- Hacker gains access to Orange Espana’s RIPE account, teases about it on X
- Issue is resolved quickly, but questions remain of account security at RIPE
On January 3 a hacker gained access to the RIPE NCC Regional Internet Registry account of telecom giant Orange Espana, and gloated about the attack on X, formerly known as Twitter.
Tagging the official Orange Espana X account, the hacker, who goes by the handle “Snow” on X, and describes themself as “she/her” and “likes cute kitty cats”, teased them about the breach. “Meow meow meow! I have fixed your RIPE admin account security. Message me to get the new credentials :^)”, the hacker wrote.
Orange confirmed that the breach had been resolved and no customer data was compromised. But there were estimates that up to half of the traffic routed through Orange Espana was affected, and unable to access certain websites.
Also read: RIPE internet registry faces losses, needs to increase fees, but how?
The breach raised concerns about the security of accounts at the RIPE regional internet registry (RIR), with community members calling for lessons to be learned. One commentator wrote on Benjojo.co.uk, “The RIPE NCC Access available MFA options and auditability are not really good enough.”
Account security breach at RIPE
RIPE addressed the breach briefly on their blog: “We are currently investigating the compromise of a RIPE NCC Access account, which resulted in some services of the account holder being temporarily impacted.
“We have restored access to the legitimate account holder and are working closely with them to ensure the integrity of the account. Our Information Security team is continuing to investigate whether any other accounts have been affected. Account holders who might be affected will be contacted directly by us.
“We encourage account holders to please update their passwords and enable multi-factor authentication for their accounts. If you suspect that your account might be impacted, please report it to security@ripe.net.”
Hans Petter Holen, the Managing Director and CEO at the RIPE NCC, added: “Indeed there are lessons to be learnt here. We will report back on our findings and areas for improvement as we learn from this incident.”
Also read: ICANN’s Africa DNS report barely mentions the AFRINIC problem
What is a Regional Internet Registry?
A Regional Internet Registry (RIR) is an organization that manages the allocation and registration of Internet number resources within a specific geographic region. Internet number resources include IP addresses and Autonomous System (AS) numbers. The primary purpose of RIRs is to ensure the fair and efficient distribution of these resources, supporting the growth and stability of the Internet.
There are five major RIRs worldwide, and each one serves a specific geographical region:
ARIN (American Registry for Internet Numbers): Serves North America and parts of the Caribbean.
RIPE NCC (Réseaux IP Européens Network Coordination Centre): Serves Europe, the Middle East, and parts of Central Asia.
APNIC (Asia-Pacific Network Information Centre): Serves the Asia-Pacific region.
LACNIC (Latin America and Caribbean Network Information Centre): Serves Latin America and parts of the Caribbean.
AFRINIC (African Network Information Centre): Serves the African region.
These organizations manage the responsible distribution of IP addresses and AS numbers to Internet service providers (ISPs), organizations, and other entities in their respective regions. They also contribute to the development and implementation of policies that govern the use and management of Internet number resources within their regions. Additionally, RIRs collaborate globally to address issues related to the exhaustion of IPv4 addresses, IPv6 adoption, and other matters affecting the global Internet infrastructure.
