[Newsclips] IETF SYN-ACK Newspack 2021-08-02

[David Goldstein <[e-mail]>]

The IETF SYN-ACK Newspack collects IETF-related items from a variety of news outlets and other online publications. They do not represent the views of the IETF and are not checked for factual accuracy.

 

 

**********************

IETF IN THE NEWS

**********************

Passing the Torch to the next Internet Society Board Chair by Gonzalo Camarillo

In the 2016 Internet Society AGM, I was elected Chair of the Board by the trustees of the Internet Society. I have had the honor and the privilege to serve in that capacity during the last five years. In the upcoming 2021 Internet Society AGM I will reach my term limit as an ISOC trustee and, thus, will be time for me to leave the Board and pass the torch to the next Board Chair, who will be elected at the beginning of the meeting.

< <https://www.internetsociety.org/blog/2021/07/passing-the-torch-to-the-next-internet-society-board-chair/> https://www.internetsociety.org/blog/2021/07/passing-the-torch-to-the-next-internet-society-board-chair/>

 

‘Smart’ regulatory framework needed for ‘Internet’ governance

WITH the world being connected through the Internet at the touch of a device, a smart regulatory framework created with input of multiple stakeholders is necessary for advancing dynamic public policies in Internet governance. ... She related that various organisations such as the Internet Society (ISOC), the Internet Engineering Task Force (IETF) and the World Wide Web Consortium (WWWC) work together to facilitate the Internet’s daily operations.

< <https://guyanachronicle.com/2021/08/01/smart-regulatory-framework-needed-for-internet-governance/> https://guyanachronicle.com/2021/08/01/smart-regulatory-framework-needed-for-internet-governance/>

 

Building Networks on the Fly

... Fortunately, industry groups such as the Internet Engineering Task Force (IETF) were already working on the first element--developing standard data formats for different types of equipment. For instance, an IETF standard, Request-for-Comment (RFC) 1759, released in 1995, provides a standard way of describing printer capabilities. Typically, printers can accept different sizes of paper from different input bins, print in different colors, sort and collate, and create printing logs. RFC 1759 describes how this information, along with printer status (such as "in use" or "warming up") should be encoded and stored in a file called the Printer MIB (management information base) table.

< <https://spectrum.ieee.org/building-networks-on-the-fly> https://spectrum.ieee.org/building-networks-on-the-fly>

 

pk: Cabinet may approve first 'National Cyber Security Policy 2021' today

The federal cabinet is likely to approve the first "National Cyber Security Policy 2021" and policy directive for the auction of Next Generation Mobile Services (NGMS) spectrum in Pakistan, Azad Jammu and Kashmir, and Gilgit-Baltistan on Tuesday (today). ... The Central Entity will also undertake specific actions, which including but not limited to the following: working with Internet Service Providers (ISP) and telecom operators to block malware attacks, by restricting access to specific domains or websites that are known sources of malware (known as Domain Name System (DNS) blocking/filtering), preventing email phishing and spoofing activity on public networks, promoting security best practice through internet governance organisations; such as Internet Corporation for Assigned Names and Numbers (ICANN), the Internet Engineering Task Force (IETF), European Regional Internet Registry (RIPE) and UN Internet Governance Forum (IGF) etc; Work with international law enforcement channels to protect Pakistan citizens from cyberattacks from unprotected infrastructure overseas; Work towards implementation of controls to secure the routing of internet traffic for government departments to avoid illegitimately re-routed by malicious actors; Investing in capabilities enhancement programs of law enforcement agencies (LEAs) and concerned ministries/divisions to enable them for response against state-sponsored and criminal cyber activities targeting Pakistan networks and systems.

< <https://www.brecorder.com/news/40109244> https://www.brecorder.com/news/40109244>

 

Beyond OAuth? GNAP for Next Generation Authentication

The Grant Negotiation and Authorization Protocol, or GNAP (“g-nap”), is currently being developed in an Internet Engineering Task Force (IETF) working group. Here, I’ll discuss why GNAP is being developed and what its upcoming first release might mean for you.

