34 ms·
The professor gets exactly what they want here, no? "We experimented on the linux kernel team to see what would happen. Our non-double-blind test of 1 FOSS mai
by rzwitserloot 6y ago
The professor gets exactly what they want here, no?
"We experimented on the linux kernel team to see what would happen. Our non-double-blind test of 1 FOSS maintenance group has produced the following result: We get banned and our entire university gets dragged through the muck 100% of the time".
That'll be a fun paper to write, no doubt.
Additional context:
* One of the committers of these faulty patches, Aditya Pakki, writes a reply taking offense at the 'slander' and indicating that the commit was in good faith[1].
Greg KH then immediately calls bullshit on this, and then proceeds to ban the entire university from making commits [2].
The thread then gets down to business and starts coordinating revert patches for everything committed by University of Minnesota email addresses.
As was noted, this obviously has a bunch of collateral damage, but such drastic measures seem like a balanced response, considering that this university decided to _experiment_ on the kernel team and then lie about it when confronted (presumably, that lie is simply continuing their experiment of 'what would someone intentionally trying to add malicious code to the kernel do')?
* Abhi Shelat also chimes in with links to UMN's Institutional Review Board along with documentation on the UMN policies for ethical review. [3]
[1]: Message has since been deleted, so I'm going by the content of it as quoted in Greg KH's followup, see footnote 2
[2]: https://lore.kernel.org/linux-nfs/YH%2FfM%2FTsbmcZzwnX@kroah.com/ https://lore.kernel.org/linux-nfs/YH%2FfM%2FTsbmcZzwnX@kroah...
[3]: https://lore.kernel.org/linux-nfs/3B9A54F7-6A61-4A34-9EAC-95332709BAE7@northeastern.edu/#t https://lore.kernel.org/linux-nfs/3B9A54F7-6A61-4A34-9EAC-95...
- gher-shyu3i 6y ago> The thread then gets down to business and starts coordinating revert patches for everything committed by University of Minnesota email addresses. What's preventing those bad actors from not using a UMN email address?
- mcdonje 6y agoHow would you catch those?
- Avamander 6y agoLiterally nothing. Instead of actual actions to improve the process it's only feel-good actions without any actual benefit to the kernel's security.
- thenoblesunfish 6y agoThe point is to make it very obviously not worth it to conduct this kind of unethical research. I don't think UMN is going to be eager to have this kind of attention again. People could always submit bogus patches from random email addresses - this removes the ability to do it under the auspices of a university.
- Avamander 6y agoThe ethical aspect is separate from the practical aspect that is kernel security. Sabotage is a very real risk but we're discussing ethics of demonstrating the risk instead of potential remediation, that's dangerous and foolish.
- d110af5ccf 6y ago> this removes the ability to do it under the auspices of a university It really doesn't though. You can claim ownership of that email address in the published manuscript. For that matter, you could even publish the academic article under a pen name if you wanted to. But after seeing how the maintainers responded here, you'd better make sure that any "real" contributions you make aren't associated with the activity in any way.
- rincebrain 6y agoYou keep posting all over this discussion about how the Linux maintainers are making a poor choice and shooting the messenger. What would you like them to do instead or in addition to this?
- GoblinSlayer 6y agoIndeed the situation is bad, nothing can be done. At the very least as long as they can make unintentional vulnerabilities, they are defenseless against intentional ones, and fixing only the former is already a very big deal.
- saul_goodman 6y agoNothing. However if they can't claim ownership of the drama they have caused it's not useful for research that's publishable so it does nix these idiots from causing further drama while working at this institution. For now.
- nickalaso 6y agoThey don't need to claim ownership of the drama to write the paper, in fact, my first thought was that they would specifically try to avoid taking ownership and instead write a paper "discovering" the vulnerability(ies).
- NotEvil 6y agoIf they submit them from personal or anonymous email the patches may have come under more sucutiny. They gain some trust comming from university email addresses
- slowmovintarget 6y agoExactly. Users contributing from the University addresses were borrowing against the reputation of the institution. That reputation is now destroyed and each individual contributor must build their own reputation to earn trust.
