- EURO-Discuss - lists.icann.org

Russian interpretation of ALAC calls
by Olivier MJ Crépin-Leblond July 24, 2019

July 24, 2019

Dear Colleagues, I am in receipt of an email from ALAC Chair Maureen Hilyard, relating to Russian language interpretation of ALAC calls. Records shows that these services have not be used at all, thus there is nobody on the Russian language Channel. Is there the need for ICANN to continue with this interpretation service? Kindest regards, Olivier

4 4

Re: [EURO-Discuss] Zoom Structural Vulnerability Discovered
by Jean-Jacques Subrenat July 11, 2019

July 11, 2019

First, a remark: for Adobe, Zoom or other tool providers, ICANN may not be the single largest client, but it is certainly a significant one owing to its nature (quasi-regulatory, multi-stakeholder, some parts geared to non-commercial users). Then, a recommendation to Chairs of ACs and SOs: ICANN Board and CEO could be requested to set up a specifications sheet for a desirable conferencing tool, based on needs expressed by the multi-stakeholder community, and publish that as a tender. Offers received could then be reviewed not only by Staff, but in consultation with ACs and SOs. This would get us closer to what we, collectively, consider as the appropriate tool for the numerous conference calls held throughout ICANN. Jean-Jacques Subrenat. Le 10 juillet 2019 à 14:46:20, Paul Rosenzweig (paul.rosenzweig(a)redbranchconsulting.com) a écrit: This is assuredly right. The change from Adobe to Zoom may, or may not, have been right for ICANN and for this group for any number of reasons ranging from cost, to security, to scalability and utility. But let’s not romanticize Adobe. They are not a terribly secure platform generically. As James said, the Zoom response is poor – but we can’t hang that around the neck of ICANN org. P Paul Rosenzweig paul.rosenzweig(a)redbranchconsulting.com O: +1 (202) 547-0660 M: +1 (202) 329-9650 VOIP: +1 (202) 738-1739 www.redbranchconsulting.com My PGP Key: https://keys.mailvelope.com/pks/lookup?op=get&search=0x9A830097CA066684 From: NCSG-Discuss <NCSG-DISCUSS(a)LISTSERV.SYR.EDU> On Behalf Of James Gannon Sent: Wednesday, July 10, 2019 12:52 AM To: NCSG-DISCUSS(a)LISTSERV.SYR.EDU Subject: Re: Zoom Structural Vulnerability Discovered Just want to call out that Adobe has likely the worst reputation in the entire tech industry when it comes to security, I really would not hold them out as either prompt or without serious issues (I believe they still hold the record for number of CVSS 9+ vulns). Zooms response is poor I agree, but on a data driven comparison it is a far more secure platform. From: NCSG-Discuss <NCSG-DISCUSS(a)LISTSERV.SYR.EDU> on behalf of Ayden Férdeline <icann(a)FERDELINE.COM> Reply-To: Ayden Férdeline <icann(a)FERDELINE.COM> Date: Tuesday, 9 July 2019 at 14:13 To: "NCSG-DISCUSS(a)LISTSERV.SYR.EDU" <NCSG-DISCUSS(a)LISTSERV.SYR.EDU> Subject: Re: Zoom Structural Vulnerability Discovered That is true, but note that this security researcher notified Zoom of the exploit and they were in no rush to repair it. Look at the timeline in the Medium post. They only sought to fix it after the vulnerability drew media attention. Adobe Connect was not perfect but it met our needs and the occasional security issues that arose were promptly fixed by Adobe and never as serious as this one! Best wishes, Ayden On Tue, Jul 9, 2019 at 18:07, Adeel Sadiq <11beeasadiq(a)seecs.edu.pk> wrote: Speaking from a technical perspective, no software is perfect or bug-free. Its only a matter of time a loophole is found and exploited and eventually patched up. If you think Adobe Connect or ezTalks were/are free of these architectural issues, think again! That's the way we technical community do things. Regards Adeel Pakistan On Wed, Jul 10, 2019 at 1:37 AM Ayden Férdeline <icann(a)ferdeline.com> wrote: Unfortunately, uninstalling the application does not rectify the situation, due to poor architecture (acknowledged by Zoom on their blog today). They are working on a fix, now that public scrutiny demands one. So disappointing that ICANN has put us in this terrible situation. Ayden On Tue, Jul 9, 2019 at 16:15, Vaibhav Aggarwal, Catalyst & Group CEO <va(a)BLADEBRAINS.COM> wrote: Thanks for this. Till the next Update, I have removed the Zoom For Mac Client with immediate effect. Regards, Vaibhav Aggarwal New Delhi VaibhavAggarwal.com On Jul 10, 2019, at 12:30 AM, Michael Karanicolas <mkaranicolas(a)GMAIL.COM> wrote: Hey - remember when ICANN switched everyone from Adobe over to Zoom as a way of enhancing information security and data privacy? "A vulnerability in the Mac Zoom Client allows any malicious website to enable your camera without your permission... This vulnerability allows any website to forcibly join a user to a Zoom call, with their video camera activated, without the user's permission. On top of this, this vulnerability would have allowed any webpage to DOS (Denial of Service) a Mac by repeatedly joining a user to an invalid call. Additionally, if you’ve ever installed the Zoom client and then uninstalled it, you still have a localhost web server on your machine that will happily re-install the Zoom client for you, without requiring any user interaction on your behalf besides visiting a webpage. This re-install ‘feature’ continues to work to this day." Read more here: https://medium.com/@jonathan.leitschuh/zoom-zero-day-4-million-webcams-mayb…

