[saag] RATs report

"Nancy Cam-Winget (ncamwing)" <ncamwing@cisco.com> Tue, 28 July 2020 00:08 UTC

Return-Path: <ncamwing@cisco.com>
X-Original-To: saag@ietfa.amsl.com
Delivered-To: saag@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 799133A097B for <saag@ietfa.amsl.com>; Mon, 27 Jul 2020 17:08:25 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -9.619
X-Spam-Level:
X-Spam-Status: No, score=-9.619 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com header.b=UovtUpzx; dkim=pass (1024-bit key) header.d=cisco.onmicrosoft.com header.b=j4SBsC6I
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IJUUqLxQpMPm for <saag@ietfa.amsl.com>; Mon, 27 Jul 2020 17:08:22 -0700 (PDT)
Received: from rcdn-iport-2.cisco.com (rcdn-iport-2.cisco.com [173.37.86.73]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DE1C33A08E9 for <saag@ietf.org>; Mon, 27 Jul 2020 17:08:21 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=14969; q=dns/txt; s=iport; t=1595894901; x=1597104501; h=from:to:subject:date:message-id:mime-version; bh=3qNkDqEFUyEGZg3mePhxGDscJ0BllobVkBJzizakqco=; b=UovtUpzx6W75PnafpNfgx2ASpVFdXqgUC99F2t3kv4k5B5YFpGWENWm4 w0o6vjych84prO1RbPTs7KjpzIhtLsvpqdo0Utrdmob99mHDHjc4aqbyL YzoacL1gn09NelDzzaQ9kcNNjkwFlykSJAv2DDDKedHq0TwnrzSC8RRcl g=;
IronPort-PHdr: 9a23:RLKYThQ20biqQ7oPxvqN7xKIp9psv++ubAcI9poqja5Pea2//pPkeVbS/uhpkESQBN+J6v9YhazRqa+zEWAD4JPUtncEfdQMUhIekswZkkQmB9LNEkz0KvPmLklYVMRPXVNo5Te3ZE5SHsutZlDOrDu19zFBUhn6PBB+c+LyHIOahs+r1ue0rpvUZQgAhDe0bb5oahusqgCEvcgNiowkIaE0mRY=
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: A0DlCQDtax9f/5ldJa1gg3YvUQdvWC8sCoQqg0YDoUuEbIJTA1ULAQEBDAEBGAEMCAIEAQGETBmCEAIkOBMCAwEBCwEBBQEBAQIBBgRthVwBC4YKER0BATgRARoTHQIEMA8IEAQPJoMEAYF+TQMuAQ6kUgKBOYhhdoEygwEBAQWBR0FCglgYgg4DBoE4gm2DWYY3GoIAgREnHIN0gXMCAwGCCIJpM4ItkmCGWZw1CoJeiFaRGAMen2SIJ4lvii6UbAIEAgQFAg4BAQWBaiOBV3AVZQGCPlAXAg2SD4UUhUJ0ECcCBggBAQMJfI4CAYEQAQE
X-IronPort-AV: E=Sophos;i="5.75,404,1589241600"; d="scan'208,217";a="807145815"
Received: from rcdn-core-2.cisco.com ([173.37.93.153]) by rcdn-iport-2.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 28 Jul 2020 00:08:20 +0000
Received: from XCH-ALN-005.cisco.com (xch-aln-005.cisco.com [173.36.7.15]) by rcdn-core-2.cisco.com (8.15.2/8.15.2) with ESMTPS id 06S08Kjl006765 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL) for <saag@ietf.org>; Tue, 28 Jul 2020 00:08:20 GMT
Received: from xhs-aln-002.cisco.com (173.37.135.119) by XCH-ALN-005.cisco.com (173.36.7.15) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Mon, 27 Jul 2020 19:08:19 -0500
Received: from xhs-rtp-003.cisco.com (64.101.210.230) by xhs-aln-002.cisco.com (173.37.135.119) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Mon, 27 Jul 2020 19:08:19 -0500
