<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body dir="auto">
Any security “authority” that sends a warning email that requires opening _any_ attachment doesn’t deserve to be taken seriously. This include the MPAA et al. Also, if they don’t send it to your registered abuse email, into the trash it should go without a
glance.<br>
<br>
<div dir="ltr"> -mel beckman</div>
<div dir="ltr"><br>
<blockquote type="cite">On Apr 3, 2023, at 4:37 AM, Suresh Ramasubramanian <ops.lists@gmail.com> wrote:<br>
<br>
</blockquote>
</div>
<blockquote type="cite">
<div dir="ltr">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style>@font-face { font-family: "Cambria Math"; }
@font-face { font-family: Calibri; }
p.MsoNormal, li.MsoNormal, div.MsoNormal { margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif; }
a:link, span.MsoHyperlink { color: blue; text-decoration: underline; }
span.EmailStyle19 { font-family: Calibri, sans-serif; color: windowtext; }
.MsoChpDefault { font-size: 10pt; }
@page WordSection1 { size: 612pt 792pt; margin: 72pt; }
div.WordSection1 { page: WordSection1; }</style>
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;mso-fareast-language:EN-US">It appears legit.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;mso-fareast-language:EN-US">BKA.DE is the German Bundeskriminalamt (Federal Police)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;mso-fareast-language:EN-US">And the PTR records, SPF etc check out for the domain.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;mso-fareast-language:EN-US">Might as well check the IP in question for malware if they’ve provided date / timestamps and such<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;mso-fareast-language:EN-US">--srs<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal" style="margin-bottom:12.0pt"><b><span style="font-size:12.0pt;color:black">From:
</span></b><span style="font-size:12.0pt;color:black">NANOG <nanog-bounces+ops.lists=gmail.com@nanog.org> on behalf of Glen A. Pearce <nanog@ve4.ca><br>
<b>Date: </b>Monday, 3 April 2023 at 12:29 PM<br>
<b>To: </b>nanog@nanog.org <nanog@nanog.org><br>
<b>Subject: </b>BKA Wiesbaden - Abteilung Cybercrime (Not sure if this is a phishing E-mail or real...)<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span style="font-size:11.0pt">Hi All:<br>
<br>
I received an E-mail with an attachment claiming something<br>
on my network is infected and that I should look at the<br>
attachment to find out what.<br>
<br>
Normally I think everything with an attachment is phishing<br>
to get me to run malware but:<br>
<br>
#1: The sites linked to in it seem to be legit German<br>
government websites based on Wikipedia entries that<br>
haven't changed in several years.<br>
(Looked at archive.org)<br>
#2: The attachment is a .txt file which I've normally<br>
assumed to be safe.<br>
#3: None of the usual dead giveaways that most phishing<br>
E-mails have.<br>
<br>
If it is a phishing E-mail it has got to be the cleverest<br>
one I've ever seen, though someone would try to be cleaver<br>
considering the target would be holders of IP blocks.<br>
<br>
I right clicked and checked properties to make sure the<br>
attached ip_addresses.txt file really is a text file and<br>
not some fancy trickery with reverse direction characters<br>
( As seen on <a href="https://www.youtube.com/watch?v=ieQUy8YTbFU">https://www.youtube.com/watch?v=ieQUy8YTbFU</a> )<br>
<br>
I tried poking around to see if there was some vulnerability<br>
in notepad (or some versions of it) that I didn't know about<br>
and only found a vulnerability in the text editor on Macs<br>
but nothing with Windows Notepad.<br>
<br>
The other thing I felt was a bit off is that the originating<br>
mail server is in Deutsche Telekom AG space and not IP Space<br>
registered to the German government. I'm thinking someone<br>
could rent some IP space from Deutsche Telekom AG with a<br>
connection to them in a data center and get the DNS delegated<br>
to them so they could set the reverse DNS to whatever they want.<br>
A lot of effort to try to look legit by coming out of Germany<br>
and having a government domain in the reverse DNS to look like<br>
a plausible legit outsourcing but again Network operators are<br>
the target audience so the normal tricks that work on the<br>
general public won't work with this group so I can see someone<br>
