5 ms·

Any idea of the minimum amount needed to bribe an open source developer to add nefarious code which will be used in a trusted program? Is there legal liability

Any idea of the minimum amount needed to bribe an open source developer to add nefarious code which will be used in a trusted program? Is there legal liability for making that change, even when the license says NO WARRANTY including for FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT? It's not even like the developer even delivers the software to anyone else. Or is it only social standing? If so, I think $2 million would be enough to retire on. It would seem that this attack vector is relevant for supply chain management. How is it currently evaluated and managed? Also, at 8:27 (https://youtu.be/6H-V-0oQvCA?t=507 https://youtu.be/6H-V-0oQvCA?t=507), "Supply chain security has to be an industry-wide effort." Would an unpaid FOSS developer, perhaps doing this as a retirement hobby, really be considered a part of industry? (For example, a statistician who continues to develop and distribute some very useful analysis software developed over her career, simply because she is interested in the approach.) If so, what if they refuse to follow the demands of for-profit corporations demanding a SBOM and reproducible builds? If not, what should companies should they depend on that FOSS software?

Veserv 3y ago
Like literally every other engineering discipline, it should be considered software engineering malpractice to use a component that is not guaranteed to be fit for purpose or that you have not audited to be fit for purpose. If that means you can not use some whizbang library because you do not know if it works and you are too lazy to figure that out for certain, tough. But I want to use the random steel sheets of unknown quality I found lying around to make a airplane is not a acceptable position. But, this does not mean you need to use aircraft grade steel everywhere. You just need to use things at a appropriate level for your purpose. If they really must use software that guarantees nothing, then they must verify it works for their purpose or pay somebody to make it fit for their purpose, simple as that.
- eesmith 3y ago
  So, no Python, no gcc, no R, ... even Visual Studio says "The software is licensed “as-is.” You bear the risk of using it. Microsoft gives no express warranties, guarantees or conditions. To the extent permitted under your local laws, Microsoft excludes the implied warranties of merchantability, fitness for a particular purpose and non-infringement." and limits direct damages to $5.00. What software do you use which is guaranteed to be fit for purpose and/or have fully audited?
_tom_ 3y ago
It's way less than $2M, since they don't bribe people to be evil, they just buy the tool and make their own alterations.
- eesmith 3y ago
  Right, but an SBOM (under the big assumption that it's fully accurate) would at least let you detect project ownership changes like that. Not that I know what you would do with that information. My scenario was to give an example of a supply chain attack where even a fully accurate SBOM would give no signal. Fundamentally, if you are using FOSS distributed for no cost, and with no contractual relationship with the developers, then how complete and useful will a SBOM really be? To be absolutely clear, I don't mean to dismiss the idea. But I remember Y2K when companies sent Y2K compliance request to vendors in their supply chain, including open source projects that had no obligation to the company, which struck me then as presumptuous. I don't like the assumption that because company X decides to use your free/open source software that obligates you to be aligned with industrial requirements.
seanhunter 3y ago
I’m pretty sure you can’t (ever) disclaim liability for wilful actions. ie if you deliberately add nefarious code you are liable no matter what your disclaimer says. $2m would be eaten up by the legal bill and the remainder would seem scant compensation when the person was “retiring” in prison. Secondly, by bribing the person even if they were covered by the disclaimer I’m pretty sure you would be liable for civil damages and probably violate one of many sweeping computer misuse laws.
- eesmith 3y ago
  What you wrote puts a shiver down my spine. If I can't disclaim any sort of warranty, and my FOSS has a bug which a company incorrectly thinks is nefarious code, what defense do I have should that company decide to sue me? (Or threatens to sue me unless I fix the code to their satisfaction.) I thought I could point to the explicit disclaimer of warranty&usability, the lack of a contract between us, the lack of payment, and the lack of copyright permission to even use my software unless they agreed to the license terms, as an absolute defense to request the court to dismiss the case. And now you suggest it might be otherwise, and I might end up paying a lot in lawyer and court costs over years? Has anything like this ever been taken to court? For example, was there any legal liability for the people who added the Bitcoin miner to event-stream? Or the denial-of-service caused by colors.js? It comes down to what specific law is broken, and where the person is living. Extradition requires the crime be illegal in both countries, yes? And who says the nefarious code must be hidden? What if it's described in the CHANGELOG and documentation? Because I know few people read those.
  - seanhunter 3y ago
    Firstly I'm not any kind of lawyer and could be wrong. I was giving you my understanding. Secondly I said you can't disclaim liability for willful actions. If you do something by mistake or it's an unintentional side-effect of course you can disclaim liability. If you do something on purpose you can't say you weren't responsible for harm you caused because you put a disclaimer in somewhere. Yes some of these sorts of things have been taken to court. In the UK where I am they are typically prosecuted under the Computer Misuse act[1] but many countries have similar legislation. See the bit about a person being guilty of an offense if "the person intends by doing the act to cause serious damage of a material kind or is reckless as to whether such damage is caused.". There is specific UK guidance from the prosecution service that DDos is covered[2] Secondly Extradition doesn't require the conduct to be a crime in both countries. It requires it to be a crime in the country requesting extradition, there to be an extradition treaty between the two countries, and the conduct and request to meet the standard for extradition in the country where you are. That doesn't necessarily mean a crime in the place you are. It also means the evidence doesn't necessarily need to be at the standard that would be required where you are. So in the UK for example you can be extradited to the US if the US show "Probable cause" (the US standard) that you committed an offense in the US because the extradition treaty says that's equivalent to the standard that would be required to get a warrant for your arrest in the UK. I didn't say anything about the code being hidden - it would depend on the legislation but as you can see from the sources I posted, the important standard in the UK is that it was intended to cause harm or that you were reckless as to whether or not it could cause harm, not anything to do with being hidden. If you did hide it, that would probable help to show that it was intentional rather than an error though. In that legislation the max sentence for that part is 14 years or life if you cause harm to critical national infrastructure. [1] https://www.legislation.gov.uk/ukpga/1990/18/section/3ZA https://www.legislation.gov.uk/ukpga/1990/18/section/3ZA [2] https://www.cps.gov.uk/legal-guidance/computer-misuse-act https://www.cps.gov.uk/legal-guidance/computer-misuse-act and DPP vs Lennon