- nomel 6y agoI can't understand this. Why would a university be more trustworthy? Foreign actors have been known to plant students, for malicious intent. edit: Reference to combat the downvote: https://www.nbcnews.com/news/china/american-universities-are-soft-target-china-s-spies-say-u-n1104291 https://www.nbcnews.com/news/china/american-universities-are...
- twic 6y agoNothing. I think the idea is 60% deterrence via collective punishment - "if we punish the whole university, people will be less likely to do this in future" - and 40% "we must do something, and this is something, therefore we must do it".
- tremon 6y agosee https://lore.kernel.org/linux-nfs/YIAmy0zgrQW%2F44Hz@kroah.com/ https://lore.kernel.org/linux-nfs/YIAmy0zgrQW%2F44Hz@kroah.c... If they just want to be jerks, yes. But they can't then use that type of "hiding" to get away with claiming it was done for a University research project as that's even more unethical than what they are doing now.
- failwhaleshark 6y agoWere all of the commits from UMN emails GPG signed with countersigned/trusted keys?
- blippage 6y ago> What's preventing those bad actors from not using a UMN email address? Technically none, but by banning UMN submissions, the kernel team have sent an unambiguous message that their original behaviour is not cool. UMN's name has also been dragged through the mud, as it should be. Prof Lu exercised poor judgement by getting people to submit malicious patches. To use further subterfuge knowing that you've been already been called out on it would be monumentally bad. I don't know how far Greg has taken this issue up with the university, but I would expect that any reasonable university would give Lu a strong talking-to.
- bluGill 6y agoIf the IRB is any good the professor doesn't get that. Universities are publish or perish, and the IRB should force the withdrawal of all papers they submitted. This is might be enough to fire the professor with cause - including remove any tenure protection they might have - which means they get a bad reference. I hope we hear from the IRB in about a year stating exactly what happened. Real investigations of bad conduct should take time to complete correctly and I want them to do their job correctly so I'll give them that time. (there is the possibility that these are good faith patches and someone in the linux community just hates this person - seems unlikely but until a proper independent investigation is done I'll leave that open.)
- duncaen 6y agoSee page 9 of the already published paper: https://raw.githubusercontent.com/QiushiWu/qiushiwu.github.io/main/papers/OpenSourceInsecurity.pdf https://raw.githubusercontent.com/QiushiWu/qiushiwu.github.i... > We send the emails to the Linux communityand seek their feedback. The experiment is not to blame any maintainers but to reveal issues in the process. The IRB of University of Minnesota reviewed the procedures of the experiment and determined that this is not human research. We obtained a formal IRB-exempt letter. The experiment will not collect any personal data, individual behaviors, or personal opinions. It is limited to studying the patching process OSS communities follow, instead of individuals.
- karlmdavis 6y agoCommunities aren’t people? What in the actual fuck is going on with this university’s IRB?!
- DetroitThrow 6y agoIn my experience in university research, the correct portrayal of the ethical impact is the burden of the researchers unfortunately, and the most plausible explanation in my view given their lack of documentation of the request for IRB exemption would be that they misconstrued the impact of the research. It seems very possible to me that an IRB wouldn't have accepted their proposed methodology if they hadn't received an exemption.
- kop316 6y agoHearing how you phrased it reminds me of a study that showed how parachutes do not in fact save lives (the study was more to show the consequences of extrapolating data, so the result should not be taken seriously): https://www.bmj.com/content/363/bmj.k5094 https://www.bmj.com/content/363/bmj.k5094
- tpoacher 6y agoThis is now my second favourite paper after the atlantic salmon in fmri
- kevmo 6y agolink?
- hprotagonist 6y agohttps://blogs.scientificamerican.com/scicurious-brain/ignobel-prize-in-neuroscience-the-dead-salmon-study/ https://blogs.scientificamerican.com/scicurious-brain/ignobe... it was, iirc, a poster not a paper.