< <https://thenewstack.io/beyond-oauth-gnap-as-the-next-generation-of-authentication/> https://thenewstack.io/beyond-oauth-gnap-as-the-next-generation-of-authentication/>

 

Taming Pegasus: A Way Forward on Surveillance Tech Proliferation

As Amnesty International and Forbidden Stories continue to publish crucial information about the potential targets of NSO Group’s spyware, we know this much already: something needs to be done. ... Big decisions on cybersecurity are not only decided in board rooms and government departments; there are a number of non-governmental and intergovernmental standards bodies which make important design decisions. Bodies such as the Internet Engineering Task Force (IETF), the Internet Corporation for Assigned Names and Numbers (ICANN), the World Wide Web Consortium (WWWC), International Telecommunications Union (ITU) and the 3rd Generation Partnership Project (3GPP) all develop protocols which govern much of how modern IT infrastructure functions.

< <https://www.privacyinternational.org/news-analysis/4602/taming-pegasus-way-forward-surveillance-tech-proliferation> https://www.privacyinternational.org/news-analysis/4602/taming-pegasus-way-forward-surveillance-tech-proliferation>

 

Seven Myths about Voice over IP: VoIP is turning telephony into just another Internet application—and a cheap one at that

VOIP is a relatively new network application, so it should come as no surprise that its particular quality-of-service problems—latency, jitter, and packet loss—are still being worked out. But fundamentally, these are problems of network congestion, and network engineers have already devised some clever methods to guarantee a minimum bandwidth for a particular application. The latest scheme, Multiprotocol Label Switching, or MPLS, is still being refined by the Internet Engineering Task Force, an international volunteer organization sponsored by the Internet Society.

< <https://spectrum.ieee.org/seven-myths-about-voice-over-ip> https://spectrum.ieee.org/seven-myths-about-voice-over-ip>

 

5G Will 10X Crypto Adoption in Developing Markets

... 5G networks are more secure as compared to the previous generation of the mobile network protocol. The upgrade follows massive testing that has been performed on the network and simulations that have ensured that it is safer for use. Before IETF could roll it out, it has to be used in different scenarios. All the bugs that were present in the design and the network specifications were removed. Testing improved the network standard making it the ideal choice for modern networks. Cryptocurrency applications are also security-sensitive. Using them on top of a more secure network makes them more efficient. The applications designed to work with the network can pass vast amounts of data in a short amount of time without slowing down.

< <https://qrius.com/5g-will-10x-crypto-adoption-in-developing-markets/> https://qrius.com/5g-will-10x-crypto-adoption-in-developing-markets/>

 

Privacy protection: DNS encryption in a field test at Telekom

... DoH isn’t the only way to encrypt DNS data, however. With DNSCrypt there has been a procedure for this for years, but it has not yet become widely accepted. DNS-over-TLS (DoT) and DNS-over-HTTPS were later created under the umbrella of the Internet Engineering Task Force (IETF).

< <https://marketresearchtelecast.com/privacy-protection-dns-encryption-in-a-field-test-at-telekom/112944/> https://marketresearchtelecast.com/privacy-protection-dns-encryption-in-a-field-test-at-telekom/112944/>

 

10 Advantages of the Google Meet App

... All meetings are encrypted by default through IETF security standards.

< <https://floridanewstimes.com/10-advantages-of-the-google-meet-app/315505/> https://floridanewstimes.com/10-advantages-of-the-google-meet-app/315505/>

 

Internet Année Zéro : la naissance des monstres numériques [Internet Year Zero: the birth of digital monsters]

