Open Stack

On 2021-01-25 18:33:36 +0100 (+0100), Christophe de Dinechin wrote:
[...]
> 2/ PRs that take advantage of the testing infrastructure to
> execute malicious code disguised as unit tests. In a chat with
> Ariel, I described that as a "unit test" doing some bitcoin
> mining. This was the case I was more concerned with in the context
> of a discussion about merging test and code repos. Frankly, I'm
> surprised we don't get more spammers trying to do this kind of
> things, given that our testing infrastructure runs containers as
> well as unit tests that could do practically anything.
> 
> I suspect that what makes this hard today is the relatively low
> traffic in terms of number of PRs. We would notice bad PRs rapidly
> during review.
[...]

Yes, I have a feeling the reason this sort of abuse isn't prevalent
is that it's at least somewhat visible/discoverable, and
attributable to an account which can be easily reported to the
service's operators. As someone who also spends a lot of time
running and maintaining a fairly large public code review and
automated testing platform (one which allows anyone to propose
changes with their own job configuration and runs builds from them
before anyone even reviews the patches), I can say it's something
we're always on the lookout for and prepared to lock down abusive IP
netblocks if necessary to get things under control.

As you pointed out, there's also plenty of lower-hanging fruit when
what you want is raw processing power and you don't care how you get
it. If you operate in network security circles at all you'll be
painfully aware that at any point in time there are millions of
compromised computers connected to the Internet and integrated into
a slew of massive bot armies. But for bitcoin mining in particular
these days, the more effective way to go about it is to just form a
shell company in a part of the world where governments provide
subsidized/free electricity to businesses and hook of giant farms of
ASICs. At worst you may need to grease some palms so a few
bureaucrats look the other way.
-- 
Jeremy Stanley
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <http://lists.katacontainers.io/pipermail/kata-dev/attachments/20210125/171a1990/attachment.sig>