- etiam 6y agoApparently there was an article as followup: "Neural Correlates of Interspecies Perspective Taking in the Post-Mortem Atlantic Salmon: An Argument For Proper Multiple Comparisons Correction" (2010, in Journal of Serendipitous and Unexpected Results) We had the good fortune to have discussion of the study with comments from the author a few years back: https://news.ycombinator.com/item?id=15598429 https://news.ycombinator.com/item?id=15598429
- optimalsolver 6y agoMy favorite is "Possible Girls": https://philpapers.org/archive/sinpg https://philpapers.org/archive/sinpg
- CommieBobDole 6y ago
- BearsAreCool 6y agoI'm really not sure what the motive to lie is. You got caught with your hand in the cookie jar, time to explain what happened before they continue to treat you like a common criminal. Doing a pentest and refusing to state it was a pentest is mind boggling. Has anyone from the "research" team commented and confirmed this was even them or a part of their research? It seems like the only defense is from people who did google-fu for a potentially outdated paper. At this point we can't even be sure if this isn't a genuinely malicious actor using comprimised credentials to introduce vulnerabilities.
- mort96 6y agoIt's also not a pen test. Pen testing is explicitly authorized, where you play the role as an attacker, with consent from your victim, in order to report security issues to your victim. This is just straight-up malicious behavior, where the "researchers" play the role as an attacker, without consent from their victim, for personal gain (in this case, publishing a paper).
- NotEvil 6y agoBecause of the nature of the research an argument can be made that it was like a bug bounty (not defending them just putting my argument) but they should have come clean when the patched was merged and told the community about the research or at least submitted the right patch. Intentionally having bugs in kernel only you know about is very bad.
- opnitro 6y agoThe primary difference being the organization being tested explicitly sets up a bug bounty with terms, as opposed to this.
- deleted 6y ago[deleted]
- unanswered 6y ago
- nitrogen 6y agoIsn't this reaction a bit like the emperor banishing anyone who tells him that his new clothes are fake? Are the maintainers upset that someone showed how easy it is to subvert kernel security?
- enumjorge 6y agoIt’s more like the emperor banning a group of people who put the citizens in danger just so they could show that it could be done. The researchers did something unethical and acted in a self-serving manner. It’s no surprise that someone would get kicked out of a community after seriously breaking the trust of that community.
- Mordisquitos 6y agoMore like the emperor banishing anyone who tries to sell him fake clothes to prove that the emperor will buy fake clothes.
- trashtester 6y agoThe middle ground would be if the Emperor jailed the tailors of the New Clothes after he had shown off the clothes at the Parade, in front of the whole city.
- wemern 5y agoYeah,maybe it's fragile security.Fortunately，the problem has been found, and 'attackers' aren't real enemy.
- gregkh 6y agoThanks for the support. I also now have submitted a patch series that reverts the majority of all of their contributions so that we can go and properly review them at a later point in time: https://lore.kernel.org/lkml/20210421130105.1226686-1-gregkh@linuxfoundation.org/ https://lore.kernel.org/lkml/20210421130105.1226686-1-gregkh...
- Cpoll 6y agoA lot of people are talking about the ethical aspects, but could you talk about the security implications of this attack? From a different thread: https://lore.kernel.org/linux-nfs/CADVatmNgU7t-Co84tSS6VW=3NcPu=17qyVyEEtVMVR_g51Ma6Q@mail.gmail.com/ https://lore.kernel.org/linux-nfs/CADVatmNgU7t-Co84tSS6VW=3N... > A lot of these have already reached the stable trees. Apologies in advance if my questions are off the mark, but what does this mean in practice? 1. If UNM hadn't brought any attention to these, would they have been caught, or would they have eventually wound up in distros? 'stable' is the "production" branch? 2. What are the implications of this? Is it possible that other malicious actors have done things like this without being caught? 3. Will there be a post-mortem for this attack/attempted attack?