Received: from NAM12-DM6-obe.outbound.protection.outlook.com (64.101.32.56) by xhs-rtp-003.cisco.com (64.101.210.230) with Microsoft SMTP Server (TLS) id 15.0.1497.2 via Frontend Transport; Mon, 27 Jul 2020 20:08:18 -0400
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=FuCWM2BtnQfs3RVRpVayOdCI8PTiDjY39B7PDpSkPQ4A/Yt4dlnqZ2oIEHVETfHhUtBFKEIJWzod8cNvXvgIxz9Ul9PiQLz9H5nUXE/zTW6drYOYzkcEg/9L8DlfspMQ900sLwg4oc9678VCnsQMzctVqmpXCmXv5OXYeiwLPQPEbUbL73JgnnssZMCczmTTHqrKC4H7mJPVzicp+LOHbvv/oDo58iTtYtyzDfIff1RtM+nojjRy/fdlCcVd7SYkvbnCsLLcg9tJCvKtwbTwZhBM2NOUKnvVGdwHXLkOchFCfPQNvBOcE7t4NOoHuQ09DnZ8cvM8v9IQculKEF3xKA==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=3qNkDqEFUyEGZg3mePhxGDscJ0BllobVkBJzizakqco=; b=a82SraqxTh8t9QsmKe/16oPx42r1N7qQfQX4BVarTg7qZDGglXWfOPuxrHOAUDNUl5lGdyuFGJxqqLaB4lP9ujBkQgvUCWHuV2cexlP+K2sf6DWHVzL/ebDWfvcYwFV8wSLWpdjlfErpJVjWcGfi18GWgVbEoaePp+pBo39w7i16h6sdTvVTT57KMFSxz1g2a6Y7vH51iDtErsGUnHVcFiBcwePjF0aHnJXgblkO+kfUHxRol+YRP8IctIpga3gxSZyiFgtpvbWcyis98hPICo4e8RLzHoib9bR8fS0FlSl+FD5POzZYGk7fGofpl06xZ81/4MEjTpOLq0mr8nnRoQ==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=cisco.com; dmarc=pass action=none header.from=cisco.com; dkim=pass header.d=cisco.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.onmicrosoft.com; s=selector2-cisco-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=3qNkDqEFUyEGZg3mePhxGDscJ0BllobVkBJzizakqco=; b=j4SBsC6IK2Y6C6UcW3wn3BSBeFpjRzxZcEpA3wBX1uHWEJ0ShrgRahIFV6noYxxVYp4u4BIAmk9UtEadmYedKCZGN6r64QIBXUddGd1ysIeYwy9f0atL/roxCjm8tPXlngkKTjdNwzoXW+Ed47rR4bH615Eyy8U42P/KGgmyRKo=
Received: from BY5PR11MB4070.namprd11.prod.outlook.com (2603:10b6:a03:181::16) by BY5PR11MB4450.namprd11.prod.outlook.com (2603:10b6:a03:1be::20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3216.21; Tue, 28 Jul 2020 00:08:18 +0000
Received: from BY5PR11MB4070.namprd11.prod.outlook.com ([fe80::e42f:216e:af3e:8ce5]) by BY5PR11MB4070.namprd11.prod.outlook.com ([fe80::e42f:216e:af3e:8ce5%7]) with mapi id 15.20.3216.033; Tue, 28 Jul 2020 00:08:18 +0000
From: "Nancy Cam-Winget (ncamwing)" <ncamwing@cisco.com>
To: "saag@ietf.org" <saag@ietf.org>
Thread-Topic: RATs report
Thread-Index: AQHWZHMyIGz+Pe+tdU65AkmR2f4bnQ==
Date: Tue, 28 Jul 2020 00:08:17 +0000
Message-ID: <0343E3DE-EF00-494C-862D-7C0841284F42@cisco.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
user-agent: Microsoft-MacOutlook/10.10.18.200713
authentication-results: ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=none action=none header.from=cisco.com;
x-originating-ip: [73.162.233.180]
x-ms-publictraffictype: Email
x-ms-office365-filtering-correlation-id: 44b52458-b23f-4c0f-5766-08d8328a54b1
x-ms-traffictypediagnostic: BY5PR11MB4450:
x-microsoft-antispam-prvs: <BY5PR11MB4450A172818E521647CC13F3D6730@BY5PR11MB4450.namprd11.prod.outlook.com>
x-ms-oob-tlc-oobclassifiers: OLM:2512;
x-ms-exchange-senderadcheck: 1
x-microsoft-antispam: BCL:0;
