Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Social engineering takeovers of open source projects

openssf.org

Post reply on HN
Print view View original

241–250 of 379 posts

Re: Social engineering takeovers of open source projects

#241

Post by int_19h »

Thorrez wrote: post #139
Aerroon wrote: post #55

Earlier quoted context omitted.

My thought immediately went to Linus Torvalds. The way he acted was tolerated in the past, but the culture was changed and it was used to force a change onto the project. Same thing with all of those Codes of Conduct that suddenly propped up.

Are you saying codes of conduct make the transmission of misinformation is inherently easier, e.g by sewing distrust in institutions or expertise, or normalizing a gish gallop argumentative style? Are you saying Linus Torvald's behaviour prevented those problems?

It has not occurred to me before, but I don't see why the cancel culture surrounding such matters couldn't be used as an attack vector. Basically, target key maintainers who are vulnerable to this (white, male, history of questionable interactions etc) and push until you force them out one way or another. Then when project gets in trouble because of the lack of qualified manpower, pitch your own agent as replacement. For bonus points, make it someone who hits the right buttons wrt "diversity".

Re: Social engineering takeovers of open source projects

#242

Post by int_19h »

smsm42 wrote: post #24
piecerough wrote: post #16

This is only going to get worse with Large Language Models. Let's imagine a somewhat knowledgeable individual, could craft both emails, messages and even commits with a bunch of prompts. Those will relate deeply to the project.

Maybe one day it will happen, but right now LLM-generated persona would likely set off every alarm bell for a lot of people. LLMs have very recognizable style, and it usually falls right into the uncanny valley.

The "recognizable style" that people usually refer to is the default persona that most are exposed. However, the style can be changed very drastically with some fairly simple prompting.

Re: Social engineering takeovers of open source projects

#243

Post by varispeed »

willvarfar wrote: post #168

So next the attackers playing the long game will just set out to develop the next great everybody-uses-it open-source library, so they control it from inception? Great that we'll finally get state-sponsored open-source development :D

Relevant: https://www.youtube.com/watch?v=jgYYOUC10aM

Re: Social engineering takeovers of open source projects

#244

Post by williamdclt »

greatgib wrote: post #121

First I think that it is wrong to single out this issue on Open Source projects. For example, since the first versions of app stores, when you are an app developer you would receive a lot of messages from random shady dudes ready to buy your application if it had a few users. Also, the xz thing was kind of pretty smart, but it is also a thing in mind of most OSs developers that you can't trust any random contributor…

The scope of impact if a mobile app becomes malicious is _immensely_ smaller than if xz becomes malicious. The latter seems to be national security level

Re: Social engineering takeovers of open source projects

#245

Post by krishadi »

I hope there is a better way to maintain open source projects without being overly cautious and suspicious of every PR someone makes. Maintaining open source projects is hard, and this is going to slow down development on many projects. And, rightly so, it's better to make a good code base, rather than one that is littered with backdoors.

I wonder what could make this situation better for the maintainers of open source projects?

Re: Social engineering takeovers of open source projects

#246

Post by int_19h »

Thorrez wrote: post #145
ClassAndBurn wrote: post #84

There's an awkward reckoning in open source software about inclusivity and protecting the long-term security of projects coming. Authors from several countries were already suspicious, such as Iran. Anyone from Russia and China or unknown places are all potential risks now. Combined with recent inclusive ideologies, it’s gonna cause hard conversations. There will be a furthering in segmenting the Internet. Why fight…

I don't see how blocking contributions from people in Russia etc will help. Malicious actors can simply falsely claim to be American. Is GitHub going to start verifying citizenship? Even if GitHub did that, it likely wouldn't be too hard to fake.

And to be honest, it's not like getting US citizenship for their agent is difficult for a government agency. The same goes for most other countries.

Keep in mind that most places allow you to literally buy citizenship through investment. The amount you need for a country like US is prohibitive for the vast majority, but, again, is not really a problem for another government.

Re: Social engineering takeovers of open source projects

#247

Post by __loam »

krishadi wrote: post #245

I hope there is a better way to maintain open source projects without being overly cautious and suspicious of every PR someone makes. Maintaining open source projects is hard, and this is going to slow down development on many projects. And, rightly so, it's better to make a good code base, rather than one that is littered with backdoors. I wonder what could make this situation better for the maintainers of open sour…

Public funding for security maintenance.

Re: Social engineering takeovers of open source projects

#248

Post by Nition »

willvarfar wrote: post #168

So next the attackers playing the long game will just set out to develop the next great everybody-uses-it open-source library, so they control it from inception? Great that we'll finally get state-sponsored open-source development :D

A kind of similar thing happened with game key scammers. People will email the devs of hundreds of Steam games pretending to be a popular YouTuber, asking for keys for themselves and usually a few extra "for a giveaway". If they get the keys, they'll try to resell them for a profit.

At first you'd get emails from like, pewdiepie@outlook.com instead of pewdiepie@gmail.com. But you could usually check the YouTube about page to find the real business email and compare it.

So eventually the scammers started creating their own YouTube channels. They'd steal videos from other channels and reupload them, then get bots to add views and subscribers. Now the email matches the one on their channel.

One remaining tell tended to be the lack of comments, but it's been a few years since I had a game that was getting those kind of emails, and I wouldn't be surprised if they have good fake video comments these days too.

Here are a couple of examples of fake channels I have saved from a few years ago:

https://www.youtube.com/channel/UCzOhUFVqJSGk20eB0kFCyOg

https://www.youtube.com/channel/UC_TgLJm0paPjmJQTWaHqDhQ

Re: Social engineering takeovers of open source projects

#249

Post by cess11 »

throwaway2037 wrote: post #195
transpute wrote: post #174

Earlier quoted context omitted.

US gov has encouraged finance/tech industry to invest in the security of OSS supply chains. OpenSSF members: https://openssf.org/about/members 2021, $10MM, https://openssf.org/press-release/2021/10/13/open-source-sec... > Financial commitments from Premier members include Amazon, Cisco, Dell Technologies, Ericsson, Facebook, Fidelity, GitHub, Google, IBM, Intel, JPMorgan Chase, Microsoft, Morgan Stanley, Oracle, Red…

Why did Eclipse org get so much and Apache org none/less? In my experience, the footprint of Apache exceeds anything else in enterprise programming.

Eclipse manages a distribution of Java and the Jakarta libraries, formerly known as JavaEE/J2EE. Arguably Jakarta is a larger footprint, since pretty much every enterprise-like library or application derives functionality from it.

Re: Social engineering takeovers of open source projects

#250

Post by ChrisMarshallNY »

transpute wrote: post #110
ChrisMarshallNY wrote: post #3

This is a great write-up. It's a very serious issue. I don't really know if there is any "one solution." I suspect that each project needs to set its own bar, and that any dependency that falls out of maintenance should be removed as quickly as possible (which was good practice, beforehand, but even more important, now). [EDITED TO ADD] I would also think about "scoring" the sensitivity of projects. Things like crypt…

Scoring framework: https://securityscorecards.dev/ Code: https://github.com/ossf/scorecard April 2024 ranking of OSS projects by criticality, 100MB CSV: https://commondatastorage.googleapis.com/ossf-criticality-sc...

Thanks!

I have a friend that used to work for a company called “SecurityScorecard.”

Different beast, though. I think the idea was similar.

Post reply on HN