... Un détail technique va changer la donne. Il porte le nom inoffensif de cookie. Le cookie est un petit fichier de mémoire, stocké par le navigateur sur l’ordinateur de l’utilisateur, qui ne peut être lu que par le service web qui l’a écrit. Le navigateur transmet le cookie chaque fois qu’une nouvelle connexion est établie avec le service, permettant de créer une relation de longue durée, et privée, entre le service et l’utilisateur. Par exemple, les cookies permettent de maintenir une session ouverte, donc que d’une page à l’autre, l’utilisateur n’ait pas à réintroduire ses identifiants, ou encore que le contenu d’un panier ne disparaisse pas. Le cookie est d’abord développé en 1994 au sein du navigateur Netscape. Trois ans plus tard, une spécification de l’Internet Engineering Task Force (IETF), l’organisme chargé de faire émerger les standards qui composent la suite des protocoles internet, met en garde contre le risque en termes de vie privée de certains types de cookies.

< <https://lvsl.fr/internet-annee-zero-ou-leclairant-recit-de-jonathan-bourguignon-sur-la-naissance-des-monstres-numeriques/> https://lvsl.fr/internet-annee-zero-ou-leclairant-recit-de-jonathan-bourguignon-sur-la-naissance-des-monstres-numeriques/>

 

迎接IPv6新时代 [Welcome to a new era of IPv6]

... 想了解IPv6首先要知道IP。IP是互联网协议（Internet Protocol）的简称，根据IP协议规则产生了IP地址，IP地址是手机、电脑等终端在互联网上的地址，是网络空间终端的唯一身份标识。IPv6则是互联网协议第6版的缩写，是全球公认的下一代互联网商业应用解决方案，是国际标准化组织IETF为解决IPv4地址枯竭而制定的下一代互联网协议版本，能够提供海量的网络地址资源和广阔的创新空间。

< <https://www.sohu.com/a/479886841_121106884> https://www.sohu.com/a/479886841_121106884>

 

**********************

SECURITY & PRIVACY

**********************

Fixing the Internet by Keith Kirkpatrick

Few people pay much attention to how the electrical grid works until there is an outage. The same is often true for the Internet. Yet unlike the electrical grid, where direct attacks are infrequent, vulnerabilities and security issues with the Internet's routing protocol have led to numerous, frequent malicious attacks that have resulted in widespread service outages, intercepted and stolen personal data, and the use of seemingly legitimate Web sites to launch massive spam campaigns.

< <https://cacm.acm.org/magazines/2021/8/254299-fixing-the-internet/fulltext> https://cacm.acm.org/magazines/2021/8/254299-fixing-the-internet/fulltext>

 

Better Security Through Obfuscation by Chris Edwards

Last year, three mathematicians published a viable method for hiding the inner workings of software. The paper was a culmination of close to two decades of work by multiple teams around the world to show that concept could work. The quest now is to find a way to make indistinguishability obfuscation (iO) efficient enough to become a practical reality.

< <https://cacm.acm.org/magazines/2021/8/254302-better-security-through-obfuscation/fulltext> https://cacm.acm.org/magazines/2021/8/254302-better-security-through-obfuscation/fulltext>

 

New MANRS Routing Security Primers for Decision-makers

As a policymaker or executive, do you worry about your data getting stolen or intercepted? Or your website suffering an attack? Or your services being shut down? Today on the MANRS blog, we’re introducing new primers that explain why you should care about routing security and simple steps you can take to decrease routing security incidents.

< <https://www.internetsociety.org/blog/2021/07/new-manrs-routing-security-primers-for-decision-makers/> https://www.internetsociety.org/blog/2021/07/new-manrs-routing-security-primers-for-decision-makers/>

 

101: Why BGP Hijacking Just Won't Die

When the Internet goes down, rendering everything inaccessible from mission-critical business services to mental stability-critical meme generators, is it because of an accident or malicious hackers? In the case of Border Gateway Protocol (BGP) hijacking, it could be either — and sometimes both.

< <https://www.darkreading.com/edge-articles/101-why-bgp-hijacking-just-won-t-die> https://www.darkreading.com/edge-articles/101-why-bgp-hijacking-just-won-t-die>

 

us: Fixing the Fractured Federal Approach to Cybersecurity

Everyone knows the U.S. has a cybersecurity problem and the Biden administration’s emergency request for $10 billion starts out by acknowledging we are in crisis. The question is what to do about it.

