[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <7f70dce9-af6-4c25-5b2f-544f8ccd7ba@gathman.org>
Date: Wed, 8 Apr 2026 12:11:33 -0400 (EDT)
From: Stuart D Gathman <stuart@...hman.org>
To: oss-security@...ts.openwall.com
Subject: Re: Fwd: [siren] Severity: High – Potential Malicious Campaign Underway Targeting Open Source Developers via Slack
On Wed, 8 Apr 2026, Solar Designer wrote:
> Also seen at https://lists.openssf-vuln.org/g/siren/message/7
> Subject: [siren] Severity: High – Potential Malicious Campaign Underway Targeting Open Source Developers via Slack
> # Overview #
> The community has received reports of an active social engineering
> campaign targeting open source developers via Slack (including
> ToDoGroup and related communities). In the reported incident, an
> attacker impersonated a well-known Linux Foundation community leader
> and attempted to lure the victim into following a malicious link:
etc
As listed in this and other recent OSS emails, platforms exploited included
Slack, Teams, Google, etc
The method is to create a convincing fake account on the centralized platform.
Is this a weakness that is aggravated by centralized platforms?
Federated protocols like SMTP, Matrix, XMPP, etc would require a
deceptive domain name (like the legendary lBM.com of Arial font fame)
for a similar attack. (Fully decentralized protocols like SSB
just have pubkeys - but I suppose users might get fooled by a new
pubkey with icons and earlier messages that look like a party
being impersonated.)
Is this evidence for a general recommendation against centralized
platforms for open source development? More to the surprise of
my preconceived ideas - are fully decentralized protocols subject
to similar social engineering? There is not much difference between
a Facebook internal account number and a pubkey for most end users.
The issue with federated protocols is that any trusted CA can forge
any TLS cert - a "serial reliability" problem.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
