[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAEo4CePqice09K5PPhmxwwF3jg=USrqRqM5FgVX_jCB8sZfDeA@mail.gmail.com>
Date: Thu, 22 Apr 2021 11:44:49 +0200
From: Albert Veli <albert.veli@...il.com>
To: Open Source Security <oss-security@...ts.openwall.com>
Subject: Re: Malicious commits to Linux kernel as part of
university study
Hi
On Thu, Apr 22, 2021 at 9:01 AM Peter Bex <peter@...e-magic.net> wrote:
>
> They also published a paper:
> https://raw.githubusercontent.com/QiushiWu/qiushiwu.github.io/main/papers/OpenSourceInsecurity.pdf
>
> I don't know the scope of this research, but it could involve other OSS
> projects, now or in the future, as well.
Supply chain attacks are a real threat to open source projects. The
Linux kernel is not the easiest way to introduce malicious commits.
But other projects like much used pip python modules, npm javascript
modules and ruby gem modules might be less vetted before they accept
commits and that is a serious risk.
Proprietary projects are not immune to supply chain attacks either. An
example is the Encrochat proprietary chat application that was
subjected to a state sponsored supply chain attack last year which
compromised their user's data. Everything that uses automated updates
could be targeted by supply chain attacks.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
