Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The xz backdoor thing reminds me of a story

rigor-mortis.nmrc.org

Post reply on HN
Print view View original

41–50 of 99 posts

Re: The xz backdoor thing reminds me of a story

#41

Post by skywhopper »

datascienced wrote: post #37
gumby wrote: post #31

Earlier quoted context omitted.

Pretty common in the US back then. Direct deposit is (still) only required to be provided at the company's bank, though I doubt anyone implements that minimum any more. Back in the 90s when I worked for Atari (Back in the terrible Warner period) you could only get DD at the company's bank, which was a small bank with one branch, in Sunnyvale (surely the company had another bank or two as well?). I was told they did t…

It must be bad if you are using your employees as a short term LOC. An inverse payday loan.

Not really. More like, “we could make an extra hundred bucks a week by doing X”. So they do X. If it’s annoying to the employees, that cost is not considered.

Re: The xz backdoor thing reminds me of a story

#42

Post by XorNot »

palijer wrote: post #35
NelsonMinar wrote: post #33

Earlier quoted context omitted.

I don't understand this. You go through all this trouble to build a fake identity and then you don't do this one simple thing to make sure you look like a real employee?

Why go through the risk of trying to deposit a cheque when the plan worked perfectly fine as is? Once you get banks involved, seems like more of a risk of something getting flagged there rather than someone in payroll noticing cheques weren't deposited within the time you were there.

People with fake identities because they're working as a spy have real bank accounts. But more importantly, cheque-cashing places give a god-awful return but would still look more legitimate then just not ever cashing anything.

In short: the details of this story make no sense for the implied narrative (spy). They make a lot of sense for "not mentally well person" or "guy who suddenly had to disappear for other reasons". Combined with just "regular software developer things".

For example - I've cloned the entire git repository server of every place I've ever worked at. I have a script which does it for Github and Gitlab, because usually when you're exploring a codebase you wind up needing just "every repo" and it's easier to dump it all in a folder on my work machine ahead of time. I've run "find" on a network share because have you ever tried to figure out where a particular word document might be after looking through 10+ years of random SMB share naming systems and empty folders?

Read the stories of long-term agents from the Cold War - for both sides, but Russians in America is easier to find the stories of. Spies don't act secretive, spies blend by acting normal. They're an unremarkable next door neighbor who never draws any attention and works a respectable job. They're polite to their neighbors but keep to themselves, they do things on time and promptly, they have identities that check out and do normal things like "get paid from a regular job".

Whereas people absolutely can and do simply ghost jobs all the time. Like a simple explanation here for this guy would be "was actually an illegal immigrant and someone told him that going from contractor to full time employee might be too much exposure, got spooked and bailed". Probably was just an actual software developer. And if you here "illegal immigrant" and think "Mexican" you're also wrong - plenty of people overstay or exceed the bounds of their visas in the US.

P.S. "contributed a large number of commits to the project he was assigned to" - you know, as would be expected when you're hired to work on something? What was in those commits? Why is it omitted from the story?

Re: The xz backdoor thing reminds me of a story

#43

Post by skywhopper »

eddd-ddde wrote: post #40
noduerme wrote: post #39

Earlier quoted context omitted.

I'm a tech contractor. I prefer payment by check from my clients. Most can't or don't want to set up direct deposit for a part time contractor. Amounts are too large for Zelle, and I don't want to pay the fees for paypal or credit card processing if I can avoid it. My clients usually issue paper checks online. Their bank prints the check and mails it. My receiving address is my bank, which deposits checks for me when…

That is so weird. What is there to set-up about deposit? Can't they just input your account number and send you your money?

It’s even easier to do it the way described. The banks are printing and mailing and processing the checks, which they can do with high efficiency. From the payor’s pov, it’s easier not to worry about tracking account numbers and just using the address which they already know.

And the payee doesn’t need to share their bank info.

Re: The xz backdoor thing reminds me of a story

#44

Post by userbinator »

freeone3000 wrote: post #19
Aaargh20318 wrote: post #13

Earlier quoted context omitted.

They can’t forge a chipped passport unless they somehow got hold of the private key for the country’s CSCA certificate.

Why would you need to? Passports are not required to hire a person; most americans don’t even have one.

Nor citizens of many other countries; passports are mainly for out-of-country travel purposes.

Re: The xz backdoor thing reminds me of a story

#45

Post by jabiko »

noduerme wrote: post #39
astrange wrote: post #9

Earlier quoted context omitted.

You don't have to give your employer a bank account number, but they still have to pay you. Quite unusual for a tech contractor though.

I'm a tech contractor. I prefer payment by check from my clients. Most can't or don't want to set up direct deposit for a part time contractor. Amounts are too large for Zelle, and I don't want to pay the fees for paypal or credit card processing if I can avoid it. My clients usually issue paper checks online. Their bank prints the check and mails it. My receiving address is my bank, which deposits checks for me when…

Maybe I'm a bit to naive since I don't know the US banking system, but at least in the EU you just need to tell someone your IBAN and Name and they can transfer money to your account. Is it that much harder in the US?

Re: The xz backdoor thing reminds me of a story

#46

Post by deathanatos »

Most of the details are out there but …

> in that he had apparently downloaded a copy of everything

… is a day in the office? I've done this, particularly at places that are "one repo == one project" organized (i.e., not monorepo): e.g., if I make a breaking change to a library, I'm going to update all the uses of that. Still to this day, the easiest way to do that is locally, with command line tooling.

Re: The xz backdoor thing reminds me of a story

#47

Post by ta1243 »

Aaargh20318 wrote: post #13
greyface- wrote: post #8

Earlier quoted context omitted.

Intelligence agencies can presumably mint valid SSNs along with other identity documents to use in situations like this.

They can’t forge a chipped passport unless they somehow got hold of the private key for the country’s CSCA certificate.

You can create a forged chipped passport, just have the chip not work. Won't work at the border, but would be fine everywhere else you show a passport. I've never had anyone (bars, hotels etc) read a chip.

Re: The xz backdoor thing reminds me of a story

#49

Post by eddd-ddde »

skywhopper wrote: post #43
eddd-ddde wrote: post #40

Earlier quoted context omitted.

That is so weird. What is there to set-up about deposit? Can't they just input your account number and send you your money?

It’s even easier to do it the way described. The banks are printing and mailing and processing the checks, which they can do with high efficiency. From the payor’s pov, it’s easier not to worry about tracking account numbers and just using the address which they already know. And the payee doesn’t need to share their bank info.

Surely a check takes longer, right? "Printing, mailing and processing" doesn't quite scream efficiency to me.

Re: The xz backdoor thing reminds me of a story

#50

Post by jmb99 »

magicalhippo wrote: post #24
astrange wrote: post #9

Earlier quoted context omitted.

You don't have to give your employer a bank account number, but they still have to pay you. Quite unusual for a tech contractor though.

> You don't have to give your employer a bank account number As a Norwegian that sounds so alien. They couldn't do anything but deposit money, so why wouldn't you?

At least in Canada, the numbers provided for direct deposit are the same numbers used for direct/pre-authorized debit (i.e. withdrawals). So, while your employer likely wouldn’t abuse that information? People may be wary of giving out those numbers unless absolutely necessary, since someone could indeed drain their bank account. They’re also the same numbers that appear on cheques, so someone could easily forge a cheque in your name with those numbers.
Post reply on HN