x-microsoft-antispam-message-info: gQEPx4hEOZ2UTnmEbdEJTxP7BIkDCDlSbPAB6ruOh/iXGTxHKon6OHVsP1SszgttMLdfzyRRP60OTAqAYQ91L6d1TRyZO/TRctR+jN5XKAKY3E1+vFGrjRPMGQ2vxFQbt8RRTTifLxnLRGokeW2CmGoTl7kODB3pCI+yC0ME+Dk04BTS1/FgrFB2jTY1Bk8MRuKYjRkhX/Q61Tq58OK9zooOr8ZU1vC0PiNu488CnyjTy+cDA2gIdFK/+LgJB9wdCA4a8cQqrYU+TAXuqRIxoZ39nKkFJvSWcKraH3alWAcCGJW8cVB+OP1tgL/38C9TjW9dVkaA7ithkJIeuD/j6JGHDR0LPNUze9zDezjotEUEexOE6jGhX2cfkvTzLsHfbjT6Ze9Zh7BwDaaDYBmfJA==
x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:BY5PR11MB4070.namprd11.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(4636009)(376002)(366004)(346002)(396003)(136003)(39860400002)(26005)(6486002)(966005)(2616005)(186003)(166002)(2906002)(6506007)(316002)(6512007)(66946007)(3480700007)(76116006)(478600001)(66476007)(66556008)(64756008)(66446008)(8936002)(5660300002)(33656002)(8676002)(4744005)(6916009)(86362001)(7116003)(36756003)(71200400001); DIR:OUT; SFP:1101;
x-ms-exchange-antispam-messagedata: FnM5j36HXvJxsQTE0EqE6RuH9dMZ0v9NMe8J65olRpeaFYCBpgPbkXJR4Dnz9bhicbP90fJZI2VCb9fT42rbFytf0YY0KpmGrTqjmZ0LfowcmTL6A5vDSQcZlqgsORRnCUgE+oB2g4Xk2uKrKL54ypnAZZhq9oU+1eUq9FoISrPcJzr4B2ZDJpkeneB/1v/jrFyddvYPx8yDsPdgb22/HYNH1X+Jszw83tEZ9RwV+5FWM/3q/9kavXwcpsTqL7Fdjr4VF8uuZYppEr21WJhY+/LVpUTsOykRdz9ujgmUyJX+hHNpjkKozoEMClX3HQAnOF8u0lJq+dNfOPkaqKFrPfzOUkopEsZPrdjl3aUZD6vaH3+8E0TEdTQ72Bms2I5S3E70xtJSPYIFr+TxD/pOYVjKumaQdsySfenrTiPaUGJi9rRpZHz5lPPsNyz7yOo1/cJD7M4uD7H27lS59mT/i6xOamx5vCvr4YG9iHqbd8RC6X4kFNXDhsoLm0nDL64G
x-ms-exchange-transport-forked: True
Content-Type: multipart/alternative; boundary="_000_0343E3DEEF00494C862D7C0841284F42ciscocom_"
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: BY5PR11MB4070.namprd11.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 44b52458-b23f-4c0f-5766-08d8328a54b1
X-MS-Exchange-CrossTenant-originalarrivaltime: 28 Jul 2020 00:08:17.8690 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 5ae1af62-9505-4097-a69a-c1553ef7840e
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: adKshs4zN/OKPRGK3TFG0sgwmgYESc1Um5m04npUp5U35CXkbb0uOM4oYE67JAMIjmFUTpmty8whb+XsJFmi9g==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BY5PR11MB4450
X-OriginatorOrg: cisco.com
X-Outbound-SMTP-Client: 173.36.7.15, xch-aln-005.cisco.com
X-Outbound-Node: rcdn-core-2.cisco.com
Archived-At: <https://mailarchive.ietf.org/arch/msg/saag/ib9dfxWZlMIkoNDzkd-gs8Ck4_8>
Subject: [saag] RATs report
X-BeenThere: saag@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Security Area Advisory Group <saag.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/saag>, <mailto:saag-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/saag/>
List-Post: <mailto:saag@ietf.org>
List-Help: <mailto:saag-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/saag>, <mailto:saag-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 28 Jul 2020 00:08:27 -0000