< <https://www.nextgov.com/ideas/2021/07/fixing-fractured-federal-approach-cybersecurity/184083/> https://www.nextgov.com/ideas/2021/07/fixing-fractured-federal-approach-cybersecurity/184083/>

 

us: Army chooses 14 for $2.4B cyber range support contract

The Army has picked the winners of a $2.4 billion contract to support the National Cyber Range Complex with testing, planning and events. In essence, the complex is a model of the internet that is used to test cyber tools and simulate attacks and responses to attacks.

< <https://washingtontechnology.com/blogs/editors-notebook/2021/07/cyber-range-award.aspx> https://washingtontechnology.com/blogs/editors-notebook/2021/07/cyber-range-award.aspx>

 

CISA, FBI Name the Most Exploited Vulnerabilities Over the Past Year

List shows many relatively new and perimeter-like devices targeted in 2020 and 2021, according to an analysis by CISA, the FBI, the Australian Cyber Security Centre, and the United Kingdom’s National Cyber Security Centre.

< <https://www.darkreading.com/vulnerabilities-threats/attackers-focusing-on-flaws-in-vpns-remote-work-cloud-technologies-new-fbi-cisa-analysis-shows> https://www.darkreading.com/vulnerabilities-threats/attackers-focusing-on-flaws-in-vpns-remote-work-cloud-technologies-new-fbi-cisa-analysis-shows>

 

U.S., U.K., and Australia Issue Joint Cybersecurity Advisory

The Cybersecurity and Infrastructure Security Agency (CISA), Australian Cyber Security Centre (ACSC), United Kingdom’s National Cyber Security Centre (NCSC) and Federal Bureau of Investigation (FBI) released a joint cybersecurity advisory today, highlighting the top Common Vulnerabilities and Exposures (CVEs) routinely exploited by cyber actors in 2020 and those vulnerabilities being widely exploited thus far in 2021.

< <https://www.fbi.gov/news/pressrel/press-releases/us-uk-and-australia-issue-joint-cybersecurity-advisory> https://www.fbi.gov/news/pressrel/press-releases/us-uk-and-australia-issue-joint-cybersecurity-advisory>

< <https://www.cisa.gov/news/2021/07/28/us-uk-and-australia-issue-joint-cybersecurity-advisory> https://www.cisa.gov/news/2021/07/28/us-uk-and-australia-issue-joint-cybersecurity-advisory>

< <https://www.cyber.gov.au/acsc/view-all-content/media-releases/us-uk-and-australia-issue-joint-cybersecurity-advisory> https://www.cyber.gov.au/acsc/view-all-content/media-releases/us-uk-and-australia-issue-joint-cybersecurity-advisory>

 

UK and allies publish advice to fix global cyber vulnerabilities

Advice on countering the most publicly known—and often dated—software vulnerabilities has been published for private and public sector organisations worldwide.

< <https://www.ncsc.gov.uk/news/global-cyber-vulnerabilities-advice> https://www.ncsc.gov.uk/news/global-cyber-vulnerabilities-advice>

 

au/uk/us: Joint advisory on top cyber vulnerabilities

The top 30 cyber security vulnerabilities exploited by malicious cyber actors since 2020 have been detailed in a joint advisory issued by the Australian Cyber Security Centre (ACSC) and counterpart cyber security agencies from the United States and the United Kingdom.

< <https://www.cyber.gov.au/acsc/view-all-content/news/joint-advisory-top-cyber-vulnerabilities> https://www.cyber.gov.au/acsc/view-all-content/news/joint-advisory-top-cyber-vulnerabilities>

 

Top Routinely Exploited Vulnerabilities

This Joint Cybersecurity Advisory was coauthored by the U.S. Cybersecurity and Infrastructure Security Agency (CISA), the Australian Cyber Security Centre (ACSC), the United Kingdom’s National Cyber Security Centre (NCSC), and the U.S. Federal Bureau of Investigation (FBI).

