<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:10.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-IN" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;mso-fareast-language:EN-US">It appears legit.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;mso-fareast-language:EN-US">BKA.DE is the German Bundeskriminalamt (Federal Police)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;mso-fareast-language:EN-US">And the PTR records, SPF etc check out for the domain.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;mso-fareast-language:EN-US">Might as well check the IP in question for malware if they�ve provided date / timestamps and such<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;mso-fareast-language:EN-US">--srs<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal" style="margin-bottom:12.0pt"><b><span style="font-size:12.0pt;color:black">From:
</span></b><span style="font-size:12.0pt;color:black">NANOG <nanog-bounces+ops.lists=gmail.com@nanog.org> on behalf of Glen A. Pearce <nanog@ve4.ca><br>
<b>Date: </b>Monday, 3 April 2023 at 12:29 PM<br>
<b>To: </b>nanog@nanog.org <nanog@nanog.org><br>
<b>Subject: </b>BKA Wiesbaden - Abteilung Cybercrime (Not sure if this is a phishing E-mail or real...)<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span style="font-size:11.0pt">Hi All:<br>
<br>
I received an E-mail with an attachment claiming something<br>
on my network is infected and that I should look at the<br>
attachment to find out what.<br>
<br>
Normally I think everything with an attachment is phishing<br>
to get me to run malware but:<br>
<br>
#1: The sites linked to in it seem to be legit German<br>
government websites based on Wikipedia entries that<br>
haven't changed in several years.<br>
(Looked at archive.org)<br>
#2: The attachment is a .txt file which I've normally<br>
assumed to be safe.<br>
#3: None of the usual dead giveaways that most phishing<br>
E-mails have.<br>
<br>
If it is a phishing E-mail it has got to be the cleverest<br>
one I've ever seen, though someone would try to be cleaver<br>
considering the target would be holders of IP blocks.<br>
<br>
I right clicked and checked properties to make sure the<br>
attached ip_addresses.txt file really is a text file and<br>
not some fancy trickery with reverse direction characters<br>
( As seen on <a href="https://www.youtube.com/watch?v=ieQUy8YTbFU">https://www.youtube.com/watch?v=ieQUy8YTbFU</a> )<br>
<br>
I tried poking around to see if there was some vulnerability<br>
in notepad (or some versions of it) that I didn't know about<br>
and only found a vulnerability in the text editor on Macs<br>
but nothing with Windows Notepad.<br>
<br>
The other thing I felt was a bit off is that the originating<br>
mail server is in Deutsche Telekom AG space and not IP Space<br>
registered to the German government. I'm thinking someone<br>
could rent some IP space from Deutsche Telekom AG with a<br>
connection to them in a data center and get the DNS delegated<br>
to them so they could set the reverse DNS to whatever they want.<br>
A lot of effort to try to look legit by coming out of Germany<br>
and having a government domain in the reverse DNS to look like<br>
a plausible legit outsourcing but again Network operators are<br>
the target audience so the normal tricks that work on the<br>
general public won't work with this group so I can see someone<br>
going that far.<br>
<br>
I'll attach the E-mail below with all headers. Has anyone<br>
else gotten these? Is there some security risk opening it<br>
in Windows Notepad that I don't know about or is it actually<br>
safe to open this?<br>
<br>
<br>
Return-Path: <abuse@cyber.bka.de><br>
Delivered-To: [REDACTED]<br>
Received: from ezp08-pco.easydns.vpn ([10.5.10.148])<br>
by ezb03-pco.easydns.vpn with LMTP<br>
id oCfeBO/yEmTokhgAzaFxkQ<br>
