Doesn't have to be a takeover. If I'm a state actor I'll maintain a few projects specifically so I can hide backdoors in them. When/if one gets popular and I decide to backdoor them I'll claim it was a social engineering takeover.
Social engineering takeovers of open source projects
31–40 of 379 posts
Re: Social engineering takeovers of open source projects
#32[flagged]
Any good links about fiasco?
Re: Social engineering takeovers of open source projects
#33I'm a maintainer (one of many) of an open source project, and this topic has been on my mind a lot lately as I review PRs. I am more suspicious of PRs from new contributors by default now. Of course I keep these suspicions to myself, but besides simply reviewing code for all the regular things, I now ask myself "what sort of sneaky thing could they be doing that appears benign on the surface?"
That's great that you are considering this more now.
But the xy story taught us, that every contributor is dangerous, the most dangerous ones are probably the most helpful and most skilled contributors. If someone barely get's a PR accepted, they probably lack the skills to add a sophisticated backdoor.
Another thing that was not talked about a lot: There are many ways to compromise existing maintainers. Compromising people is the core competency of intelligence, happens all the time, and most cases probably never come to public knowledge.
Re: Social engineering takeovers of open source projects
#34Good warning for the future... but what about the past? Any thoughts on retroactively looking at behavior for existing OS projects? Seems like an impossible amount of work.
Maybe not so impossible. Start with making a list of projects that are everywhere. Inside every Linux distribution, inside every react/angular/vue/etc project, … Then check which companies support those projects with active development, and calculate a rating. Are the companies located inside democracies or are they mostly from china or Russia? It’s probably not that many packages in the end. A few thousand high impa…
Backdoor attempts won't be that obvious. The xz incident just had a random unaffiliated burner account and nothing of any clear national origin.
Re: Social engineering takeovers of open source projects
#35Earlier quoted context omitted.
And one difficulty here I believe is that those intent on social engineering think about it in more sophisticated terms than their targets, which perhaps is obvious. And part of the process can be a kind of performative incredulity at the very suggestion that they are part of a campaign of hostile takeover, even if it's exactly accurate. I suppose you could even have unfortunate circumstances where parts of an open s…
>> And I think you probably see a parallel in state-based information warfare, where part of the objective isn't just to spread misinformation, but to shift cultural norms so that the transmission of misinformation is inherently easier, which can involve sewing distrust in institutions or expertise, or normalizing a gish gallop argumentative style. TikTok springs to mind when reading this...
Not going to quote the whole thing, but yes hard agree. Contrasting this factual opinion with the opinions in the “sell TikTok” hn threads is quite a delta.
Re: Social engineering takeovers of open source projects
#36Earlier quoted context omitted.
Your average American could quit working for 5 million dollars. They could live comfortably for the rest of their lives off that money, if well invested (read EFT for sp500) 5 million bucks is change for you average government. "Amazon made billions on my project and if I turn a blind eye to this I can retire, fuck them..." Sponsorship, for good or bad makes a lot of decisions simple.
[flagged]
Friend, I read the comment that you’re replying to that if hostile governments wanted to backdoor our software supply-chains, it wouldn’t cost that much to corrupt an open source maintainer.
Whereas, if it was the norm for well used OS projects to be sponsored, it’s far less likely to be tempted by relatively small bribes.
Re: Social engineering takeovers of open source projects
#37[flagged]
Any good links about fiasco?
Re: Social engineering takeovers of open source projects
#38This is only going to get worse with Large Language Models. Let's imagine a somewhat knowledgeable individual, could craft both emails, messages and even commits with a bunch of prompts. Those will relate deeply to the project.
Do you have any evidence or real examples to support that? I hear people say similar things but see nothing to suggest LLMs are a particular threat.
Are you asking for evidence that LLM’s can be used to write emails and chat messages?
Re: Social engineering takeovers of open source projects
#39It doesn't even have to be a server like ssh. It could be a client side project engineered to somehow deliver all your ssh keys or bitcoin wallets. There is no reason backdoors couldn't stealthily phone home from client side applications.
The crazy thing about the xz issue was, that xz is not even a dependency of openssh, but of systemd. And the xz backdoor exploited the systemd integration of openssh. This exploit was invisible to people that tested plain openssh without one of the most common integrations into Linux.
Re: Social engineering takeovers of open source projects
#40Earlier quoted context omitted.
> Maybe we need a reporting system for maintainer changes of bigger projects. Some list where they get published and people can keep an eye on it. The rust project does it. There's a repo with all [active] members and their permissions on github, etc. These get synchronized and updated every time there's a change.
Just for the main project, or for all/most packages on crates.io?
Every repository and team under rust-lang on github.