< <https://us-cert.cisa.gov/ncas/alerts/aa21-209a> https://us-cert.cisa.gov/ncas/alerts/aa21-209a>

 

DDoS attack trends for 2021 Q2

Recent weeks have witnessed massive ransomware and ransom DDoS attack campaigns that interrupted aspects of critical infrastructure around the world, including one of the largest petroleum pipeline system operators, and one of the world’s biggest meat processing companies. Earlier this quarter, more than 200 organizations across Belgium, including the government and parliament websites and other services, were also DDoS’d.

< <https://blog.cloudflare.com/ddos-attack-trends-for-2021-q2/> https://blog.cloudflare.com/ddos-attack-trends-for-2021-q2/>

 

How can organizations support cybersecurity in the Pacific?

A little more than two months ago I heard the good news that the Samoa National Computer Emergency Response Team (SamCERT) had been established. Congratulations to the team at the Ministry of Communications and Information Technology (MCIT) and the security community in Samoa!

< <https://blog.apnic.net/2021/07/29/how-can-organizations-support-cybersecurity-in-the-pacific/> https://blog.apnic.net/2021/07/29/how-can-organizations-support-cybersecurity-in-the-pacific/>

 

Report of the Commission on the Geopolitical Impacts of New Technologies and Data

An in depth report produced by the Commission on the Geopolitical Impacts of New Technologies, making recommendations to maintain economic and national security and new approaches to develop and deploy critical technologies.

< <https://www.atlanticcouncil.org/content-series/geotech-commission/exec-summary/> https://www.atlanticcouncil.org/content-series/geotech-commission/exec-summary/>

 

**********************

INTERNET OF THINGS

**********************

Seoul to implement city-wide public IoT network by 2023

Seoul’s public Internet of Things (IoT) network will be “in every corner of the city” by 2023, according to the Seoul Metropolitan Government.

< <https://www.itu.int/en/myitu/News/2021/07/26/10/50/Seoul-public-IoT-network-Cities-Today> https://www.itu.int/en/myitu/News/2021/07/26/10/50/Seoul-public-IoT-network-Cities-Today>

 

China hatches a plan to lead in the adoption of new internet protocol as Beijing eyes internet of things

China wants to achieve global leadership in the next-generation IPv6 internet protocol by 2025 as Beijing prepares itself for the internet of things (IoT) era, when a washing machine or a microwave oven may have its own IP address.

< <https://www.scmp.com/tech/policy/article/3143180/china-hatches-plan-lead-adoption-new-internet-protocol-beijing-eyes> https://www.scmp.com/tech/policy/article/3143180/china-hatches-plan-lead-adoption-new-internet-protocol-beijing-eyes>

 

za: Internet of things: The ‘things’ are getting smarter

Greatly increased computing power, cloud technology, machine learning and autonomous decision-making are revolutionising the role devices play in our lives.

< <https://www.itweb.co.za/content/kYbe97XDnjx7AWpG> https://www.itweb.co.za/content/kYbe97XDnjx7AWpG>

 

au: Grant backs farmer connections to Internet of Things

Queensland’s peak farming body will fast-track a project to connect more farmers via Internet of Things technologies thanks to a Digital Transformation Grant as part of Queensland’s COVID-19 Economic Recovery Plan.

< <https://statements.qld.gov.au/statements/92778> https://statements.qld.gov.au/statements/92778>

 

**********************

NEW TRANSPORT PROTOCOLS

**********************

Chrome Flags Is Google's Best Open Secret: How to Activate, 10 Best Tools to Use

... 8. Experimental QUIC Protocol: QUIC is Google's own protocol that is designed to make the web faster. The catch is it only works with websites that have been optimized for it, Android Authority said. It is still worth trying out.

