Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

XZ Backdoor: Times, damned times, and scams

rheaeve.substack.com

Post reply on HN
Print view View original

111–120 of 193 posts

Re: XZ Backdoor: Times, damned times, and scams

#111

Post by cozzyd »

asveikau wrote: post #90
krick wrote: post #86

Earlier quoted context omitted.

Yes, that's what I mean as well: I don't really think this analysis is any near to be considered any conclusive. It's interesting . But this is it. From what I'm seeing, there really isn't very much data. The article makes it feel like there is this huge archive of commits, that draws a picture of a guy working almost every day on these projects with some very much visible gaps in time, but there really isn't. The da…

Somebody on another HN thread pointed out he used Gmail, so google has something too. I think I saw somewhere a claim that somebody confirmed he used a VPN, I'm can't recall how they did that.

Anyone try emailing with a tracking image?

Re: XZ Backdoor: Times, damned times, and scams

#112

Post by lapcat »

jtuple wrote: post #108
lapcat wrote: post #37

> who regularly works in the early morning? Me > For a hacker, it is much more plausible to work in the afternoon and late at night c/hacker/younger person

The "hacker" stereotype is certainly stale, but subbing "young person" (and implying not "old person") is equally silly. I'm 41 and have been awake before 7am maybe 20 times in the past 10 years. Half the reason I still put up with computers is because it's one of the few professions where I can work a 11-7pm schedule most days and still excel. There are morning people and night people. You are what you are, no judge…

> There are morning people and night people. You are what you are, no judgements, but it isn't something you grow in/out of, nor should be expected to.

Oh, my sweet summer child.

Talk to me again in another decade or so.

Re: XZ Backdoor: Times, damned times, and scams

#113

Post by asveikau »

cozzyd wrote: post #111
asveikau wrote: post #90

Earlier quoted context omitted.

Somebody on another HN thread pointed out he used Gmail, so google has something too. I think I saw somewhere a claim that somebody confirmed he used a VPN, I'm can't recall how they did that.

Anyone try emailing with a tracking image?

I'm sure this guy is not checking his email after being exposed.

Re: XZ Backdoor: Times, damned times, and scams

#114

Post by akira2501 »

lucb1e wrote: post #92
vsnf wrote: post #47

Earlier quoted context omitted.

> arguably bigger than that That’s a stretch. Stuxnet was the first acknowledged state cyber attack, utilized multiple zero days, and destroyed nuclear weapons manufacturing facilities. Bigger in scope sure, but bigger unconditionally? I don’t know about that.

From my point of view, from what we know today, it is bigger than Stuxnet because: Stuxnet : aimed to delay one nuclear facility that was still being built SSH pre-auth RCE : root access to most servers on the planet, impacting everyone from hobbyist self-hosters (that's me) to large businesses (of every type imaginable) to probably even some of the security agencies around the world. With SSH's track record, a lot o…

It's not clear that the distribution mechanism and many of the other requirements would be so broadly met that "access to most servers on the internet" is a correct description of the scope.

Or that, once in the wild, that the author would have their pick of the litter when choosing targets. It's also true that the exploit has several kill switches in it, and so even vulnerable servers could be protected by simply setting an environment variable.

Which, honestly, makes this entire attack all the more strange. It had incredibly unclear value and longevity. It makes me wonder if the author didn't have different, parallel aims, or if this wasn't a type of practice run for a larger attack in the future.

Re: XZ Backdoor: Times, damned times, and scams

#115

Post by tgsovlerkhgsel »

Sophira wrote: post #64

I would remind people that it is not difficult at all to have someone's sleep schedule match another country, particularly when we're dealing with what seems to be a state-sponsored attack. Times are a red herring - don't be fooled.

And yet in many clearly-attributed cases the times lined up with the attacking country's office hours.

Re: XZ Backdoor: Times, damned times, and scams

#116

Post by SmartHypercube »

BluSyn wrote: post #33

For years I've had `gc` in my terminal mapped to `TZ=UTC0 git commit` for exactly this reason. No need to change system times or git settings. (though perhaps a better way in global config?) It's not even for nefarious reasons. I travel a lot, and don't like leaking my travel itinerary on public repos.

I have been using a small tool I made to hide the time information in my git commits: https://github.com/SmartHypercube/git-date-truncate

It not only sets the timezone to UTC, but also sets the time to 00:00. So my commits will only have date information. I think only saving the date permanently in the git commit is good enough. No need to leak the precise time I made commits.

Re: XZ Backdoor: Times, damned times, and scams

#117

Post by bombcar »

ufmace wrote: post #85

Probably worth considering here - if this was a state-sponsored attack, it's entirely possible (and exactly what I would do if I was running such a program) that there is one person or department actually writing the code and list messages etc, and another person or team who sits between that department and the internet and whose entire job is to ensure that everything that comes out from the development team takes p…

Exactly. Once you assume that it’s more than “a lone wolf/single guy” many more things become possible.

Including carefully curating things to appear in a location and to NOT appear to be more than one person.

Re: XZ Backdoor: Times, damned times, and scams

#119

Post by bombcar »

77pt77 wrote: post #107
thrdbndndn wrote: post #24

I suggest not putting a UTC+8 timezone graph as header image, when the conclusion is he's likely from Eastern Europe (not saying you should put one showing EET timezone instead). I understand that people should read the full article instead of drawing any conclusion from a mere image, but lots of people don't (hence why clickbait works). I also think it's a little tasteless, if not misleading. Disclaimer: I'm a Chine…

export TZ=Z will just tag all your commits in UTC. Just a heads up for the next guy...

Write a script to select a (random) time zone so all your commits are within an hour of noon local time zone time :)

Re: XZ Backdoor: Times, damned times, and scams

#120

Post by jamebond »

mik1998 wrote: post #32

I don't think he was from Eastern Europe, but if you want to look at UTC+0200/+0300, in Europe this only includes Finland, Baltics, Ukraine, Romania, Moldavia, and Greece. But notably if you look a bit down it also includes a good chunk of the Middle East, including Israel.

Tukaani is a Finnish organisation primarily contributed to by Finnish people. You look at the contributors and almost all of them have Finnish names.

Seems to check out to me.

Post reply on HN