News for hackers. Stuff that matters.
Re:“They introduce kernel bugs on purpose” by motohagiography on Wednesday April 21, 2021 @10:56AM (#26890485)
On the other thread, I suggested this was an attack on critical infrastructure using a university as cover and that this was a criminal/counter-intellgence matter, and then asked whether any of these bug submitters also suggested the project culture was too aggressive and created an unsafe environment, to reduce scrutiny on their backdoors.

Talk about predictive power in a hypothesis.

Re:“They introduce kernel bugs on purpose” by CoolGuySteve on Wednesday April 21, 2021 @12:16PM (#26891615)
Given its ubiquity in so many industries, tampering with Linux kernel security sounds an awful lot like criminal sabotage under US law.

Getting banned from contributing is a light penalty.

Re:“They introduce kernel bugs on purpose” by _n_b_ on Wednesday April 21, 2021 @12:32PM (#26891855)
> criminal sabotage under US law

It is pretty comfortably not sabotage under 18 USC 105, which requires proving intent to harm the national defense of the United States. Absent finding an email from one of the researchers saying "this use-after-free is gonna fuck up the tankz," intent would otherwise be nearly impossible to prove.

Re:“They introduce kernel bugs on purpose” by dragonwriter on Wednesday April 21, 2021 @12:42PM (#26891997)
> It is pretty comfortably not sabotage under 18 USC 105, which requires proving intent to harm the national defense of the United States.

Presumably, this reference is intended to be to 18 USC ch. 105 (18 USC §§ 2151-2156). However, the characterization of required intent is inaccurate; the most relevant provision (18 USC § 2154) doesn’t require intent if the defendant has “reason to believe that his act may injure, interfere with, or obstruct the United States or any associate nation in preparing for or carrying on the war or defense activities” (emphasis added) during either a war or declared national emergency.

It wouldn’t take much more than showing evidence that the defendant was aware (or even was in a position likely to be exposed to information that would make him aware) that Linux is used somewhere in the defense and national security establishment to support the mental state aspect of the offense.

https://www.law.cornell.edu/uscode/text/18/2154

Re:“They introduce kernel bugs on purpose” by LinuxBender on Wednesday April 21, 2021 @12:46PM (#26892054)
Intent would be hard to prove without emails / chat conversations for sure. As for damages, Linux is used by DoD, NASA and a myriad of other agencies. All the 2 and 3 letter agencies use it. Some of them contribute to it.
Re:“They introduce kernel bugs on purpose” by rvba on Wednesday April 21, 2021 @01:21PM (#26892612)
If congress wasn't full of old people who don't understand computers, that university professor could spend years in jail or be executed for treason.
Re:“They introduce kernel bugs on purpose” by webinvest on Wednesday April 21, 2021 @12:20PM (#26891682)
Either that or the CFAA
Re:“They introduce kernel bugs on purpose” by andrewzah on Wednesday April 21, 2021 @12:04PM (#26891443)
"I suggested this was an attack on critical infrastructure using a university as cover and that this was a criminal/counter-intellgence matter"

There is absolutely zero evidence of this. None. In my opinion it's baseless speculation.

It's far more likely that they are upset over being called out, and are out of touch with regards as to what is ethical testing.

Re:“They introduce kernel bugs on purpose” by mratsim on Wednesday April 21, 2021 @12:09PM (#26891522)
Sure, don't attribute to malice what can be attributed to ignorance. But you have to admit that backdooring Linux would be huge and worth billions.
Re:“They introduce kernel bugs on purpose” by webinvest on Wednesday April 21, 2021 @12:19PM (#26891651)
Yes, Hanlon’s razor is apt but if you read TFA, you can see heavy amounts of both malice and ignorance.

From TFA: “The UMN had worked on a research paper dubbed "On the Feasibility of Stealthily Introducing Vulnerabilities in Open-Source Software via Hypocrite Commits". Obviously, the "Open-Source Software" (OSS) here is indicating the Linux kernel and the University had stealthily introduced Use-After-Free (UAF) vulnerability to test the susceptibility of Linux.”

Re:“They introduce kernel bugs on purpose” by SuoDuanDao on Wednesday April 21, 2021 @02:50PM (#26893894)
GP had a hypothesis and made a prediction based on it. The prediction turned out to be right. What more do you want?
Re:“They introduce kernel bugs on purpose” by andrewzah on Wednesday April 21, 2021 @03:04PM (#26894046)
I want proof that the motive was in any way, shape, or form, related to or sponsored by a foreign government under the cover of university research. Not speculation based -solely- on the nationality or ethnicity of the accused.
Re:“They introduce kernel bugs on purpose” by SuoDuanDao on Wednesday April 21, 2021 @03:58PM (#26894647)
With the utmost possible respect, 'criminal or counterintelligence' in no way implies the involvement of a foreign government, and trying to allege racism on such flimsy grounds is a rhetorical tactic well past it's sell-by date.
Re:“They introduce kernel bugs on purpose” by motohagiography on Wednesday April 21, 2021 @03:49PM (#26894527)
What is their ethnicity? I just assumed they were all American citizens. My previous comment included how U.S. based attackers alleged they did something similar to openbsd's VPN libraries over a decade ago.

Suggesting a foreign government could be leaping to conclusions as well, given domestic activists with an agenda may do the same thing. A linux kernel backdoor is valuable to a lot of different interests. Hence why counter-intelligence should be involved.

However, I just looked at the names of the people involved and I don't know. Even if they were Taiwanese, that's an allied country, so I wouldn't expect it. Who were you thinking of?