5 ms·
I completely disagree with this framing. A real malicious actor is going to be planted in some reputable institution, creating errors that look like honest mis
by incrudible 6y ago
I completely disagree with this framing.
A real malicious actor is going to be planted in some reputable institution, creating errors that look like honest mistakes.
How do you test if the process catches such vulnerabilities? You do it the just the way that these researchers did.
Yes, it creates extra homework for some people with certain responsibilities, that doesn't mean it's unethical. Don't shoot the messenger.
- hctaw 6y agoThese are real malicious actors.
- incrudible 6y agoYou don't know that, but that's also irrelevant. There's always plausible deniability with such bugs. The point is that you need to catch the errors no matter where they come from, because you can't trust anyone.
- WrtCdEvrydy 6y agoBut that's the point, you're a security researcher wanting to get the honors of getting a PhD, not a petty criminal, so you're supposed to have a strong ethical background. A security researcher doesn't just delete a whole hard drive's worth of data to prove they have the rights to delete things, they are trusted for this reason.
- hctaw 6y agoCarrying out an attack for personal gain is malicious. It doesn't matter if the payload is for crypto mining, creating a backdoor for the NSA, or a vulnerability you can cite in a paper. Pentesting unwitting participants is malicious, and in many cases illegal.
- mannykannot 6y agoIt is ironic that you introduce plausible deniability here. No one as concerned about security as you profess to be should consider the presence of plausible deniability as being grounds for terminating a threat analysis. In the real world, where we cannot be sure of catching every error, identifying actual threats, and their capabilities and methods, is a security-enhancing analysis.
- WrtCdEvrydy 6y ago> A real malicious actor They introduced a real vulnerability in a codebase that lowers world-wide cybersecurity used by billions so they could jerk themselves off over a research paper. They are a real malicious actor and I hope they hit by the CFAA.
- toomuchtodo 6y agoThere is a specific subsection of the CFAA that applies to this situation (deployment of unauthorized code that makes its way into non consenting systems). This was a bold and unwise exercise, especially if you’re an academic in country on a revocable visa who participated.
- sharken 6y agoOthers would call it stupid to submit the patches and it would be fine if there were further consequences to deter others.
- toomuchtodo 6y agoWas attempting politeness. You’re not wrong.
- andrewzah 6y agoNo. There are processes to do such sorts of penetration testing. Randomly sending buggy commits or commits with security vulns to "test the process" is extremely unethical. The linux kernel team are not lab rats.
- xiphias2 6y agoIt's not simply unethical, it's a national security risk. Is there a proof that the Chinese government was not sponsoring this ,,research '' for example?
- andrewzah 6y agoLinux kernel vulnerabilities affect the entire world. The world does not revolve around the U.S., and I find it extremely unlikely a university professor in the U.S. doing research for a paper did this on behalf of the Chinese government. It's far more likely that professor is so out of touch that they honestly think their behavior is acceptable.
- discoduck1 6y agoThe bio of the assistant professor, Kangjie Lu, is here: https://www-users.cs.umn.edu/~kjlu/ https://www-users.cs.umn.edu/~kjlu/ It probably IS from being out of touch, or perhaps desperation to become tenured. However, he is also an alumnus of Chongqing University: http://www.cse.cqu.edu.cn/info/2095/5360.htm http://www.cse.cqu.edu.cn/info/2095/5360.htm
- kodah 6y agoHow about that question gets asked when there's actually some semblance of evidence that supports that theory. When you just throw, what I call, "dual loyalty" out as an immediate possibility just because the person is from China it starts to sound real nasty from the observers point of view.
- 6y ago
- willtemperley 6y agoThis would absolutely be true if this were an authorised penetration test, however it was unauthorised and therefore unethical.
- incrudible 6y agoHow exactly do you "authorize" these tests? Giving advance notice would defeat the purpose, obviously.
- WrtCdEvrydy 6y ago"We're writing research on the security systems involved around the Linux kernel, would it be acceptable to submit a set of patches to be reviewed for security concerns just as if it was a regular patch to the Linux kernel?" This is what you do as a grownup and the other side is expected to honor your request and perform the same thing they do for other commits... the problem is that people think of pen testing as an adversarial relationship where one person needs to win over the other one.
- yjftsjthsd-h 6y agoTo play Devil's Advocate, I suspect that this would if different results because people behave differently when they know that there is something going on.
- WrtCdEvrydy 6y agoThat's the thing, you just told the person to review the request for security... in a true double blind, you submit 10 PRs and see how many get rejected / approved. If all 10 are rejected but only one had a security concern, then the process is faulty in another way. Edit: There is this theory that penetration testing is adversarial but in the real world people want the best outcome for all. The kernel maintainers are professionals so I would expect the same level of caring for a "special PR" versus a "normal PR"
- captn3m0 6y ago
- michelpp 6y agoIt is unethical. You cannot experiment on people without their consent. Their own university has explicit rules against this.