Veserv 3y ago

Like literally every other engineering discipline, it should be considered software engineering malpractice to use a component that is not guaranteed to be fit for purpose or that you have not audited to be fit for purpose. If that means you can not use some whizbang library because you do not know if it works and you are too lazy to figure that out for certain, tough. But I want to use the random steel sheets of unknown quality I found lying around to make a airplane is not a acceptable position. But, this does not mean you need to use aircraft grade steel everywhere. You just need to use things at a appropriate level for your purpose. If they really must use software that guarantees nothing, then they must verify it works for their purpose or pay somebody to make it fit for their purpose, simple as that.

eesmith 3y ago
So, no Python, no gcc, no R, ... even Visual Studio says "The software is licensed “as-is.” You bear the risk of using it. Microsoft gives no express warranties, guarantees or conditions. To the extent permitted under your local laws, Microsoft excludes the implied warranties of merchantability, fitness for a particular purpose and non-infringement." and limits direct damages to $5.00. What software do you use which is guaranteed to be fit for purpose and/or have fully audited?

_tom_ 3y ago

It's way less than $2M, since they don't bribe people to be evil, they just buy the tool and make their own alterations.

eesmith 3y ago
Right, but an SBOM (under the big assumption that it's fully accurate) would at least let you detect project ownership changes like that. Not that I know what you would do with that information. My scenario was to give an example of a supply chain attack where even a fully accurate SBOM would give no signal. Fundamentally, if you are using FOSS distributed for no cost, and with no contractual relationship with the developers, then how complete and useful will a SBOM really be? To be absolutely clear, I don't mean to dismiss the idea. But I remember Y2K when companies sent Y2K compliance request to vendors in their supply chain, including open source projects that had no obligation to the company, which struck me then as presumptuous. I don't like the assumption that because company X decides to use your free/open source software that obligates you to be aligned with industrial requirements.

seanhunter 3y ago

I’m pretty sure you can’t (ever) disclaim liability for wilful actions. ie if you deliberately add nefarious code you are liable no matter what your disclaimer says. $2m would be eaten up by the legal bill and the remainder would seem scant compensation when the person was “retiring” in prison. Secondly, by bribing the person even if they were covered by the disclaimer I’m pretty sure you would be liable for civil damages and probably violate one of many sweeping computer misuse laws.

eesmith 3y ago
What you wrote puts a shiver down my spine. If I can't disclaim any sort of warranty, and my FOSS has a bug which a company incorrectly thinks is nefarious code, what defense do I have should that company decide to sue me? (Or threatens to sue me unless I fix the code to their satisfaction.) I thought I could point to the explicit disclaimer of warranty&usability, the lack of a contract between us, the lack of payment, and the lack of copyright permission to even use my software unless they agreed to the license terms, as an absolute defense to request the court to dismiss the case. And now you suggest it might be otherwise, and I might end up paying a lot in lawyer and court costs over years? Has anything like this ever been taken to court? For example, was there any legal liability for the people who added the Bitcoin miner to event-stream? Or the denial-of-service caused by colors.js? It comes down to what specific law is broken, and where the person is living. Extradition requires the crime be illegal in both countries, yes? And who says the nefarious code must be hidden? What if it's described in the CHANGELOG and documentation? Because I know few people read those.
- seanhunter 3y ago
  Firstly I'm not any kind of lawyer and could be wrong. I was giving you my understanding. Secondly I said you can't disclaim liability for willful actions. If you do something by mistake or it's an unintentional side-effect of course you can disclaim liability. If you do something on purpose you can't say you weren't responsible for harm you caused because you put a disclaimer in somewhere. Yes some of these sorts of things have been taken to court. In the UK where I am they are typically prosecuted under the Computer Misuse act[1] but many countries have similar legislation. See the bit about a person being guilty of an offense if "the person intends by doing the act to cause serious damage of a material kind or is reckless as to whether such damage is caused.". There is specific UK guidance from the prosecution service that DDos is covered[2] Secondly Extradition doesn't require the conduct to be a crime in both countries. It requires it to be a crime in the country requesting extradition, there to be an extradition treaty between the two countries, and the conduct and request to meet the standard for extradition in the country where you are. That doesn't necessarily mean a crime in the place you are. It also means the evidence doesn't necessarily need to be at the standard that would be required where you are. So in the UK for example you can be extradited to the US if the US show "Probable cause" (the US standard) that you committed an offense in the US because the extradition treaty says that's equivalent to the standard that would be required to get a warrant for your arrest in the UK. I didn't say anything about the code being hidden - it would depend on the legislation but as you can see from the sources I posted, the important standard in the UK is that it was intended to cause harm or that you were reckless as to whether or not it could cause harm, not anything to do with being hidden. If you did hide it, that would probable help to show that it was intentional rather than an error though. In that legislation the max sentence for that part is 14 years or life if you cause harm to critical national infrastructure. [1] https://www.legislation.gov.uk/ukpga/1990/18/section/3ZA https://www.legislation.gov.uk/ukpga/1990/18/section/3ZA [2] https://www.cps.gov.uk/legal-guidance/computer-misuse-act https://www.cps.gov.uk/legal-guidance/computer-misuse-act and DPP vs Lennon