4 ms·

This isn't friendly pen-testing in a community, this is an attack on critical infrastructure using a university as cover. The foundation should sue the responsi

This isn't friendly pen-testing in a community, this is an attack on critical infrastructure using a university as cover. The foundation should sue the responsible profs personally and seek criminal prosecution. I remember a bunch of U.S. contractors said they did the same thing to one of the openbsd vpn library projects about 15 years ago as well. What this professor is proving out is that open source and (likely, other) high trust networks cannot survive really mendacious participants, but perhaps by mistake, he's showing how important it is to make very harsh and public examples of said actors and their mendacity. I wonder if some of these or other bug contributors have also complained that the culture of the project governance is too aggressive, that project leads can create an unsafe environment, and discourage people from contributing? If counter-intelligence prosecutors pull on this thread, I have no doubt it will lead to unravelling a much broader effort.

frombody 6y ago
I am not knowledgeable enough to know if this intent is provable, but if someone can frame the issue appropriately, it feels like it could be good to report this to the FBI tip line so it is at least on their radar.
eatbitseveryday 6y ago
> The foundation should sue the responsible profs personally and seek criminal prosecution. This is overkill and uncalled for.
- motohagiography 6y ago
  Organizing an effort, with a written mandate, to knowingly introduce kernel vulnerabilities, through deception, that will spread downstream into other Linux distributions, likely including firmware images, which may not be patched or reverted for months or years - does not warrant a criminal investigation? The foundation should use recourse to the law to signal they are handling it, if only to prevent these profs from being mobbed.
  - asciident 6y ago
    I think you are misunderstanding what happened. They emailed the patches to the maintainers, and when the maintainers responded "this looks good", then told them there was a bug in the patch. They never committed a bad patch to the source tree. The problem is they were deceptive in their initial email, not that they actually introduced kernel vulnerabilities. No bad code was ever committed, and they had a written mandate to verify that.
    - noptd 6y ago
      No the parent is correct- malicious commits made it into stable. https://lore.kernel.org/lkml/78ac6ee8-8e7c-bd4c-a3a7-5a90c7ccb399@roeck-us.net/ https://lore.kernel.org/lkml/78ac6ee8-8e7c-bd4c-a3a7-5a90c7c... https://lore.kernel.org/linux-nfs/CADVatmNgU7t-Co84tSS6VW=3NcPu=17qyVyEEtVMVR_g51Ma6Q@mail.gmail.com/ https://lore.kernel.org/linux-nfs/CADVatmNgU7t-Co84tSS6VW=3N...
      - smbullet 6y ago
        It doesn't sound like either of those reverts are necessarily for malicious patches. They are reverting all commits from umn.edu addresses regardless of their involvement with this professor.
      - asciident 6y ago
        Both of those reverts suggest those were just non-malicious contributions that the maintainers reverted just in case (and reapplied after review). If that's the proof, then I think you are mistaken. Maybe put another way, if someone says "noptd has bad intentions, so I'm reverting all of noptd's contributions that were committed to stable" the reverts themselves are not proof that malicious commits made it to stable, and that noptd has bad intentions.
      - luckystarr 6y ago
        It doesn't matter whether the patches made it in our not. Even the attempt is illegal in some jurisdictions.
    - 6y ago
- totalZero 6y ago
  How exactly is a lawsuit overkill? If the researchers are in the right, the court will find in their favor.
  - thrwyoilarticle 6y ago
    And if they aren't and it doesn't, will the maintainers be happier? No, just older and poorer.
aluminum96 6y ago
Not everything can be fixed with the criminal justice system. This should be solved with disciplinary action by the university (and possibly will be [1]). [1] https://cse.umn.edu/cs/statement-cse-linux-kernel-research-april-21-2021 https://cse.umn.edu/cs/statement-cse-linux-kernel-research-a...

frombody 6y ago

I am not knowledgeable enough to know if this intent is provable, but if someone can frame the issue appropriately, it feels like it could be good to report this to the FBI tip line so it is at least on their radar.

eatbitseveryday 6y ago

> The foundation should sue the responsible profs personally and seek criminal prosecution. This is overkill and uncalled for.

motohagiography 6y ago
Organizing an effort, with a written mandate, to knowingly introduce kernel vulnerabilities, through deception, that will spread downstream into other Linux distributions, likely including firmware images, which may not be patched or reverted for months or years - does not warrant a criminal investigation? The foundation should use recourse to the law to signal they are handling it, if only to prevent these profs from being mobbed.
- asciident 6y ago
  I think you are misunderstanding what happened. They emailed the patches to the maintainers, and when the maintainers responded "this looks good", then told them there was a bug in the patch. They never committed a bad patch to the source tree. The problem is they were deceptive in their initial email, not that they actually introduced kernel vulnerabilities. No bad code was ever committed, and they had a written mandate to verify that.
  - noptd 6y ago
    No the parent is correct- malicious commits made it into stable. https://lore.kernel.org/lkml/78ac6ee8-8e7c-bd4c-a3a7-5a90c7ccb399@roeck-us.net/ https://lore.kernel.org/lkml/78ac6ee8-8e7c-bd4c-a3a7-5a90c7c... https://lore.kernel.org/linux-nfs/CADVatmNgU7t-Co84tSS6VW=3NcPu=17qyVyEEtVMVR_g51Ma6Q@mail.gmail.com/ https://lore.kernel.org/linux-nfs/CADVatmNgU7t-Co84tSS6VW=3N...
    - smbullet 6y ago
      It doesn't sound like either of those reverts are necessarily for malicious patches. They are reverting all commits from umn.edu addresses regardless of their involvement with this professor.
    - asciident 6y ago
      Both of those reverts suggest those were just non-malicious contributions that the maintainers reverted just in case (and reapplied after review). If that's the proof, then I think you are mistaken. Maybe put another way, if someone says "noptd has bad intentions, so I'm reverting all of noptd's contributions that were committed to stable" the reverts themselves are not proof that malicious commits made it to stable, and that noptd has bad intentions.
    - luckystarr 6y ago
      It doesn't matter whether the patches made it in our not. Even the attempt is illegal in some jurisdictions.
  - 6y ago
totalZero 6y ago
How exactly is a lawsuit overkill? If the researchers are in the right, the court will find in their favor.
- thrwyoilarticle 6y ago
  And if they aren't and it doesn't, will the maintainers be happier? No, just older and poorer.

aluminum96 6y ago

Not everything can be fixed with the criminal justice system. This should be solved with disciplinary action by the university (and possibly will be [1]). [1] https://cse.umn.edu/cs/statement-cse-linux-kernel-research-april-21-2021 https://cse.umn.edu/cs/statement-cse-linux-kernel-research-a...