Setting aside the gravity of the situation, I'm 100% gripped by the "mystery novel" side of this. Seeing the internet piecing together the Who? the How? an the Why? is fascinating.
[deleted]
XZ Backdoor: Times, damned times, and scams
121–130 of 193 posts
Re: XZ Backdoor: Times, damned times, and scams
#122Probably worth considering here - if this was a state-sponsored attack, it's entirely possible (and exactly what I would do if I was running such a program) that there is one person or department actually writing the code and list messages etc, and another person or team who sits between that department and the internet and whose entire job is to ensure that everything that comes out from the development team takes p…
This is the real point.
Re: XZ Backdoor: Times, damned times, and scams
#123GMT+8, the name (Mandarin/mixed-dialect first name + Hokkien surname) and most importantly the circumstance that the user was seen connecting from a likely VPN exit or hosted server in Singapore [1] are all consistent with a Singaporean identity, whether real or cover. For that reason, the opinion of [1]'s source that the name sounds fake should also be taken with some amount of salt (Mainland Chinese are not always…
In the few commits from Jia Tan that I've seen, the English parses (to me at least) idiomatically as a native speaker from either the US or UK, and I did not encounter any signs of Singaporean English. Obviously, this is a very small sample so one cannot read too much into it.
Almost 10% of Singaporeans share the family name Tan. [1]
[1] https://en.wikipedia.org/wiki/File:Singaporean_surnames_by_f...
Re: XZ Backdoor: Times, damned times, and scams
#124Earlier quoted context omitted.
Somebody on another HN thread pointed out he used Gmail, so google has something too. I think I saw somewhere a claim that somebody confirmed he used a VPN, I'm can't recall how they did that.
Anyone try emailing with a tracking image?
No need to bother with a tracking image. Just scour the message headers of any message sent in the past--there's decent chance there's a few more dates lurking in those headers, and even an IP address or two.
Re: XZ Backdoor: Times, damned times, and scams
#125Something feels weird about the timezone arithmetic here, though maybe I am nuts. Take this for example: > Notably, on Tuesday, Jun 27, 2023, we see two commits: 23:38:32 +0800 and 17:27:09 +0300. If we do the math, there is about a 9-hour difference between the two commits. Putting it all into UTC we get: 23:38 - 8 = 15:38 17:27 - 3 = 14:27 That's not 9 hours by my numbers. Or another example: > Even more damning, o…
Yes, thanks for pointing this out! As somebody else already speculated, we got the two examples swapped. Already updated the post.
Re: XZ Backdoor: Times, damned times, and scams
#126If you don't have your BIOS clock set to UTC and your OS is expecting it to be, you can get strange behavior like this. If they were switching between Windows and Linux, that could explain some of the offsets.
Re: XZ Backdoor: Times, damned times, and scams
#127Poor Jia. Two whole years of work down the drain. If you're reading this Jia, remember that you miss 100% of the shots you don't take. Chin up, brother.
How is it down the drain? You know he didn't achieve his goals?
Re: XZ Backdoor: Times, damned times, and scams
#128Hi all! One of the authors of the original piece here. Thanks for all your comments – we picked up a lot of cool ideas for future analyses. Just to address four common objections:
- We agree it's unclear whether this was one person, or several ones. But even if it was a team, the timezone idea would still tell us where the team is located (the timings seem too much like regular office hours for a globally distributed team).
- It's also absolutely possible that commit times were changed, or commits were made/uploaded using timed scripts. Still seems like it would be hard in practice to use this to cover up a massive difference in timezone, though, because it would require adding a massive latency -- and xz wasn't developed in a vacuum, but in reaction to other online events like the filing of issues or mailing list posts.
- yes, we did get the two examples mixed up (the two times we say are 10-ish hours apart are actually only minutes apart, and the times we say are minutes apart, are 10-ish hours apart). Update is on the way.
- and finally, yes, UTC+2/3 goes beyond just Eastern Europe and includes part of the Middle East. We also clarified this in an update to the article.
Re: XZ Backdoor: Times, damned times, and scams
#129Giant, fragile, pointless build infrastructure is always suspicious. Just take k8s or any other Go cli utility unable to build directly as it was originally intended back when there was go get and now go install.
Simplicity and clarity translate into security, maintainability, and reliability.
Re: XZ Backdoor: Times, damned times, and scams
#130> Notably, on Tuesday, Jun 27, 2023, we see two commits: 23:38:32 +0800 and 17:27:09 +0300. If we do the math, there is about a 9-hour difference between the two commits. Isn't 17:27:09 +0300 == 22:27:09 +0800, making the commits just about one hour apart?
> Isn't 17:27:09 +0300 == 22:27:09 +0800, making the commits just about one hour apart? Yes, and even worse: > Even more damning, on 6 Oct 2022, we see the following: one commit at 21:53:09 +0300 followed by another at 17:00:38 +0800. This is only a difference in a matter of minutes! No, this is a difference of almost 10 hours... Maybe the author inadvertently switched the two analyses? Or maybe the author is just no…
Author here. Thanks for pointing this out – we switched the examples. (although we also are very bad with timezone math at 2 am.)