIMER : This message is sent in confidence and is only intended for the named recipient. If you receive this message by mistake, you may not use, copy, distribute or forward this message, or any part of its contents or rely upon the information contained in it. > Please notify the sender immediately by e-mail and delete the relevant e-mails from any computer. This message does not constitute a commitment by Europol unless otherwise indicated. > > *******************

8 8

First RIPE NCC webinar for law enforcement
by Richard Leaning 17 May '17

17 May '17

Hi all, As many of you know, the RIPE NCC has been actively engaging with law enforcement across Europe to help them gain a better understanding of RIPE NCC tools and services that might be of use in cybercrime investigations. As part of this initiative, on 15 May we held the first in a series of six webinars tailored specifically to police, law enforcement and judiciary working in the area of cybercrime, in collaboration with Europol and CEPOL (the European Union Agency for Law Enforcement Training). You can read more in the news announcement: https://www.ripe.net/publications/news/ripe-ncc-webinars-for-law-enforcement We’ll also publish a more detailed article on RIPE Labs when the webinar series concludes next month. Kind regards, Richard Leaning External Relations RIPE NCC

1 0

Re: [anti-abuse-wg] WannaCry Ransomware
by Marilson 16 May '17

16 May '17

Olaf, You forgot to comment on the real reason for this unending and weekly update for 10 years. These OSs have more holes than Swiss cheese and spying runs wild. Deliberate holes or not they should pay for us to use these tools. But when you say that this product is bad "to spare a few cents on proper development" you are underestimating them. The product is made according to a predetermined purpose. Olaf, read what Phillip Misner, principal security group manager at the Microsoft Security Response Center, wrote: "Seeing businesses and individuals affected by cyberattacks, such as the ones reported today, was painful. Microsoft worked throughout the day to ensure we understood the attack and were taking all possible actions to protect our customers." What moving words! It makes you want to cry ... of anger! They have made Volkswagen pay a high price for a fraud that looks more like a child's play than Microsoft and the NSA do. Oh yes! I forgot that they do what they do to protect us from terrorists ... That's why they read Mutti Merkel's emails and the strategies of competing companies. I would like to know what the Europol EC3 will do. Will pursue a hacker or those who created the virus and the port? Marilson From: HRH Prince Sven Olaf von CyberBunker Sent: Monday, May 15, 2017 4:17 PM To: Marilson ; anti-abuse-wg(a)ripe.net ; rleaning(a)ripe.net Cc: Philipp.Amann(a)europol.europa.eu ; o3(a)europol.europa.eu ; O372(a)europol.europa.eu Subject: Re: [anti-abuse-wg] WannaCry Ransomware Microsoft inc. most definately has been deliberately putting their customers AND third parties at risk with it's "it kinda works - ship it!" business mentality. They have deliberately sold, and are currently selling un-finished premature software and didn't bother to seriously look at their own code for at least 15 years. Until problems started popping up because others did. Their most recent remote execution exploit was discovered by some guy linked to Google, without even having access to the source code. One would say that Microsoft itself could have reviewed their code years ago already, and didn't. In fact microsoft maintains a 'telemetry' (basically espionage) system within windows that reports crashes to them when they occur from customer computers, unknown to those customers. the legal aspects of that too, require investigation. It facilitates tracking of customer activity and ip address data/location. Apperantly they did find time to build in a few 1000 'telemetry points' but not to fix their implementation of a 30 year old IBM network file sharing protocol. By the time