What if it is an American (random other place) pretending to be an Eastern European pretending to be Chinese? ;)
If I would be pretending something I'd certainly put at least one more indirection in.
XZ Backdoor: Times, damned times, and scams
51–60 of 193 posts
Re: XZ Backdoor: Times, damned times, and scams
#52I don't think he was from Eastern Europe, but if you want to look at UTC+0200/+0300, in Europe this only includes Finland, Baltics, Ukraine, Romania, Moldavia, and Greece. But notably if you look a bit down it also includes a good chunk of the Middle East, including Israel.
What about the daylight savings time and holidays points? How do they line up for Israel?
Re: XZ Backdoor: Times, damned times, and scams
#53> Notably, on Tuesday, Jun 27, 2023, we see two commits: 23:38:32 +0800 and 17:27:09 +0300. If we do the math, there is about a 9-hour difference between the two commits.
Isn't 17:27:09 +0300 == 22:27:09 +0800, making the commits just about one hour apart?
Re: XZ Backdoor: Times, damned times, and scams
#54I don't think he was from Eastern Europe, but if you want to look at UTC+0200/+0300, in Europe this only includes Finland, Baltics, Ukraine, Romania, Moldavia, and Greece. But notably if you look a bit down it also includes a good chunk of the Middle East, including Israel.
Not sure why you’re downvoted. When you think of state actors, Israel comes very high (stuxnet etc), as well as the usual US/Russia/China/NK groups.
Unit 8200 in the IDF especially have a very notable reputation.
That’s not to say other counties don’t have capabilities (and this doesn’t look like you need the resources of a group like say the NSA or GCHQ for this particular attack - indeed it could just be a single lone wolf) but it’s noteworthy.
Re: XZ Backdoor: Times, damned times, and scams
#55I don't think he was from Eastern Europe, but if you want to look at UTC+0200/+0300, in Europe this only includes Finland, Baltics, Ukraine, Romania, Moldavia, and Greece. But notably if you look a bit down it also includes a good chunk of the Middle East, including Israel.
[deleted]
Re: XZ Backdoor: Times, damned times, and scams
#56Earlier quoted context omitted.
Considering what the account was up to I sincerely doubt it was being used without Tor or a VPN.
This article asserts some opsec failures - time zones switching when they shouldn’t etc. It’s quite plausible that they didn’t manage perfect vpn usage every single time.
Expert level opsec - very rarely make deliberate "mistakes" by having an inconsistent timezone, or tunneling through someone's compromised home device instead of a VPN, to throw adversaries on wild goose chases.
Re: XZ Backdoor: Times, damned times, and scams
#57Poor Jia. Two whole years of work down the drain. If you're reading this Jia, remember that you miss 100% of the shots you don't take. Chin up, brother.
Don't worry, they (it's a team) also contribute to image libraries, webkit, Kubernetes, ...
Re: XZ Backdoor: Times, damned times, and scams
#58[deleted]
Re: XZ Backdoor: Times, damned times, and scams
#59I suggest not putting a UTC+8 timezone graph as header image, when the conclusion is he's likely from Eastern Europe (not saying you should put one showing EET timezone instead). I understand that people should read the full article instead of drawing any conclusion from a mere image, but lots of people don't (hence why clickbait works). I also think it's a little tasteless, if not misleading. Disclaimer: I'm a Chine…
how is it tasteless? the only fact is that, almost always, Jia Tan's timezone was UTC+8. the rest is mostly speculation about where else they could have been from given holidays and times
[deleted]
Re: XZ Backdoor: Times, damned times, and scams
#60FBI could subpoena GitHub for IP addresses.
The ssh public key might also be interesting, given the opsec failures, they might have used it for other accounts / at other providers