going that far.<br>
<br>
I'll attach the E-mail below with all headers. Has anyone<br>
else gotten these? Is there some security risk opening it<br>
in Windows Notepad that I don't know about or is it actually<br>
safe to open this?<br>
<br>
<br>
Return-Path: <abuse@cyber.bka.de><br>
Delivered-To: [REDACTED]<br>
Received: from ezp08-pco.easydns.vpn ([10.5.10.148])<br>
by ezb03-pco.easydns.vpn with LMTP<br>
id oCfeBO/yEmTokhgAzaFxkQ<br>
(envelope-from <abuse@cyber.bka.de>)<br>
for <[REDACTED]>; Thu, 16 Mar 2023 10:43:59 +0000<br>
Received: from smtp.easymail.ca ([127.0.0.1])<br>
by ezp08-pco.easydns.vpn with LMTP<br>
id WCB5BO/yEmSHdgEABcrfzg<br>
(envelope-from <abuse@cyber.bka.de>); Thu, 16 Mar 2023 10:43:59 +0000<br>
Received: from localhost (localhost [127.0.0.1])<br>
by smtp.easymail.ca (Postfix) with ESMTP id 0DC85557DF<br>
for <arin@ve4.ca>; Thu, 16 Mar 2023 10:43:59 +0000 (UTC)<br>
X-Virus-Scanned: Debian amavisd-new at ezp08-pco.easydns.vpn<br>
X-Spam-Flag: NO<br>
X-Spam-Score: 0.075<br>
X-Spam-Level:<br>
X-Spam-Status: No, score=0.075 required=4 tests=[BAYES_00=-1.9,<br>
DEAR_SOMETHING=1.973, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001,<br>
SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no<br>
Received: from smtp.easymail.ca ([127.0.0.1])<br>
by localhost (ezp08-pco.easydns.vpn [127.0.0.1]) (amavisd-new, port <br>
10024)<br>
with ESMTP id d0XbPteZN-Io for <arin@ve4.ca>;<br>
Thu, 16 Mar 2023 10:43:55 +0000 (UTC)<br>
Received: from mail.cyber.bka.de (mail.cyber.bka.de [80.146.190.22])<br>
by smtp.easymail.ca (Postfix) with ESMTPS id 0BC0C557DC<br>
for <arin@ve4.ca>; Thu, 16 Mar 2023 10:43:54 +0000 (UTC)<br>
Date: Thu, 16 Mar 2023 10:43:53 +0000<br>
To: arin@ve4.ca<br>
From: BKA Wiesbaden - Abteilung Cybercrime <abuse@cyber.bka.de><br>
Reply-To: BKA Wiesbaden - Abteilung Cybercrime <abuse@cyber.bka.de><br>
Subject: Information regarding possible infection with malware<br>
Message-ID: <br>
<M47LJRZpjy1zymUJDKsNtrYm3RimkafZfZTqeZpauZA@emailapi.apps.cc.bka><br>
MIME-Version: 1.0<br>
Content-Type: multipart/mixed;<br>
boundary="b1_M47LJRZpjy1zymUJDKsNtrYm3RimkafZfZTqeZpauZA"<br>
Content-Transfer-Encoding: 8bit<br>
<br>
Dear Sir or Madam,<br>
<br>
As part of criminal proceedings, the German Federal Criminal Police <br>
Office (Bundeskriminalamt) has been<br>
informed about public IP addresses and timestamps which indicate a <br>
potential infection by the malicious<br>
software "Bumblebee" of one or more systems behind the respective public <br>
IP address.<br>
<br>
Within this letter, the BKA is providing you with the data of the <br>
respective IP addresses which have been<br>
assigned to you as the appropriate provider. You are asked to take <br>
appropriate measures to inform your<br>
customers about the potential infection.<br>
<br>
The following information will be provided:<br>
<br>
1. Public IP address<br>
2. Last known timestamp of contact by the public IP address<br>
3. Possible system name or username on the potentially infected system<br>
<br>
The following information may be sent to your customers in addition to <br>
the message of concern.<br>
<br>
What should you do now?<br>
<br>
1. Don’t panic!<br>
2. Check your systems/networks for possible infections. If other <br>
institutions have already made you aware<br>
of infected systems recently, follow the action guidelines which you may <br>
have received from them.<br>
3. For further information on cleaning up infections, please visit the <br>
English website of the Federal Office<br>
for Information Security (BSI):<br>
<br>
<a href="https://www.bsi.bund.de/EN/Themen/Verbraucherinnen-und-Verbraucher/Informationen-und-Empfehlungen/Cyber-Sicherheitsempfehlungen/Infizierte-Systeme-bereinigen/infizierte-systeme-bereinigen_node.html">https://www.bsi.bund.de/EN/Themen/Verbraucherinnen-und-Verbraucher/Informationen-und-Empfehlungen/Cyber-Sicherheitsempfehlungen/Infizierte-Systeme-bereinigen/infizierte-systeme-bereinigen_node.html</a><br>
<br>
Yours sincerely,<br>
<br>
Bundeskriminalamt Wiesbaden<br>
<br>
-- <br>
Glen A. Pearce<br>
gap@ve4.ca<br>
Network Manager, Webmaster, Bookkeeper, Fashion Model and Shipping Clerk.<br>
Very Eager 4 Tees<br>
<a href="http://www.ve4.ca">http://www.ve4.ca</a><br>
ARIN Handle VET-17<o:p></o:p></span></p>
</div>
</div>
</div>
</blockquote>
</body>
</html>