they became (officially) aware of the bug, they refused to halt their sales, did not do a recall on systems and install media in the retail chain, and happily continued to deliberately sell their broken product while they were working on some patch. Most likely install media (cds/dvds) and systems containing pre-installed broken versions are still for sale in retail stores now. Then presenting themselves (microsoft) providing a patch for their self-declared 'unsupported' windows xp as being something 'generous' ignoring the fact that their users, which have paid for a working product, have been shipped off with a broken product, endangering them for 15 years. Note that they never even mentioned the words 'REFUND' or 'RECALL' - asking the customer to apply a patch in their own manhours and at their own cost, to fix something that was sold broken to them and is endangering them and others is highly arrogant to say the least. Some of microsoft's customers getting some files encrypted is not a real problem. The real problems with microsoft's business tactics lie in the dangers that come with other possible uses of the same vulnerabilities. Using a wormable remote code execution vulnerability such as the one used by wannacry, one can make laptop batteries explode, ventilators halt and cpus catch fire. (and the buildings they are in shortly afterwards) Using a wormable remote code execution vulnerability such as the one used by wannacry, considering microsoft's installed base and market penetration, one can easily ddos the entire internet down for quite some time. When a few million microsoft machines start to ddos random other ips there won't be any 'downloading patches' anymore, there won't be any downloading of anything anymore for quite a while, as the internet will be completely down, and not just for microsoft customers. Now, I suggest, a certain party with slightly wider-established diplomatic immunity than ours, just hacks and permanently disables all remaining vulnerable nodes with a text display routine in the bootsector telling them how to 1: restore the bootsector and 2: apply the patch or (preferably) install a different operating system. A more proactive approach, such as hacking into and shutting down or force-patching all remaining vulnerable boxes is desired, as well as a criminal investigation into microsoft itself and the way they do product development and bugfixing. Bothering chasing whomever made wannacry and whomever will make the no-doubt 1000s of other worms and virusses exploiting this vulnerability is of no use whatsoever, the -real- problem, is microsoft's way of product development and release. This is not a matter of selling a car without seatbelts, this is a matter of deliberately selling a car where the wheels break off and hit bystanders in the head, to spare a few cents on proper development. Typical american garbage which does not belong on the EU market. Pull them off the road. On 15 ماي, 2017 م 06:35, Marilson wrote: On May 14, 2017 EC3 wrote: > If you want to share any other prevention, protection or awareness information with us, please do not hesitate to contact us. Yeah! I do. Thank you. To prevent, protect and raise awareness, it is necessary to estimate the damage that this virus will cause and to charge this amount from the US Government and Microsoft. Microsoft has created a "flaw", a port for the NSA to spy on governments and businesses around the world. When the "software", created by the NSA, to use that port was hacked, the NSA informed Microsoft that it released a patch to "fix the flaw". And did it quietly, not to arouse suspicion. This distinguished company still tried to get high gains with the misfortune of others by selling patch to OS prior to the W7. Until a young Englishman created a key to unlock hijacked computers. And this patch became free. Do you want to criminalize the hacker who is hijacking computers? Wrong! Be grateful to him as you should be to Snowden. Marilson By honest competition and true capitalism.