3 3

Test your browser config if it launches Zoom automatically with camera and mic enabled
by Dev Anand Teelucksingh July 11, 2019

July 11, 2019

This has been posted to the Technology Taskforce wiki page https://community.icann.org/display/atlarge/Zoom+conferencing+solution - Dev Anand The security researcher Jonathan Leitschuh who publicly disclosed the Zoom security vulnerability has noted that depending on your browser setting on whether to always open Zoom links with the associated app is on, a malicious webpage (that could be hidden in a iframe) can automatically launch Zoom with your camera enabled without asking. This is true for Windows as well as for Mac for Firefox and Chrome browsers. As he noted in his tweet at https://twitter.com/JLLeitschuh/status/1149123386855104516 Here is a Proof of Concept Link to see whether Zoom will autolaunch with your camera and mic enabled : https://jlleitschuh.org/zoom_vulnerability_poc/zoompwn_iframe.html If your browser settings are set to always these type of Zoom links with the associated app, you *will* be automatically launched into a Zoom conference with your camera enabled. How to prevent Zoom from auto-opening Zoom links on a webpage : In Mozilla Firefox, - 1) Click the menu button [image: Fx57Menu] and choose Options. - 2) In the General panel, go to the *Applications* section. 3) Search for the Content Type *zoommtg* and select it. 4) Click on the Action column in the *zoommtg* row to change the action to "*always ask*" /twitter.com/JLLeitschuh/status/114912338685510dsds [image: firefox-turning-off-automatic-open-zoom.png] In Google Chrome: This is harder for Google Chrome which saves such settings in a preferences file which isn't accessible from the browser. >From https://support.google.com/chrome/answer/114662 "Chrome allows external applications and web services to open certain links. For example, certain links can open a site like Gmail or a program like iTunes. If you set a default action for a type of link but want to delete it, clear your browsing data <https://support.google.com/chrome/answer/2392709> ( https://support.google.com/chrome/answer/2392709) and select "Cookies and other site data." Here's the more "hacky" way: 1) Navigate to chrome://version/ and find the path listed under "Profile Path". 2) Quit Chrome, open that directory, and then open the "Preferences" file. This will appear be a long line of text in a text editor. 3) Look for the string "zoommtg":false or "zoomrc":false. If it either exist, remove them. If there is a comma immediately after either string, remove it as well. 4) Save the file. Visit Jonathan Leitschuh's Proof of Concept page at * https://jlleitschuh.org/zoom_vulnerability_poc/zoompwn_iframe.html <https://jlleitschuh.org/zoom_vulnerability_poc/zoompwn_iframe.html>* to see if your browser asks to open Zoom. This is what you will see in Mozilla Firefox : [image: firefox-ask-to-launch-zoom.png] and this is what you will see in Google Chrome: [image: chrome-ask-to-launch-zoom.png]

1 0

Meeting invitation: EURALO Monthly Call on Tuesday, 17 September 2019 at 18:00 UTC
by Michelle DeSmyter July 9, 2019

July 9, 2019

Dear All, The next EURALO Monthly Call is scheduled for Tuesday, 17 September 2019 at 18:00 UTC. For other times: https://tinyurl.com/y5pu4v3n The agenda (to be updated) and call details can be found at: https://community.icann.org/x/RKmjBg Zoom Room: https://icann.zoom.us/j/771250164 EURALO Main Wiki Portal: https://community.icann.org/x/K5Qi EURALO Web Page: https://atlarge.icann.org/ralos/euralo ADIGO Conf. ID EN: 1638 Toll-free access number (US and Canada): 800 550 6865 Other toll-free numbers: http://adigo.com/icann/ Thank you. Kind regards, At-Large Staff ICANN Policy Staff in support of the At-Large Community Website: atlarge.icann.org<https://atlarge.icann.org/> Facebook: facebook.com/icann<https://www.facebook.com/icannatlarge>atlarge<https://www.facebook.com/icannatlarge> Twitter: @<https://twitter.com/ICANNAtLarge>ICANNAtLarge<https://twitter.com/ICANNAtLarge>

2 1

EURALO Monthly Call
by ICANN Policy Calendar July 9, 2019

July 9, 2019

Dear All, The next EURALO Monthly Call is scheduled for Tuesday, 17 September 2019 at 18:00 UTC. For other times: https://tinyurl.com/y5pu4v3n The agenda (to be updated) and call details can be found at: https://community.icann.org/x/RKmjBg Zoom Room: https://icann.zoom.us/j/771250164 EURALO Main Wiki Portal: https://community.icann.org/x/K5Qi EURALO Web Page: https://atlarge.icann.org/ralos/euralo ADIGO Conf. ID EN: 1638 Toll-free access number (US and Canada): 800 550 6865 Other toll-free numbers: http://adigo.com/icann/ Thank you. Kind regards, At-Large Staff ICANN Policy Staff in support of the At-Large Community Website: atlarge.icann.org<https://atlarge.icann.org/> Facebook: facebook.com/icann<https://www.facebook.com/icannatlarge>atlarge<https://www.facebook.com/icannatlarge> Twitter: @<https://twitter.com/ICANNAtLarge>ICANNAtLarge<https://twitter.com/ICANNAtLarge>