- deleted 6y ago[deleted]
- cutemonster 6y agoI wonder about this me too. To me, seems to indicate that nation state supported evil hacker org (maybe posing as an individual) could place their own exploits in the kernel. Let's say they contribute 99.9% useful code, solve real problems, build trust over some years, and only rarely write an evil hard to notice exploit bug. And then, everyone thinks that obviously it was just an ordinary bug. Maybe they can pose as 10 different people, in case some of them gets banned.
- Spooky23 6y agoYou're still in a better position with open source. The same thing happens in closed source companies. See: https://www.reuters.com/article/us-usa-security-siliconvalley/strong-ties-bind-spy-agencies-and-silicon-valley-idUSBRE96214I20130703 https://www.reuters.com/article/us-usa-security-siliconvalle... "As U.S. intelligence agencies accelerate efforts to acquire new technology and fund research on cybersecurity, they have invested in start-up companies, encouraged firms to put more military and intelligence veterans on company boards, and nurtured a broad network of personal relationships with top technology executives." Foreign countries do the same thing. There are numerous public accounts of Chinese nationals or folks with vulnerable family in China engaging in espionage.
- ww520 6y agoWell part of the experiment is to see how deliberate malicious commits are handled. Banning is the result. They got what they wanted. Play stupid game. Win stupid pri[z]e.
- gervwyk 6y agoWell said.
- failwhaleshark 6y agoNit: The expression is "Play stupid games, win stupid prizes." As heard frequently on ASP, along with "Room Temperature Challenge."
- brodock 6y agoIsn't trying to break security of the "entire internet" some kind of crime (despite whatever the excuse is)? People got swatted for less.
- salawat 5y agoInterestingly enough, this is more a case of being a dick. That is not illegal. If an AG does not levy a charge, no crime has been committed. This does not at all mean the behavior in question should be condoned. This fails the sniff test worse than thioacetone.
- furyofantares 6y agoTo be clear, the quoted text in your post is presumably your own words, not a quote?
- jvanderbot 6y agoSo, the patch was about a possible double-free, detected presumably from a bad static analyzer. Couldn't this patch have been done in good faith? That's not at all impossible. However, the prior activity of submitting bad-faith code is indeed pretty shameful.
- machello13 6y agoI'm not a linux kernel maintainer but it seems like the maintainers all agree it's extremely unlikely a static analyzer could be so wrong in so many different ways.
- Floegipoky 6y agoSetting aside the ethical aspects which others have covered pretty thoroughly, they may have violated 18 U.S.C. §1030(a)(5) or (b). This law is infamously broad and intent is easier to "prove" than most people think, but #notalawyer #notlegaladvice. Please don't misinterpret this as a suggestion that they should or should not be prosecuted.
- flowerlad 6y agoBut this raises an obvious question: Doesn't Linux need better protection against someone intentionally introducing security vulnerabilities? If we have learned anything from the SolarWinds hack, it is that if there is a way to introduce a vulnerability then someone will do it, sooner or later. And they won't publish a paper about it, so that shouldn't be the only way to detect it!
- corty 6y agoThat question has been obvious for quite some time. It is always possible to introduce subtle vulnerabilities. Research has tried for decades to come up with a solution, to no real avail.
- danielbot 6y agoAssassinating the researchers doesn't help.
- thelean12 6y agoThe Linux team found the source of a security threat and have taken steps to prevent that security threat from continuing to attack them. You can't break into someone's house through their back window, tell the owners what you did, and not expect to get arrested. People don't scream "how are we going to know that people can break into houses through broken windows without these heros!?"
- cthaeh 6y agoDoes nobody here even understand what actually happened? Really losing my faith in the accuracy of HN if such a huge thread is full of misinformation. Basically (as I understand it, feel free to correct me) this is what happened: Researcher emailed maintained with flawed code, maintainer LGTMed it, researcher told maintainer that the code is buggy and not to merge it. The researchers confirmed that the code was not merged or commited anywhere. Paper gets published. Nothing of note happens. Now, one of the researchers grad students has submitted stuff to linux oh his own volition- he does not appear to be associated with the previous research. These commits are "obviously bad" according to linux maintainers and claim that the grad student is just continuing the "merge bad shit" research. These commits do not appear to be intentionally flawed but rather newbie mistakes (so claims the student)- which is why he feels the linux community is unwelcoming to newcomers. Now how on earth did that warp to whatever everyone here is smoking?