1 0

Re: [anti-abuse-wg] WannaCry Ransomware
by Marilson 15 May '17

15 May '17

Peter H wrote: > Why is noone doing something effective against SPAM ? Are you kidding? Do you know what was the AVERAGE DAILY SPAM VOLUME FOR APRIL 2017 ? 394.39 BILLION PER DAY. May 10 2017: Total Email Volume: 505.28 Spam Volume: 430.2 - 85% are spam Be careful what you wish for! Have you tired of living? Marilson

1 0

Re: [anti-abuse-wg] WannaCry Ransomware
by Marilson 15 May '17

15 May '17

On May 14, 2017 EC3 wrote: > If you want to share any other prevention, protection or awareness information with us, please do not hesitate to contact us. Yeah! I do. Thank you. To prevent, protect and raise awareness, it is necessary to estimate the damage that this virus will cause and to charge this amount from the US Government and Microsoft. Microsoft has created a "flaw", a port for the NSA to spy on governments and businesses around the world. When the "software", created by the NSA, to use that port was hacked, the NSA informed Microsoft that it released a patch to "fix the flaw". And did it quietly, not to arouse suspicion. This distinguished company still tried to get high gains with the misfortune of others by selling patch to OS prior to the W7. Until a young Englishman created a key to unlock hijacked computers. And this patch became free. Do you want to criminalize the hacker who is hijacking computers? Wrong! Be grateful to him as you should be to Snowden. Marilson By honest competition and true capitalism. From: anti-abuse-wg-request(a)ripe.net Sent: Monday, May 15, 2017 8:20 AM To: anti-abuse-wg(a)ripe.net Subject: anti-abuse-wg Digest, Vol 66, Issue 2 Send anti-abuse-wg mailing list submissions to anti-abuse-wg(a)ripe.net To subscribe or unsubscribe via the World Wide Web, visit https://lists.ripe.net/mailman/listinfo/anti-abuse-wg or, via email, send a message with subject or body 'help' to anti-abuse-wg-request(a)ripe.net You can reach the person managing the list at anti-abuse-wg-owner(a)ripe.net When replying, please edit your Subject line so it is more specific than "Re: Contents of anti-abuse-wg digest..." Today's Topics: 1. WannaCry Ransomware (Richard Leaning) ---------------------------------------------------------------------- Message: 1 Date: Mon, 15 May 2017 06:57:23 +0100 From: Richard Leaning <rleaning(a)ripe.net> To: "cooperation-wg(a)ripe.net" <cooperation-wg(a)ripe.net>, "anti-abuse-wg(a)ripe.net" <anti-abuse-wg(a)ripe.net> Subject: [anti-abuse-wg] WannaCry Ransomware Message-ID: <5961E790-4494-46F4-A71C-6C34B4DDA8D0(a)ripe.net> Content-Type: text/plain; charset="utf-8" Dear Colleagues, The European cybercrime centre at Europol have asked us to circulate the below. I hope you find it useful and please forward it on to anyone who you may think will benefit from it. Kind regards Richard Leaning External Relations RIPE NCC > Begin forwarded message: > > From: "O3 - European Cybercrime Centre (EC3)" <o3(a)europol.europa.eu> > Subject: @EXT: WannaCry Ransomware > Date: 14 May 2017 at 19:06:20 BST > Cc: "Amann, Philipp" <Philipp.Amann(a)europol.europa.eu>, Mounier, Gr?gory <gregory.mounier(a)europol.europa.eu>, "Sanchez, Maria" <maria.sanchez(a)europol.europa.eu>, "O372 Advisory Groups Support" <O372(a)europol.europa.eu> > > Dear AG members, > > As you are no doubt aware, we are currently experiencing an unprecedented ransomware attack at a global scale. The malware was detected on 12 May 2017 and has the capability to spread across networks taking advantage of a critical exploit in a popular communication protocol used by Windows systems. > > Many of you have already reached out and are actively involved in containing this threat. However, since we believe that the infection and propagation rate may go up on Monday when people return to their workplaces, we would like to ask you to please help us distribute information that can help contain this threat. To this end, we have compiled a list of recommendations and also prepared an infographic (see attachment). Please feel free to use this information for reaching out to your network and to complement your advice, if and where useful. > > Also, the No More Ransom (NMR) initiative, actively supported by many of you already, remains an essential source of information. Together with you and other partners, we will continue to update the information available via the NMR portal, so it is important to watch this space as well. > > If you want to share any other prevention, protection or awareness information with us, please do not hesitate to contact us. > > Thank you again for your continued support. > > Kind regards, > EC3 Outreach & Support > > -------------------------------- > > If you are a victim or have reason to believe that you could be a victim > > This is link provides some practical advice on how to contain the propagation of this type of ransomware: https://www.ncsc.gov.uk/guidance/ransomware-latest-ncsc-guidance <https://www.ncsc.gov.uk/guidance/ransomware-latest-ncsc-guidance> > > The most important step involves