If the "Jigar Kumar" kind ends up in a CIA black site mailing lists will be a lot more enjoyable.
Social engineering takeovers of open source projects
171–180 of 379 posts
Re: Social engineering takeovers of open source projects
#172I'm a maintainer (one of many) of an open source project, and this topic has been on my mind a lot lately as I review PRs. I am more suspicious of PRs from new contributors by default now. Of course I keep these suspicions to myself, but besides simply reviewing code for all the regular things, I now ask myself "what sort of sneaky thing could they be doing that appears benign on the surface?"
Wasn't a key thing of the xz attack vector that people where encouraged to download the custom source release instead of the autogenerated Github one? I don't know if that is a pattern but it seems like best practices in the (source) supply-chain could prevent a large class of these attacks.
That is unfortunately how `the `autotools` ecosystem works; although I guess projects could guide their users to run `autoreconf -i` if working with the source code instead of the release tarballs before doing the usual `./configure && make && make install` step.
Re: Social engineering takeovers of open source projects
#173Anyone who has played Eve Online is familiar with this process. Gain membership, become a valued contributor to the corp, then betray it for profit.
And one difficulty here I believe is that those intent on social engineering think about it in more sophisticated terms than their targets, which perhaps is obvious. And part of the process can be a kind of performative incredulity at the very suggestion that they are part of a campaign of hostile takeover, even if it's exactly accurate. I suppose you could even have unfortunate circumstances where parts of an open s…
> transmission of misinformation is inherently easier
This may already be the case, according to "Study: On Twitter, false news travels faster than true stories" (2018):
https://mitsloan.mit.edu/ideas-made-to-matter/study-false-ne...
Re: Social engineering takeovers of open source projects
#174So next the attackers playing the long game will just set out to develop the next great everybody-uses-it open-source library, so they control it from inception? Great that we'll finally get state-sponsored open-source development :D
US gov has encouraged finance/tech industry to invest in the security of OSS supply chains.
OpenSSF members: https://openssf.org/about/members
2021, $10MM, https://openssf.org/press-release/2021/10/13/open-source-sec...
> Financial commitments from Premier members include Amazon, Cisco, Dell Technologies, Ericsson, Facebook, Fidelity, GitHub, Google, IBM, Intel, JPMorgan Chase, Microsoft, Morgan Stanley, Oracle, Red Hat, Snyk, and VMware. Additional commitments come from General members Aiven, Anchore, Apiiro, AuriStor, Codethink, Cybertrust Japan, Deepfence, Devgistics, DTCC, GitLab, Goldman Sachs, JFrog, Nutanix, StackHawk, Tencent, TideLift, and Wind River.
2022, $5MM for 10,000 OSS projects, https://openssf.org/press-release/2022/02/01/openssf-announc...
> Following a meeting with government and industry leaders at the White House, OpenSSF is excited to announce the Alpha-Omega Project to improve the security posture of open source software (OSS) through direct engagement of software security experts and automated security testing. Microsoft and Google are supporting the Alpha-Omega Project with an initial investment of $5 million.. “Omega” will identify at least 10,000 widely deployed OSS projects where it can apply automated security analysis, scoring, and remediation guidance to their open source maintainer communities.
2022+2023, $4.8MM disbursed to ten (not 10K?) OSS projects, https://openssf.org/blog/2024/02/16/alpha-omega-2023-annual-... & https://openssf.org/blog/2022/12/14/alpha-omega-project-firs...
Eclipse $1,150,000
NodeJS $579,000
Rust $920,000
Homebrew $175,000
jQuery $350,000
OpenSSL $127,968
OpenRefactory $50,000
Prossimo (ISRG) $530,000
Python $400,000
Linux Kernel $620,000Re: Social engineering takeovers of open source projects
#175So next the attackers playing the long game will just set out to develop the next great everybody-uses-it open-source library, so they control it from inception? Great that we'll finally get state-sponsored open-source development :D
The ideal state is having the world's superpowers all devoting effort to improving open source libraries, but all catching each others' backdoors and at the end of the day improving security for everyone.
Re: Social engineering takeovers of open source projects
#176Earlier quoted context omitted.
We know about the failed attempts, we have no idea about the successful ones, and the ones that are going to be successful in the future.
You can always use this line because you can never prove something doesn't exist. Go find evidence. It's been over a month.
You have evidence of a state-sponsored attack which was only discovered because we got extremely lucky, and you’re not worried?
The attack itself is the frankly evidence. It’s sort of like how we expect there to be life on other planets because there is life on earth.
Re: Social engineering takeovers of open source projects
#177So next the attackers playing the long game will just set out to develop the next great everybody-uses-it open-source library, so they control it from inception? Great that we'll finally get state-sponsored open-source development :D
The ideal state is having the world's superpowers all devoting effort to improving open source libraries, but all catching each others' backdoors and at the end of the day improving security for everyone.
Web of trust, but all commits must be signed by at least 3 intelligence agencies from rival countries.
Re: Social engineering takeovers of open source projects
#178The problem with open source is that it's free software, so no one wants to pay for it. Therefore the developers don't spend enough time maintaining and securing it, and not enough time preventing social engineering takeovers.
Re: Social engineering takeovers of open source projects
#179Re: Social engineering takeovers of open source projects
#180I'm a maintainer (one of many) of an open source project, and this topic has been on my mind a lot lately as I review PRs. I am more suspicious of PRs from new contributors by default now. Of course I keep these suspicions to myself, but besides simply reviewing code for all the regular things, I now ask myself "what sort of sneaky thing could they be doing that appears benign on the surface?"
Why is there not a policy that any PR can be rewritten by a maintainer ? Wherever the PR looks a bit odd, rewrite it so do the same thing a different way. Enough unpredictable change to disrupt finely-tuned subterfuge.