- dfrankow 6y agohttps://twitter.com/UMNComputerSci/status/1384963718333730820 https://twitter.com/UMNComputerSci/status/138496371833373082... "The University of Minnesota Department of Computer Science & Engineering takes this situation extremely seriously. We have immediately suspended this line of research."
- killjoywashere 6y agoNot that I approve of the methods, but why would an IRB be involved in a computer security study? IRBs are for human subjects research. If we have to run everything that looks like any kind of research through IRBs, the Western gambit on technical advantage is going to run into some very hard times.
- altouring 6y agoThe subjects were the kernel team. They should have had consent to be part of this study. It's like red team testing, someone somewhere has to know about it and consent to it.
- neatze 6y agoHow IEEE accepted this paper is a mystery, from twitter feeds, seems like at least one complaint was filled with IEEE, paper still was accepted.
- spullara 6y agoPerhaps the Linux kernel team should actively support a Red Team to do this with a notification when it would be merged into the stable branch.
- yuliyp 6y agoWhat would be the point? Of course people can miss things in code review. Yet the Linux developer base and user base has decided that generally an open submission policy has benefits that outweigh the risks. Should every city park with a "no alcohol" policy conduct red teams on whether it's possible to smuggle alcohol in? Should police departments conduct red teams to see if people can get away with speeding?
- spullara 6y agoLet's say that no one has ever seen someone speeding or drinking the park. But then someone announces that they just did it, got away with it, and the system isn't effective at catching folks that violate the policies. It might make sense to figure out how you could change the way the system works to stop people from violating the policy. One way to do that is to replicate the violation and see what measures could be introduced to decrease the likely-hood. I would say it is very much akin to the companies that test to see if your employees can be phished or the pen testers to see if you can be hacked. Other important things that people want to protect have these teams to make them a harder target and I think in the case of something as important as the Linux Kernel it might pay dividends.
- dleslie 6y agoI think this hasn't gone far enough. The university has shown that it is willing to allow its members to act in bad faith for their own interests, under the auspices of acting ethically for scientific reasons. The university itself cannot be trusted _ever again_. Black list the whole lot from everything, everywhere. Black hole that place and nuke it from orbit.
- xwolfi 6y agoI had a uni teacher who thought she was a genius because her research team powdered wikipedia with fake information while timing how long it took to remove them. "Earth is center of universe" took 1000 years to remove from books, I'm not sure what her point was :D
- Khaine 6y agoInterestingly, the Sokal Squared guy got banned from future research for "unauthorized human experimentation". It's a different university, but I wonder if these people will see the same result.
- chrisseaton 6y ago> The professor gets exactly what they want here, no? I don't think they're a professor are they? Says they're a PhD student?
- DannyBee 6y agoJoke's on you - this was really sociology research on anger response levels of open source communities when confronted with things that look like bad faith.
- rossjudson 6y agoWaitASecond...are you saying that this was an experiment to find out how the maintainers would react to being experimented on? ;)
- JPKab 6y agoYet another reason to absolutely despise the culture within academia. The US Federal government is subsidizing a collection of pathologically toxic institutions, and this is one of many results, along with HR departments increasingly mimicking the campus tribalism.
- BiteCode_dev 6y agoThe problem with such experiment is that it can be a front. If you are a big entity, gov, or whatever, and you need to insert a vulnerability in the kernel, you can start a "research project". Then you try to inject it with this pretense, and if it fails, you can always say "my bad, it was for science".
- birdyrooster 5y agoIt wasn’t a real experiment, it was a legitimate attempt to insert bugs into the code base and this professor was going to go on speaking tours to self promote and talk about how easy it was to crack Linux. If it looks like grift it’s probably grift. This was never about science.