XZ Backdoor: Times, damned times, and scams
rheaeve.substack.com
XZ Backdoor: Times, damned times, and scams
1–10 of 193 posts
Re: XZ Backdoor: Times, damned times, and scams
#2[deleted]
Re: XZ Backdoor: Times, damned times, and scams
#3One of Jia’s followers on GitHub is form Eastern Europe.
Edit: it’s a meme. Apparently. I feel like an old man.
> illia-git This user is suspected to be a part of an online ransomware organization. Please report any suspicious activity to GitHub security. Poland
Re: XZ Backdoor: Times, damned times, and scams
#4FBI could subpoena GitHub for IP addresses.
Re: XZ Backdoor: Times, damned times, and scams
#5Shame on me for not reading more before my now removed comment. Shout-out for doing this level of analysis and guessing, as with everything in this incident, fascinating and tantalizing to wonder about.
It is interesting, at least one of the things listed as suspicious is something I do with some frequency. I will sometimes work on what is logically three commits and not chunk them out until the very end.
A bit random, but has there been speculation on why this seemed to only target rpm/deb packaging?
Re: XZ Backdoor: Times, damned times, and scams
#6FBI could subpoena GitHub for IP addresses.
Considering what the account was up to I sincerely doubt it was being used without Tor or a VPN.
Re: XZ Backdoor: Times, damned times, and scams
#7[dead]
Re: XZ Backdoor: Times, damned times, and scams
#8FBI could subpoena GitHub for IP addresses.
They probably have/will, though we are unlikely to find out what they get unless they manage to arrest/charge/try him.
Jia Tan probably used a vpn though - we know that they did for accessing IRC (source: https://boehs.org/node/everything-i-know-about-the-xz-backdo...)
Re: XZ Backdoor: Times, damned times, and scams
#9FBI could subpoena GitHub for IP addresses.
Considering what the account was up to I sincerely doubt it was being used without Tor or a VPN.
This article asserts some opsec failures - time zones switching when they shouldn’t etc.
It’s quite plausible that they didn’t manage perfect vpn usage every single time.
Re: XZ Backdoor: Times, damned times, and scams
#10One of Jia’s followers on GitHub is form Eastern Europe. Edit: it’s a meme. Apparently. I feel like an old man. > illia-git This user is suspected to be a part of an online ransomware organization. Please report any suspicious activity to GitHub security. Poland
The message is a custom status, and probably a reference to a Discord meme:
https://knowyourmeme.com/memes/discord-user-is-a-suspected-t...