Re: Malicious commits to Linux kernel as part of university study

[Silas <silas.cutler () blacklistthisdomain com>]

Hello,

They issued a clarification as well:
https://www-users.cs.umn.edu/~kjlu/papers/clarifications-hc.pdf

- S



On 4/22/21 12:25 PM, Marcus Meissner wrote:
> Hi,
>
> to follow the "give complete content" requirement, here their statement on their website:
>
> https://cse.umn.edu/cs/statement-cse-linux-kernel-research-april-21-2021
>
> "
> Statement from CS&E on Linux Kernel research - April 21, 2021
>
> Leadership in the University of Minnesota Department of Computer Science & Engineering learned today about the 
> details of research being conducted by one of its faculty members and graduate students into the security of the 
> Linux Kernel. The research method used raised serious concerns in the Linux Kernel community and, as of today, this 
> has resulted in the University being banned from contributing to the Linux Kernel.
>
> We take this situation extremely seriously. We have immediately suspended this line of research. We will investigate 
> the research method and the process by which this research method was approved, determine appropriate remedial 
> action, and safeguard against future issues, if needed. We will report our findings back to the community as soon as 
> practical.
>
> Sincerely,
>
> Mats Heimdahl, Department Head
> Loren Terveen, Associate Department Head
> "
>
> Ciao, Marcus
>
> On Thu, Apr 22, 2021 at 05:11:42PM +0200, Marcus Meissner wrote:
> > Hi,
> >
> > https://twitter.com/UMNComputerSci/status/1384948683821694976
> >
> > Ciao, Marcus
> >
> >
> > On Thu, Apr 22, 2021 at 02:55:03PM +0000, David H wrote:
> > > Has anyone reported this to https://research.umn.edu/ethics-compliance/reporting-research-misconduct ?
> > >
> > >
> > > On 4/22/21, 3:00 AM, "Peter Bex" <peter () more-magic net> wrote:
> > >
> > >     Hi all,
> > >
> > >     Probably a lot of you know this already but I consider it serious enough
> > >     to point out to the OSS security community at large.
> > >
> > >     The university of Minnesota has been banned from making any commits to
> > >     the Linux kernel after it was found out they'd been submitting bogus
> > >     patches to the LKML to knowingly introduce security issues:
> > >     https://lore.kernel.org/linux-nfs/YH%2FfM%2FTsbmcZzwnX () kroah com/
> > >
> > >     They also published a paper:
> > >     https://raw.githubusercontent.com/QiushiWu/qiushiwu.github.io/main/papers/OpenSourceInsecurity.pdf
> > >
> > >     I don't know the scope of this research, but it could involve other OSS
> > >     projects, now or in the future, as well.  Hence this e-mail.  If you feel
> > >     it's spam or needless drama, feel free to ignore.
> > >
> > >     Cheers,
> > >     Peter

Attachment: pEpkey.asc
Description: