Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

XZ Backdoor: Times, damned times, and scams

rheaeve.substack.com

Post reply on HN
Print view View original

141–150 of 193 posts

Re: XZ Backdoor: Times, damned times, and scams

#141

Post by asveikau »

dustyharddrive wrote: post #137
jcranmer wrote: post #124

Earlier quoted context omitted.

No need to bother with a tracking image. Just scour the message headers of any message sent in the past--there's decent chance there's a few more dates lurking in those headers, and even an IP address or two.

Headers have the IP address of their mail service.

Years ago they would include the IP of the end user. Gmail and hotmail stopped including that more than a decade ago. But they both used to. I think Gmail stopped this practice years ahead of Hotmail.

I have a relative with mental health problems who lives on the street, and he sometimes writes me from public libraries -- kind of luckily for family members who are concerned about him, the webmail service he uses still includes that info in headers. So I usually know which public library he writes from.

Re: XZ Backdoor: Times, damned times, and scams

#142

Post by someplaceguy »

sihe wrote: post #130
someplaceguy wrote: post #84

Earlier quoted context omitted.

> Isn't 17:27:09 +0300 == 22:27:09 +0800, making the commits just about one hour apart? Yes, and even worse: > Even more damning, on 6 Oct 2022, we see the following: one commit at 21:53:09 +0300 followed by another at 17:00:38 +0800. This is only a difference in a matter of minutes! No, this is a difference of almost 10 hours... Maybe the author inadvertently switched the two analyses? Or maybe the author is just no…

Author here. Thanks for pointing this out – we switched the examples. (although we also are very bad with timezone math at 2 am.)

No problem, all of you are welcome! Very enjoyable article.

Re: XZ Backdoor: Times, damned times, and scams

#143

Post by AnonHP »

hnthrowaway0328 wrote: post #138
bradleyjg wrote: post #52

Earlier quoted context omitted.

What about the daylight savings time and holidays points? How do they line up for Israel?

Israelis usually are off on Fridays so it doesn't match the git commit records.

Israelis are usually off from the evening of Friday (sundown) till the evening of Saturday (sundown) for Shabbat. Where did you get the idea that they’re off on Fridays during daytime?

In this context, middle eastern countries with Islam as the majority religion have the day off on Fridays.

Re: XZ Backdoor: Times, damned times, and scams

#144

Post by naruhodo »

lapcat wrote: post #139
naruhodo wrote: post #131

Earlier quoted context omitted.

I'm in my mid fifties. I rarely start work before 2pm. My colleagues regularly receive emails from me sent after 1am. Are you saying I will grow out of this and become a lark? Or are you saying I will eventually conform, oh wise one?

I'm saying that changing sleep patterns and waking up earlier is a very common effect of aging. https://www.sleepfoundation.org/aging-and-sleep/why-do-older... YMMV but the idea that you can't grow in/out of sleep patterns is empirically false, and I know this from personal experience. For most of my life, I didn't need glasses for reading... until I suddenly did. Bodies change.

I knew most of the stuff in that article. If I wake up at 5am on full alert, mind racing, I read for a couple of hours and then go back to sleep when it's possible. I know that I can't function well on less than 7 hours, so I don't try.

The article seems to be taking about people on the verge of entering "the facility", on their slow slide into dementia, who are making do despite not getting enough sleep. I'll get back to you when I hit 70.

Re: XZ Backdoor: Times, damned times, and scams

#145

Post by yencabulator »

transpute wrote: post #78
FredFS456 wrote: post #68

Earlier quoted context omitted.

Mullvad accepts cash in an envelope with no return address, good luck tracing that

Postal mail has non-zero metadata, e.g. origin can be traced at least to departure postal code.

You seem to assume Mullvad stores something that allows correlating a Mullvad account to a specific incoming envelope.

Or that they store something that allows correlating an IP+time to a Mullvad account.

Re: XZ Backdoor: Times, damned times, and scams

#146

Post by cozzyd »

asveikau wrote: post #141
dustyharddrive wrote: post #137

Earlier quoted context omitted.

Headers have the IP address of their mail service.

Years ago they would include the IP of the end user. Gmail and hotmail stopped including that more than a decade ago. But they both used to. I think Gmail stopped this practice years ahead of Hotmail. I have a relative with mental health problems who lives on the street, and he sometimes writes me from public libraries -- kind of luckily for family members who are concerned about him, the webmail service he uses stil…

When I was a PhD student ips in header were a great way to see if professors I was working with were traveling or not...

Re: XZ Backdoor: Times, damned times, and scams

#147

Post by transpute »

pquki4 wrote: post #133
transpute wrote: post #103

Earlier quoted context omitted.

Most populous US zip code is less than 150K people, https://worldpopulationreview.com/zips

I mean, even if I live in Manhattan, I can easily take a subway train to an area with a different zip code and mail it there. And that's almost the easiest thing you could do -- if you want to hide where the mail is from, it is trivial.

Dense urban areas are often blanketed by a range of spectrum sensors for the purpose of retroactive correlation (e.g Palantir) with other metadata sources.

Re: XZ Backdoor: Times, damned times, and scams

#148

Post by indrora »

transpute wrote: post #78
FredFS456 wrote: post #68

Earlier quoted context omitted.

Mullvad accepts cash in an envelope with no return address, good luck tracing that

Postal mail has non-zero metadata, e.g. origin can be traced at least to departure postal code.

There's... actually very little that stops you from sending mail from a non-local postal code.

I've occasionally sent packages postmarked as being from one zipcode from another; as long as it's in the same region, much of the postal processing doesn't care so much.

There's also remailers and forwarders.

Re: XZ Backdoor: Times, damned times, and scams

#149

Post by transpute »

yencabulator wrote: post #145
transpute wrote: post #78

Earlier quoted context omitted.

Postal mail has non-zero metadata, e.g. origin can be traced at least to departure postal code.

You seem to assume Mullvad stores something that allows correlating a Mullvad account to a specific incoming envelope. Or that they store something that allows correlating an IP+time to a Mullvad account.

Correlation is about combining metadata to incrementally narrow datasets.

When a VPN provider isn't cooperative, metadata can be sought upstream.

Mullvad deserves much credit for accepting non-digital payments, which increases the cost of deanonymization.

Re: XZ Backdoor: Times, damned times, and scams

#150

Post by DrTung »

akira2501 wrote: post #114
lucb1e wrote: post #92

Earlier quoted context omitted.

From my point of view, from what we know today, it is bigger than Stuxnet because: Stuxnet : aimed to delay one nuclear facility that was still being built SSH pre-auth RCE : root access to most servers on the planet, impacting everyone from hobbyist self-hosters (that's me) to large businesses (of every type imaginable) to probably even some of the security agencies around the world. With SSH's track record, a lot o…

It's not clear that the distribution mechanism and many of the other requirements would be so broadly met that "access to most servers on the internet" is a correct description of the scope. Or that, once in the wild, that the author would have their pick of the litter when choosing targets. It's also true that the exploit has several kill switches in it, and so even vulnerable servers could be protected by simply se…

Since they would have "their pick of the litter" why did they then include kill switches? A scary scenario is a rerun of the Viasat hack https://en.wikipedia.org/wiki/Viasat_hack I.e. wipe all servers worldwide at the morning of an attack, but before that you install the kill switches on your servers and those of your allies.
Post reply on HN