patching the Microsoft vulnerability (MS17-010): > https://technet.microsoft.com/en-us/library/security/ms17-010.aspx <https://technet.microsoft.com/en-us/library/security/ms17-010.aspx> > > A patch for legacy platforms is available here: > https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-w… <https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-w…> > > In instances where it is not possible to install the patch, manage the vulnerability becomes key. One way of doing this would be to disable the SMBv1 (Server Message Block) protocol: > https://support.microsoft.com/en-us/help/2696547 <https://support.microsoft.com/en-us/help/2696547> > and/or block SMBv1 ports on network devices [UDP 137, 138 and TCP 139, 445]. > > Another step would be to update endpoint security and AV solutions with the relevant hashes of the ransomware (e.g. via VirusTotal). > > If these steps are not possible, not starting up and/or shutting down vulnerable systems can also prevent the propagation of this threat. > > How to prevent a ransomware attack? > > Back-up! Back-up! Back-up! Have a backup and recovery system in place so a ransomware infection can?t destroy your personal data forever. It?s best to create at least two back-up copies on a regular basis: one to be stored in the cloud (remember to use a service that makes an automatic backup of your files) and one stored locally (portable hard drive, thumb drive, etc.). Disconnect these when you are done and store them separately from your computer. Your back-up copies will also come in handy should you accidentally delete a critical file or experience a hard drive failure. > Use robust antivirus software to protect your system from ransomware. Always use the latest virus definition/database and do not switch off the ?heuristic? functions as these help the solution to catch samples of ransomware (and other type of malware) that have not yet been formally detected. > Keep all the software on your computer up to date. When your operating system (OS) or applications release a new version, install it. If the software you use offers the option of automatic updating, enable it. > Trust no one. Literally. Any account can be compromised and malicious links can be sent from the accounts of friends on social media, colleagues or an online gaming <https://blog.kaspersky.com/teslacrypt-20-ransomware/9314/> partner. Never open attachments in emails from someone you don?t know. Similarly, don?t open attachments in emails from somebody you know but from whom you would not expect to receive such as message. Cybercriminals often distribute fake email messages that look very much like email notifications from an online store, a bank, the police, a court or a tax collection agency, luring recipients into clicking on a malicious link and releasing the malware into their system. If in doubt, call the sender at a trusted phone number to confirm the legitimacy of the message received. > Enable the ?Show file extensions? option in the Windows settings on your computer. This will make it much easier to spot potentially malicious files. Stay away from file extensions like ?.exe?, ?.com?, ?.vbs? or ?.scr?. Cybercriminals can use several extensions to disguise a malicious file as a video, photo, or document (like hot-chics.avi.exe or report.doc.scr). > If you discover a rogue or unknown process on your machine, disconnect it immediately from the internet or other network connections (such as home Wi-Fi) ? this will prevent the infection from spreading. > > > > > ******************* > > DISCLAIMER : This message is sent in confidence and is only intended for the named recipient. If you receive this message by mistake, you may not use, copy, distribute or forward this message, or any part of its contents or rely upon the information contained in it. > Please notify the sender immediately by e-mail and delete the relevant e-mails from any computer. This message does not constitute a commitment by Europol unless otherwise indicated. > > *******************

1 0

Agenda Update - AA-WG Meeting at RIPE 74
by Brian Nisbet 10 May '17

10 May '17

Colleagues, Here is the draft agenda for RIPE 74. The WG meeting is to take place at 11:00CEST on Thursday 11th May. We've added an update from the RIPE NCC in relation to LEA interactions. If there is something else you'd like to discuss, please let me know. A. Administrative Matters * Welcome * Scribe, Jabber, Stenography * Microphone Etiquette * Approve Minutes from RIPE 73 * Finalise agenda B. Update * B1. Recent List Discussion? * B2. C. Policies - * C1. D. Interactions - * D1. Working Groups - DB & Implementation of "abuse-c" * D2. RIPE NCC LEA Interactions Update E. Presentation - * E1. Network & Information Security Directive, Nathalie Falot, NCSC-NL X. A.O.B. Z. Agenda for RIPE 75 -- Brian Nisbet Network Operations Manager HEAnet CLG, Ireland's National Education and Research Network 1st Floor, 5 George's Dock, IFSC, Dublin D01 X8N7, Ireland +35316609040 brian.nisbet(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

1 0