Re: Malicious commits to Linux kernel as part of university study

[Albert Veli <albert.veli () gmail com>]

Hi

On Thu, Apr 22, 2021 at 9:01 AM Peter Bex <peter () more-magic net> wrote:
> They also published a paper:
> https://raw.githubusercontent.com/QiushiWu/qiushiwu.github.io/main/papers/OpenSourceInsecurity.pdf
>
> I don't know the scope of this research, but it could involve other OSS
> projects, now or in the future, as well.

Supply chain attacks are a real threat to open source projects. The
Linux kernel is not the easiest way to introduce malicious commits.
But other projects like much used pip python modules, npm javascript
modules and ruby gem modules might be less vetted before they accept
commits and that is a serious risk.

Proprietary projects are not immune to supply chain attacks either. An
example is the Encrochat proprietary chat application that was
subjected to a state sponsored supply chain attack last year which
compromised their user's data. Everything that uses automated updates
could be targeted by supply chain attacks.