TY - GEN A1 - Ramsauer, Ralf A1 - Duda, Sebastian A1 - Mauerer, Wolfgang A1 - Bulwahn, Lukas T1 - The list is our process: An analysis of the kernel’s email-based development process T2 - Linux Plumbers Conference, Lisbon September 9, 2019 Y1 - 2019 UR - https://www.youtube.com/watch?v=QG1YDQ1HOKE ER - TY - GEN A1 - Ramsauer, Ralf A1 - Duda, Sebastian A1 - Bulwahn, Lukas A1 - Mauerer, Wolfgang T1 - The list is our process! An analysis of the kernel’s email-based development process T2 - Embedded Linux Conference Europe, Lyon 28.10.2019 Y1 - 2019 UR - https://elinux.org/images/0/09/Pasta-elce19.pdf ER - TY - CHAP A1 - Ramsauer, Ralf A1 - Bulwahn, Lukas A1 - Lohmann, Daniel A1 - Mauerer, Wolfgang ED - Zhang, Yinqian ED - Sion, Radu T1 - The Sound of Silence : Mining Security Vulnerabilities from Secret Integration Channels in Open-Source Projects T2 - Proceedings of the 2020 ACM SIGSAC Conference on Cloud Computing Security Workshop: 09.11.2020, virtual event N2 - Public development processes are a key characteristic of open source projects. However, fixes for vulnerabilities are usually discussed privately among a small group of trusted maintainers, and integrated without prior public involvement. This is supposed to prevent early disclosure, and cope with embargo and non-disclosure agreement (NDA) rules. While regular development activities leave publicly available traces, fixes for vulnerabilities that bypass the standard process do not. We present a data-mining based approach to detect code fragments that arise from such infringements of the standard process. By systematically mapping public development artefacts to source code repositories, we can exclude regular process activities, and infer irregularities that stem from non-public integration channels. For the Linux kernel, the most crucial component of many systems, we apply our method to a period of seven months before the release of Linux 5.4. We find 29 commits that address 12 vulnerabilities. For these vulnerabilities, our approach provides a temporal advantage of 2 to 179 days to design exploits before public disclosure takes place, and fixes are rolled out. Established responsible disclosure approaches in open development processes are supposed to limit premature visibility of security vulnerabilities. However, our approach shows that, instead, they open additional possibilities to uncover such changes that thwart the very premise. We conclude by discussing implications and partial countermeasures. Y1 - 2020 SN - 9781450380843 U6 - https://doi.org/10.1145/3411495.3421360 SP - 147 EP - 157 PB - ACM CY - New York, NY, USA ER - TY - GEN A1 - Ramsauer, Ralf A1 - Bulwahn, Lukas A1 - Lohmann, Daniel A1 - Mauerer, Wolfgang T1 - The Sound of Silence: Mining Security Vulnerabilities from Secret Integration Channels in Open-Source Projects T2 - MiniDebConf Regensburg (MDC) 2021 Y1 - 2021 UR - https://gemmei.ftp.acc.umu.se/pub/debian-meetings/2021/MiniDebConf-Regensburg/sound-of-silence.webm CY - Regensburg ER -