4 ms·

This goes to show: no matter how great your network defenses, you have to be prepared for WHEN you get breached. Supply chain vulnerabilities are becoming a gr

This goes to show: no matter how great your network defenses, you have to be prepared for WHEN you get breached. Supply chain vulnerabilities are becoming a greater problem by the day. I think Solarwinds demonstrated this greatly.

judofyr 4y ago
I agree with your point, but this is maybe a bad example since there’s no indication that anyone was breached by this?
xmprt 4y ago
One of my college professors joked about/discussed a potential attack where someone sneaks a change into the Linux kernel or distributes a binary that's different from the open source code and I remember the class dismissing it as if it was a joke. Turns out it wasn't as much of a joke as it seemed at the time.
- lamontcg 4y ago
  Put it into the compiler so it re-inserts itself when it sees that the compiler is being recompiled... Reflections on Trusting Trust: https://dl.acm.org/doi/pdf/10.1145/358198.358210 https://dl.acm.org/doi/pdf/10.1145/358198.358210
  - pabs3 4y ago
    Bootstrappable Builds solves the compiler backdoor problem; start with only 512 of machine code and lots of source code, then build a whole distro. https://bootstrappable.org/ https://bootstrappable.org/
- ccheney 4y ago
  You may be interested in reading about the Linux incident[1] perpetrated by some University of Minnesota researchers[2]. Previous discussion: https://news.ycombinator.com/item?id=26887670 https://news.ycombinator.com/item?id=26887670 [1] https://lkml.org/lkml/2021/4/21/454 https://lkml.org/lkml/2021/4/21/454 [2] https://cse.umn.edu/cs/linux-incident https://cse.umn.edu/cs/linux-incident
- pabs3 4y ago
  Reproducible Builds solves the "binary different from the source" problem: https://reproducible-builds.org/ https://reproducible-builds.org/
- captn3m0 4y ago
  In 2011, root access to kernel.org was with rogue hackers: https://www.securityweek.com/linux-source-code-repository-kernelorg-gets-hacked https://www.securityweek.com/linux-source-code-repository-ke...

judofyr 4y ago

I agree with your point, but this is maybe a bad example since there’s no indication that anyone was breached by this?

xmprt 4y ago

One of my college professors joked about/discussed a potential attack where someone sneaks a change into the Linux kernel or distributes a binary that's different from the open source code and I remember the class dismissing it as if it was a joke. Turns out it wasn't as much of a joke as it seemed at the time.

lamontcg 4y ago
Put it into the compiler so it re-inserts itself when it sees that the compiler is being recompiled... Reflections on Trusting Trust: https://dl.acm.org/doi/pdf/10.1145/358198.358210 https://dl.acm.org/doi/pdf/10.1145/358198.358210
- pabs3 4y ago
  Bootstrappable Builds solves the compiler backdoor problem; start with only 512 of machine code and lots of source code, then build a whole distro. https://bootstrappable.org/ https://bootstrappable.org/
ccheney 4y ago
You may be interested in reading about the Linux incident[1] perpetrated by some University of Minnesota researchers[2]. Previous discussion: https://news.ycombinator.com/item?id=26887670 https://news.ycombinator.com/item?id=26887670 [1] https://lkml.org/lkml/2021/4/21/454 https://lkml.org/lkml/2021/4/21/454 [2] https://cse.umn.edu/cs/linux-incident https://cse.umn.edu/cs/linux-incident
pabs3 4y ago
Reproducible Builds solves the "binary different from the source" problem: https://reproducible-builds.org/ https://reproducible-builds.org/
captn3m0 4y ago
In 2011, root access to kernel.org was with rogue hackers: https://www.securityweek.com/linux-source-code-repository-kernelorg-gets-hacked https://www.securityweek.com/linux-source-code-repository-ke...