Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

XZ Backdoor: Times, damned times, and scams

rheaeve.substack.com

Post reply on HN
Print view View original

81–90 of 193 posts

Re: XZ Backdoor: Times, damned times, and scams

#82

Post by sureglymop »

s_Hogg wrote: post #44

Saying "Eastern Europe" as opposed to "Moscow" is a little coy, isn't it? They're in the same time zone and one seems likelier than the other, to put it one way. Edit: speaking of, these guys might also have some time pressure at the moment with regards to hacking stuff lol. Kind of fits the bill with what we know about the hack

Why? There would be a number of plausible location based on the time zones. Just asking why you would make that conclusion in terms of rationality.

Re: XZ Backdoor: Times, damned times, and scams

#83

Post by ufo »

bradleyjg wrote: post #52
mik1998 wrote: post #32

I don't think he was from Eastern Europe, but if you want to look at UTC+0200/+0300, in Europe this only includes Finland, Baltics, Ukraine, Romania, Moldavia, and Greece. But notably if you look a bit down it also includes a good chunk of the Middle East, including Israel.

What about the daylight savings time and holidays points? How do they line up for Israel?

I don't know all the holidays but they have commits on Yom Kippur dates in 2021 and 2022. For 2023 it's harder to say because their commit activity is sparser.

Re: XZ Backdoor: Times, damned times, and scams

#84

Post by someplaceguy »

qiqitori wrote: post #53

> Notably, on Tuesday, Jun 27, 2023, we see two commits: 23:38:32 +0800 and 17:27:09 +0300. If we do the math, there is about a 9-hour difference between the two commits. Isn't 17:27:09 +0300 == 22:27:09 +0800, making the commits just about one hour apart?

> Isn't 17:27:09 +0300 == 22:27:09 +0800, making the commits just about one hour apart?

Yes, and even worse:

> Even more damning, on 6 Oct 2022, we see the following: one commit at 21:53:09 +0300 followed by another at 17:00:38 +0800. This is only a difference in a matter of minutes!

No, this is a difference of almost 10 hours...

Maybe the author inadvertently switched the two analyses? Or maybe the author is just not very good with timezone math... :)

Re: XZ Backdoor: Times, damned times, and scams

#85

Post by ufmace »

Probably worth considering here - if this was a state-sponsored attack, it's entirely possible (and exactly what I would do if I was running such a program) that there is one person or department actually writing the code and list messages etc, and another person or team who sits between that department and the internet and whose entire job is to ensure that everything that comes out from the development team takes place at actual times and with timestamps that are consistent with whatever story they're using for the project. Possibly even once in a while intentionally inserting a "mistake" to hint to investigators that the person's real location is another chosen place, which is also different from the real place where the project is being run.

Re: XZ Backdoor: Times, damned times, and scams

#86

Post by krick »

asveikau wrote: post #71
krick wrote: post #63

Earlier quoted context omitted.

If the only think I knew was UTC+2 (and I don't even think I know that, I'm really cautious with assumptions about what mistakes that kind of people plausibly make), Israel would be very high on the list. But FWIW, 25Dec is a Catholic holiday, and even though it's mentioned on Wikipedia page about Israel holidays, I'm not sure how official that is. I mean, it doesn't seems to be, like, a real Israeli holiday.

I think no commits on December 25 is not enough to go by. He's been active for about 2 years, so that's what, 1-2 Christmases? I assume he doesn't commit literally every day. So it could be a coincidence that he didn't on those particular 1-2 days. Also, in many Orthodox Christian majority countries including those in UTC+2 they don't celebrate on 12/25. But doesn't Israel also not follow a typical work week? Eg. No…

Yes, that's what I mean as well: I don't really think this analysis is any near to be considered any conclusive. It's interesting. But this is it. From what I'm seeing, there really isn't very much data. The article makes it feel like there is this huge archive of commits, that draws a picture of a guy working almost every day on these projects with some very much visible gaps in time, but there really isn't. The data is quite scarce. I would need to actually do the analysis myself to decide what I'm willing to believe, and I don't think I want to do this right now. But for now, I don't think we really have anything.

…What I would really want is some input from Microsoft. I don't know what they can reveal, but I believe they must have quite a bit more data, than us. Even speaking about times, well, he must have been using Github more than to just commit stuff. And I'd imagine they have some logs. Also, it's very fair to assume than he was using VPN all the time, but it's also fair to assume that he wouldn't accidentally slip like that, revealing his real time zone in 9 commits. So, yeah, for sure there are people who have waay more data than me, and probably know how to use it properly better than me too. Not sure they will be willing to share, though.

Re: XZ Backdoor: Times, damned times, and scams

#90

Post by asveikau »

krick wrote: post #86
asveikau wrote: post #71

Earlier quoted context omitted.

I think no commits on December 25 is not enough to go by. He's been active for about 2 years, so that's what, 1-2 Christmases? I assume he doesn't commit literally every day. So it could be a coincidence that he didn't on those particular 1-2 days. Also, in many Orthodox Christian majority countries including those in UTC+2 they don't celebrate on 12/25. But doesn't Israel also not follow a typical work week? Eg. No…

Yes, that's what I mean as well: I don't really think this analysis is any near to be considered any conclusive. It's interesting . But this is it. From what I'm seeing, there really isn't very much data. The article makes it feel like there is this huge archive of commits, that draws a picture of a guy working almost every day on these projects with some very much visible gaps in time, but there really isn't. The da…

Somebody on another HN thread pointed out he used Gmail, so google has something too.

I think I saw somewhere a claim that somebody confirmed he used a VPN, I'm can't recall how they did that.

Post reply on HN