(envelope-from <abuse@cyber.bka.de>)<br>
for <[REDACTED]>; Thu, 16 Mar 2023 10:43:59 +0000<br>
Received: from smtp.easymail.ca ([127.0.0.1])<br>
by ezp08-pco.easydns.vpn with LMTP<br>
id WCB5BO/yEmSHdgEABcrfzg<br>
(envelope-from <abuse@cyber.bka.de>); Thu, 16 Mar 2023 10:43:59 +0000<br>
Received: from localhost (localhost [127.0.0.1])<br>
by smtp.easymail.ca (Postfix) with ESMTP id 0DC85557DF<br>
for <arin@ve4.ca>; Thu, 16 Mar 2023 10:43:59 +0000 (UTC)<br>
X-Virus-Scanned: Debian amavisd-new at ezp08-pco.easydns.vpn<br>
X-Spam-Flag: NO<br>
X-Spam-Score: 0.075<br>
X-Spam-Level:<br>
X-Spam-Status: No, score=0.075 required=4 tests=[BAYES_00=-1.9,<br>
DEAR_SOMETHING=1.973, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001,<br>
SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no<br>
Received: from smtp.easymail.ca ([127.0.0.1])<br>
by localhost (ezp08-pco.easydns.vpn [127.0.0.1]) (amavisd-new, port <br>
10024)<br>
with ESMTP id d0XbPteZN-Io for <arin@ve4.ca>;<br>
Thu, 16 Mar 2023 10:43:55 +0000 (UTC)<br>
Received: from mail.cyber.bka.de (mail.cyber.bka.de [80.146.190.22])<br>
by smtp.easymail.ca (Postfix) with ESMTPS id 0BC0C557DC<br>
for <arin@ve4.ca>; Thu, 16 Mar 2023 10:43:54 +0000 (UTC)<br>
Date: Thu, 16 Mar 2023 10:43:53 +0000<br>
To: arin@ve4.ca<br>
From: BKA Wiesbaden - Abteilung Cybercrime <abuse@cyber.bka.de><br>
Reply-To: BKA Wiesbaden - Abteilung Cybercrime <abuse@cyber.bka.de><br>
Subject: Information regarding possible infection with malware<br>
Message-ID: <br>
<M47LJRZpjy1zymUJDKsNtrYm3RimkafZfZTqeZpauZA@emailapi.apps.cc.bka><br>
MIME-Version: 1.0<br>
Content-Type: multipart/mixed;<br>
boundary="b1_M47LJRZpjy1zymUJDKsNtrYm3RimkafZfZTqeZpauZA"<br>
Content-Transfer-Encoding: 8bit<br>
<br>
Dear Sir or Madam,<br>
<br>
As part of criminal proceedings, the German Federal Criminal Police <br>
Office (Bundeskriminalamt) has been<br>
informed about public IP addresses and timestamps which indicate a <br>
potential infection by the malicious<br>
software "Bumblebee" of one or more systems behind the respective public <br>
IP address.<br>
<br>
Within this letter, the BKA is providing you with the data of the <br>
respective IP addresses which have been<br>
assigned to you as the appropriate provider. You are asked to take <br>
appropriate measures to inform your<br>
customers about the potential infection.<br>
<br>
The following information will be provided:<br>
<br>
1. Public IP address<br>
2. Last known timestamp of contact by the public IP address<br>
3. Possible system name or username on the potentially infected system<br>
<br>
The following information may be sent to your customers in addition to <br>
the message of concern.<br>
<br>
What should you do now?<br>
<br>
1. Don’t panic!<br>
2. Check your systems/networks for possible infections. If other <br>
institutions have already made you aware<br>
of infected systems recently, follow the action guidelines which you may <br>
have received from them.<br>
3. For further information on cleaning up infections, please visit the <br>
English website of the Federal Office<br>
for Information Security (BSI):<br>
<br>
<a href="https://www.bsi.bund.de/EN/Themen/Verbraucherinnen-und-Verbraucher/Informationen-und-Empfehlungen/Cyber-Sicherheitsempfehlungen/Infizierte-Systeme-bereinigen/infizierte-systeme-bereinigen_node.html">https://www.bsi.bund.de/EN/Themen/Verbraucherinnen-und-Verbraucher/Informationen-und-Empfehlungen/Cyber-Sicherheitsempfehlungen/Infizierte-Systeme-bereinigen/infizierte-systeme-bereinigen_node.html</a><br>
<br>
Yours sincerely,<br>
<br>
Bundeskriminalamt Wiesbaden<br>
<br>
-- <br>
Glen A. Pearce<br>
gap@ve4.ca<br>
Network Manager, Webmaster, Bookkeeper, Fashion Model and Shipping Clerk.<br>
Very Eager 4 Tees<br>
<a href="http://www.ve4.ca">http://www.ve4.ca</a><br>
ARIN Handle VET-17<o:p></o:p></span></p>
</div>
</div>
</body>
</html>