oss-sec mailing list archives
Re: Malicious commits to Linux kernel as part of university study
From: Albert Veli <albert.veli () gmail com>
Date: Thu, 22 Apr 2021 11:44:49 +0200
Hi On Thu, Apr 22, 2021 at 9:01 AM Peter Bex <peter () more-magic net> wrote:
They also published a paper: https://raw.githubusercontent.com/QiushiWu/qiushiwu.github.io/main/papers/OpenSourceInsecurity.pdf I don't know the scope of this research, but it could involve other OSS projects, now or in the future, as well.
Supply chain attacks are a real threat to open source projects. The Linux kernel is not the easiest way to introduce malicious commits. But other projects like much used pip python modules, npm javascript modules and ruby gem modules might be less vetted before they accept commits and that is a serious risk. Proprietary projects are not immune to supply chain attacks either. An example is the Encrochat proprietary chat application that was subjected to a state sponsored supply chain attack last year which compromised their user's data. Everything that uses automated updates could be targeted by supply chain attacks.
Current thread:
- Malicious commits to Linux kernel as part of university study Peter Bex (Apr 22)
- Re: Malicious commits to Linux kernel as part of university study Albert Veli (Apr 22)
- Re: Malicious commits to Linux kernel as part of university study Peter Bex (Apr 22)
- Re: Malicious commits to Linux kernel as part of university study David A. Wheeler (Apr 22)
- Re: Malicious commits to Linux kernel as part of university study Santiago Torres (Apr 22)
- Re: Malicious commits to Linux kernel as part of university study Ariadne Conill (Apr 22)
- Re: Malicious commits to Linux kernel as part of university study r00t4dm (Apr 22)
- Re: Malicious commits to Linux kernel as part of university study Mark Steward (Apr 22)
- Re: Malicious commits to Linux kernel as part of university study Michael Orlitzky (Apr 22)
- Re: Malicious commits to Linux kernel as part of university study Francis Booth (Apr 22)
- Re: Malicious commits to Linux kernel as part of university study Eric Biggers (Apr 22)
- Re: Malicious commits to Linux kernel as part of university study Peter Bex (Apr 22)
- Re: Malicious commits to Linux kernel as part of university study Jan Engelhardt (Apr 23)
- Re: Malicious commits to Linux kernel as part of university study Albert Veli (Apr 22)