< <https://www.itechpost.com/articles/106481/20210726/chrome-flags-googles-best-open-secret-activate-10-tools-use.htm> https://www.itechpost.com/articles/106481/20210726/chrome-flags-googles-best-open-secret-activate-10-tools-use.htm>

 

Google vuole rendere Internet più veloce con Quic [Google wants to make the internet faster with Quic]

Internet cresce di dimensioni e di complessità anno dopo anno, ma poggia ancora su una base tecnica ormai molto vecchia: il protocollo di comunicazione TCP, che risale al 1974. ... Il nuovo protocollo di trasmissione per l'Internet del futuro è stato sviluppato e affinato da Google nel corso degli anni e recentemente, a maggio 2021, è stato standardizzato dalla IETF (Internet Engineering Task Force, organismo indipendente internazionale che sviluppa e promuove gli standard per Internet) con il nome di RFC 9000.

< <https://www.fastweb.it/internet/internet-veloce-google-quic/> https://www.fastweb.it/internet/internet-veloce-google-quic/>

 

**********************

OTHERWISE NOTEWORTHY

**********************

Outage Reporting by Geoff Huston

Much has been said about the criticality of the small coterie of large-scale content distribution platforms and their critical role in today's Internet. These days when one of the small set of core content platforms experiences a service outage then it’s mainstream news, as we saw in June of this year with outages reported in both Fastly and Akamai. In the case of Akamai, the June outage impacted three of Australia’s largest banks, their national postal service, the country’s reserve bank, and one airline operator.

< <https://www.potaroo.net/ispcol/2021-07/outage.html> https://www.potaroo.net/ispcol/2021-07/outage.html>

 

CDNs and Centrality by Geoff Huston

On the afternoon June 17 of this year there was a widespread outage of online services. In Australia it impacted three of the country’s largest banks, the national postal service, the country’s reserve bank, and one airline operator. Further afield from Australia the outage impacted the Hong Kong Stock Exchange, and some US airlines. The roll call of impacted services appeared to reach some 500 services.

< <https://www.potaroo.net/ispcol/2021-07/cdn.html> https://www.potaroo.net/ispcol/2021-07/cdn.html>

 

Norman Abramson, pioneer behind wireless networks, dies at age 88

Norman Abramson, the leader of a group of scientists and engineers who pioneered the development of wireless computer networks, died at his home in San Francisco on December 1. He was 88 years old.

< <https://illinoisnewstoday.com/norman-abramson-pioneer-behind-wireless-networks-dies-at-age-88/320000/> https://illinoisnewstoday.com/norman-abramson-pioneer-behind-wireless-networks-dies-at-age-88/320000/>

 

The dawn of mobile and e-mail: Telecom in the 1980s

After the introduction of computer-led network operation in the late 1970s, the telecommunications industry was in for even bigger changes in the 1980s. The new decade would usher in enormous changes in technology, industry structure, policy and regulation. The innovative eighties heralded mobile telephony, the first standards for e-mail, and an accelerating convergence between computing and communication technologies.

< <https://www.itu.int/en/myitu/News/2021/07/29/10/35/Mobile-e-mail-Telecom-1980s> https://www.itu.int/en/myitu/News/2021/07/29/10/35/Mobile-e-mail-Telecom-1980s>

 

Mastery of technology is central to the ‘new geopolitical order’, Breton says

The COVID-19 crisis has exposed Europe’s strategic vulnerabilities and underscored the need for the European Union to foster its own industrial policy and aim for technological sovereignty in “the new geopolitical order”, the EU’s Commissioner for the internal market, Thierry Breton, has stressed.

< <https://www.euractiv.com/section/digital/news/mastery-of-technology-is-central-to-the-new-geopolitical-order-breton-says/> https://www.euractiv.com/section/digital/news/mastery-of-technology-is-central-to-the-new-geopolitical-order-breton-says/>

------

David Goldstein

email:  <mailto:[e-mail]> [e-mail]

web:  <http://goldsteinreport.com/> http://goldsteinreport.com/

Twitter:  <https://twitter.com/goldsteinreport> https://twitter.com/goldsteinreport

phone: [phone] - mobile; [phone] - office/home