It would be interesting to see how the commit timestamps change around time change. If he has a job in a country that observes DST they would likely show an abrupt change.
XZ Backdoor: Times, damned times, and scams
41–50 of 193 posts
Re: XZ Backdoor: Times, damned times, and scams
#42Earlier quoted context omitted.
Sure, but why go to the effort to exclude others? Did they think it would help avoid detection on systems that they didn't care to backdoor?
Obviously it would help avoiding detection since the backdoor has the side effect of slowing down things. So you only target the ones you really want. And to me it's less that they don't care, more that their script probably only works or only has been tested on the ones using .rpm/.deb.
> Obviously it would help avoiding detection since the backdoor has the side effect of slowing down things.
My understanding was that this was the result of a bug? But I understand that part less than any of it, so I well could be wrong.
>And to me it's less that they don't care, more that their script probably only works or only has been tested on the ones using .rpm/.deb.
Now that, strikes me as more likely. Maybe they wanted to be relatively sure that they wouldn't be detected and needed to select a test matrix to test against (SELinux/landlock config across rpm/deb distros, versus across every distro.)
I guess what I'm getting at is... did they have an intended set of targets and knew they were running deb/rpm, on top of any other factors?
Re: XZ Backdoor: Times, damned times, and scams
#43For years I've had `gc` in my terminal mapped to `TZ=UTC0 git commit` for exactly this reason. No need to change system times or git settings. (though perhaps a better way in global config?) It's not even for nefarious reasons. I travel a lot, and don't like leaking my travel itinerary on public repos.
How about this?
alias git='TZ=UTC0 git'Re: XZ Backdoor: Times, damned times, and scams
#44Saying "Eastern Europe" as opposed to "Moscow" is a little coy, isn't it? They're in the same time zone and one seems likelier than the other, to put it one way.
Edit: speaking of, these guys might also have some time pressure at the moment with regards to hacking stuff lol. Kind of fits the bill with what we know about the hack
Re: XZ Backdoor: Times, damned times, and scams
#45FBI could subpoena GitHub for IP addresses.
They probably have/will, though we are unlikely to find out what they get unless they manage to arrest/charge/try him. Jia Tan probably used a vpn though - we know that they did for accessing IRC (source: https://boehs.org/node/everything-i-know-about-the-xz-backdo... )
Most (but not all ) VPN providers keep logs and payment info that are subpoenable. You could use something like Mulvad with Lightning Network payments, but I am not sure that even that is fully anonymous.
The Witopia VPN that he used for IRC [1] is US based: https://www.personalvpn.com/contact-us/ and they don't mention neither LN payments nor not keeping logs.
1. "~jiatan@185.128.24.163" https://boehs.org/node/everything-i-know-about-the-xz-backdo...
Re: XZ Backdoor: Times, damned times, and scams
#46I suggest not putting a UTC+8 timezone graph as header image, when the conclusion is he's likely from Eastern Europe (not saying you should put one showing EET timezone instead). I understand that people should read the full article instead of drawing any conclusion from a mere image, but lots of people don't (hence why clickbait works). I also think it's a little tasteless, if not misleading. Disclaimer: I'm a Chine…
It seems no more misleading than Jia Tan assuming an identity based on git commit timestamps…
Re: XZ Backdoor: Times, damned times, and scams
#47I dont know what the XZ backdoor is about but, to assume someone putting backdoors into software would work usual working days and hours has to be very naïve. The whole premise of the article is based on a false assumption IMO.
If you’ve missed probably the largest cyber security story since stuxnet, and arguably bigger than that, I suggest you start looking at the last few days. Start here. https://news.ycombinator.com/item?id=39865810
> arguably bigger than that
That’s a stretch. Stuxnet was the first acknowledged state cyber attack, utilized multiple zero days, and destroyed nuclear weapons manufacturing facilities. Bigger in scope sure, but bigger unconditionally? I don’t know about that.
Re: XZ Backdoor: Times, damned times, and scams
#48I don't think he was from Eastern Europe, but if you want to look at UTC+0200/+0300, in Europe this only includes Finland, Baltics, Ukraine, Romania, Moldavia, and Greece. But notably if you look a bit down it also includes a good chunk of the Middle East, including Israel.
[deleted]
Re: XZ Backdoor: Times, damned times, and scams
#49Saying "Eastern Europe" as opposed to "Moscow" is a little coy, isn't it? They're in the same time zone and one seems likelier than the other, to put it one way. Edit: speaking of, these guys might also have some time pressure at the moment with regards to hacking stuff lol. Kind of fits the bill with what we know about the hack
Moscow is UTC+3 year round, not UTC+2 in winter and +3 in summer
Re: XZ Backdoor: Times, damned times, and scams
#50> Generally, anonymity in the free software sphere is a good thing: software is inherently based on accomplishment and merit, and there is no reason to know anything about a person’s identity. This is an interesting take. Most software engineers I know love to show off their FOSS contributions. It's a place to do what _you_ want to do, free of budgets and MBA interference. I guess in certain parts of the world you pr…
I think personality matters a lot here. One person may flaunt their open source contributions to their colleagues because they like the kudos. Another person may quietly commit and never publicize themselves because they don’t like being the center of attention. Both can even be true of the same person at different points in their careers!