3 ms·

I’m gonna cry survivorship bias here. How do we know how many similar attempts succeeded? How many of the ones discovered have been written off as honest mistak

by bsza 3y ago

I’m gonna cry survivorship bias here. How do we know how many similar attempts succeeded? How many of the ones discovered have been written off as honest mistakes? How can we know for sure that e.g. Heartbleed wasn’t put there by someone on purpose (and that that someone isn’t filthy rich now)? When you get hired to a private company, they know who you are. That’s an immediate deterrent against trying anything funny. On Github, no one knows who you are. It might be harder to backdoor a project without getting noticed, but there is no risk to getting noticed. You can try as many times as you like. Jia Tan is still at large, and didn’t even have to plan their whole life around living in a non-extraditing country (if they aren’t in one already).

xyst 3y ago
https://en.wikipedia.org/wiki/Industrial_espionage https://en.wikipedia.org/wiki/Industrial_espionage (aka corporate espionage) Happens all the time. Maybe it's a state actor. Maybe it's a disgruntled employee. It's just not in the same lens as you expect (software supply chain attack). Apple has trouble keeping the lid on top secret projects. Leaks about designs happen all the time prior to scheduled debut at WWDC. MS has had trouble in the past as well when it came to developing the Xbox (One?). "Owners of China-Based Company Charged With Conspiracy to Send Trade Secrets Belonging to Leading U.S.-Based Electric Vehicle Company" - https://www.justice.gov/usao-edny/pr/owners-china-based-company-charged-conspiracy-send-trade-secrets-belonging-leading-us https://www.justice.gov/usao-edny/pr/owners-china-based-comp... "Ex-Google engineer charged with stealing AI trade secrets while working with Chinese companies" - https://www.latimes.com/world-nation/story/2024-03-07/ex-google-engineer-charged-with-stealing-ai-trade-secrets-while-working-with-chinese-companies https://www.latimes.com/world-nation/story/2024-03-07/ex-goo... "The US Hits Huawei With New Charges of Trade Secret Theft" - https://www.wired.com/story/us-hits-huawei-new-charges-trade-secret-theft/ https://www.wired.com/story/us-hits-huawei-new-charges-trade... "U.S. charges China-controlled company in trade secrets theft" - https://www.pbs.org/newshour/economy/u-s-charges-china-controlled-company-in-trade-secrets-theft https://www.pbs.org/newshour/economy/u-s-charges-china-contr... "Ex-Google and Uber engineer Anthony Levandowski charged with trade secret theft" - https://www.theverge.com/2019/8/27/20835368/google-uber-engineer-trade-theft-secrets-anthony-levandowski-charged https://www.theverge.com/2019/8/27/20835368/google-uber-engi... In the case of Levandowski, the dude didn't even bother with covering his tracks. Straight up just downloads trade secrets from source control and transfers them to personal computer - https://www.justice.gov/usao-ndca/press-release/file/1197991/download https://www.justice.gov/usao-ndca/press-release/file/1197991... In this small sample of cases, were the exfiltration attempts as elaborate as the "xz attack"? Probably not, but all of these people were vetted by internal procedures and that did nothing to stop them from acting maliciously. Forget back dooring the project when getting through the front door is so much easier! People are very relaxed in their walled off garden and cubicle :)
- resolutebat 3y ago
  Stealing trade secrets (read: copying source code) is a whole different ballgame from trying to inject backdoors into ubiquitous pieces of software.
- bsza 3y ago
  This kind of demonstrates my point. Every single one of these headlines indicates the bad actor has been "charged" (with serious consequences in the case of Huawei). Has Jia Tan been "charged" with anything?
  - nindalf 3y ago
    I’m gonna cry survivorship bias here. How do we know how many similar attempts succeeded?
    - bsza 3y ago
      Right, we don’t know that, but we have yet to hear of one case where a supply chain attack on a FOSS project resulted in someone getting arrested.
deleted 3y ago
[deleted]

by bsza 3y ago

xyst 3y ago

https://en.wikipedia.org/wiki/Industrial_espionage https://en.wikipedia.org/wiki/Industrial_espionage (aka corporate espionage) Happens all the time. Maybe it's a state actor. Maybe it's a disgruntled employee. It's just not in the same lens as you expect (software supply chain attack). Apple has trouble keeping the lid on top secret projects. Leaks about designs happen all the time prior to scheduled debut at WWDC. MS has had trouble in the past as well when it came to developing the Xbox (One?). "Owners of China-Based Company Charged With Conspiracy to Send Trade Secrets Belonging to Leading U.S.-Based Electric Vehicle Company" - https://www.justice.gov/usao-edny/pr/owners-china-based-company-charged-conspiracy-send-trade-secrets-belonging-leading-us https://www.justice.gov/usao-edny/pr/owners-china-based-comp... "Ex-Google engineer charged with stealing AI trade secrets while working with Chinese companies" - https://www.latimes.com/world-nation/story/2024-03-07/ex-google-engineer-charged-with-stealing-ai-trade-secrets-while-working-with-chinese-companies https://www.latimes.com/world-nation/story/2024-03-07/ex-goo... "The US Hits Huawei With New Charges of Trade Secret Theft" - https://www.wired.com/story/us-hits-huawei-new-charges-trade-secret-theft/ https://www.wired.com/story/us-hits-huawei-new-charges-trade... "U.S. charges China-controlled company in trade secrets theft" - https://www.pbs.org/newshour/economy/u-s-charges-china-controlled-company-in-trade-secrets-theft https://www.pbs.org/newshour/economy/u-s-charges-china-contr... "Ex-Google and Uber engineer Anthony Levandowski charged with trade secret theft" - https://www.theverge.com/2019/8/27/20835368/google-uber-engineer-trade-theft-secrets-anthony-levandowski-charged https://www.theverge.com/2019/8/27/20835368/google-uber-engi... In the case of Levandowski, the dude didn't even bother with covering his tracks. Straight up just downloads trade secrets from source control and transfers them to personal computer - https://www.justice.gov/usao-ndca/press-release/file/1197991/download https://www.justice.gov/usao-ndca/press-release/file/1197991... In this small sample of cases, were the exfiltration attempts as elaborate as the "xz attack"? Probably not, but all of these people were vetted by internal procedures and that did nothing to stop them from acting maliciously. Forget back dooring the project when getting through the front door is so much easier! People are very relaxed in their walled off garden and cubicle :)

resolutebat 3y ago
Stealing trade secrets (read: copying source code) is a whole different ballgame from trying to inject backdoors into ubiquitous pieces of software.
bsza 3y ago
This kind of demonstrates my point. Every single one of these headlines indicates the bad actor has been "charged" (with serious consequences in the case of Huawei). Has Jia Tan been "charged" with anything?
- nindalf 3y ago
  I’m gonna cry survivorship bias here. How do we know how many similar attempts succeeded?
  - bsza 3y ago
    Right, we don’t know that, but we have yet to hear of one case where a supply chain attack on a FOSS project resulted in someone getting arrested.

deleted 3y ago

[deleted]