1 0

Happy Birthday
by Roberto Gaetano July 9, 2019

July 9, 2019

Hi Olivier. I was taken by surprise and the Zoom closed before I was able to find the emoji that I needed. Here they are, for you: 🎂🥂 Happy Birthday R

1 0

**CALL ON IN 15 MINUTES** Meeting invitation: EURALO Monthly Call on Tuesday, 09 July 2019 at 18:00 UTC
by ICANN At-Large Staff July 9, 2019

July 9, 2019

Dear All, The next EURALO Monthly Call is scheduled for Tuesday, 09 July 2019 at 18:00 UTC. For other times: https://tinyurl.com/y39pjrw6 The agenda (to be updated) and call details can be found at: https://community.icann.org/x/q6WjBg Zoom Room: https://icann.zoom.us/j/547642341 EURALO Main Wiki Portal: https://community.icann.org/x/K5Qi EURALO Web Page: https://atlarge.icann.org/ralos/euralo ADIGO Conf. ID EN: 1638 Toll-free access number (US and Canada): 800 550 6865 Other toll-free numbers: http://adigo.com/icann/ Thank you. Kind regards, At-Large Staff ICANN Policy Staff in support of the At-Large Community Website: atlarge.icann.org<https://atlarge.icann.org/> Facebook: facebook.com/icann<https://www.facebook.com/icannatlarge>atlarge<https://www.facebook.com/icannatlarge> Twitter: @<https://twitter.com/ICANNAtLarge>ICANNAtLarge<https://twitter.com/ICANNAtLarge>

1 0

Meeting invitation: EURALO Monthly Call on Tuesday, 09 July 2019 at 18:00 UTC
by ICANN At-Large Staff July 9, 2019

July 9, 2019

Dear All, The next EURALO Monthly Call is scheduled for Tuesday, 09 July 2019 at 18:00 UTC. For other times: https://tinyurl.com/y39pjrw6 The agenda (to be updated) and call details can be found at: https://community.icann.org/x/q6WjBg Zoom Room: https://icann.zoom.us/j/547642341 EURALO Main Wiki Portal: https://community.icann.org/x/K5Qi EURALO Web Page: https://atlarge.icann.org/ralos/euralo ADIGO Conf. ID EN: 1638 Toll-free access number (US and Canada): 800 550 6865 Other toll-free numbers: http://adigo.com/icann/ Thank you. Kind regards, At-Large Staff ICANN Policy Staff in support of the At-Large Community Website: atlarge.icann.org<https://atlarge.icann.org/> Facebook: facebook.com/icann<https://www.facebook.com/icannatlarge>atlarge<https://www.facebook.com/icannatlarge> Twitter: @<https://twitter.com/ICANNAtLarge>ICANNAtLarge<https://twitter.com/ICANNAtLarge>

3 4

IG events in Kyiv, Ukraine, 23-26 September
by Oksana Prykhodko July 9, 2019

July 9, 2019

Dear all, Yesterday we at last oficially confirmed the dates of IG event in Ukraine: 23 September - X IGF-UA; 24-25 September - RIPE NCC Regional Meeting: 26 September - II Youth IGF-UA. Welcome to Kyiv! Best regards, Oksana

1 0

Regional Advice Needed / 294 BIKLAB
by Olivier MJ Crépin-Leblond July 8, 2019

July 8, 2019

Dear Colleagues, in early June we received an application for ALS from an organisation called BIKLAB, based in Guadeloupe. The application had initially gone to LACRALO by error and this was finally forwarded to EURALO - as Guadeloupe is French Overseas Region in the Caribbean. The application form contains personal details and confidential information that cannot be shared on a public mailing list, but if you are interested in looking at it, please email me and I'll forward it to you. In the meantime, I have asked EURALO leadership, that is, EURALO Board and appointees, directly by email, whether they have any objections to ratification of this organisation as an ALS. After some discussion regarding funding of this organisation (they are self-funding but had indicated otherwise by error), there were no objections to ratification of this organisation. In addition to this, since this organisation is located physically in the LACRALO region, we have struck a deal with LACRALO whereas members of BIKLAB could also participate in LACRALO activities as Observers. BIKLAB would retain its voting right in EUROPE only. So -- to summarise, if you'd like to have a look at the application, email me directly and I'll forward it to you by email. Otherwise, I'll give a last chance to discuss this during our EURALO monthly call tomorrow and then if there are no objections, I'll proceed with letting At-Large Staff know that the recommendation from EURALO to the ALAC is to ratify BIKLAB as an ALS. Kindest regards, Olivier

1 0