6 ms·
Given the recent ( not so recent ) attacks/"bugs" I feel there is a need to do more than the already hard task of investigating and detecting attacks but also t
by PedroBatista 3y ago
Given the recent ( not so recent ) attacks/"bugs" I feel there is a need to do more than the already hard task of investigating and detecting attacks but also to bring IRL consequences to these people.
My understanding is that right now it's pretty much a name and shame of people who most of the time aren't even real "people" but hostile agents either working for governments or criminal groups ( or both )
Getting punched in the face is actually a necessary human condition for a healthy civilization.
- buildbot 3y agoIn the article it says CISA was notified - that sounds like it's going to be a federal investigation if nothing else. If I was this person, I wouldn't be in the USA (or any US friendly nation) ASAP.
- graemep 3y agoOne of Jia Tan's recent contributions is "Speed up CRC32 calculation on LoongArch" I would guess the odds are that this is not someone in the US.
- buildbot 3y agoYeah I saw that - I wouldn't bet on them being in the US but who knows. Maybe they just really love CRC32 ;) And introducing backdoors (if it that was them not an account takeover).
- kevin_b_er 3y agoThose tarballs are PGP signed, too..
- rrix2 3y agoThat was a review of someone else's work? https://github.com/tukaani-project/xz/pull/86 https://github.com/tukaani-project/xz/pull/86
- Fnoord 3y agoSince that repo is disabled: here is a mirror of the discussion [1] [1] https://archive.is/tksCR https://archive.is/tksCR
- hangonhn 3y agoIt's also very possible that the account was compromised and taken over. A two years long con with real useful work is a lot of patience and effort vs. just stealing a weakly protected account. I wonder if MFA shouldn't be a requirement for accounts that contribute to important OSS projects.
- dist-epoch 3y agoThis is most likely not his first backdoor, but the first which was detected. So most likely he didn't wait two years to benefit.
- dralley 3y ago>A two years long con with real useful work is a lot of patience and effort vs. just stealing a weakly protected account. The long-con theory seems a bit more plausible at the moment https://github.com/google/oss-fuzz/pull/10667 https://github.com/google/oss-fuzz/pull/10667
- IncreasePosts 3y agoIt might not even be a long time. He might have just been approached exactly because of his history to insert the back door. And offered either money, or blackmailed or threatened
- hangonhn 3y agoOh man. The was a scenario that didn't cross my mind. I was too narrowly focused on the technical aspects rather than the social aspects of security. Great point.
- Arrath 3y agoWhat if this contributor was a member of a state actor/persistent threat group and, like some totally legit software dev houses, they encourage their people to contribute to OSS projects for the whole personal pursuit/enjoyment/fulfillment angle? With the added bonus that sometimes they get to pull off a longcon like this.
- deleted 3y ago[deleted]
- Unfrozen0688 3y ago[flagged]
- dreamingincode 3y agoThe full name "Jia Cheong Tan" doesn't sound like Mainland China. The name and actions could be intentionally misleading though. https://news.ycombinator.com/item?id=39867737 https://news.ycombinator.com/item?id=39867737
- viraptor 3y agoWe're way too global now for this to be more than a tiny extra signal. People move around, families preserve names. Also nobody checked that person's id, so "Jia" is only slightly more meaningful than "ghrssbitrvii".
- graemep 3y agoNames can be faked, and even real names are not a great indicator. Unless you have some very specific cultural knowledge you could not make even vaguely useful deductions about my location, nationality, culture, ethnicity etc. from my name. I get a lot of wrong guesses though!
- deleted 3y ago[deleted]
- rurban 3y agoSince his only appearance outside of github and git repos is on some Taiwanese blogs, can we please change all occurances of China to Taiwan please? And some others hints at Eastern Europe, comparing the timezones. Taiwan ist still the strongest hint though.
- sneak 3y agoWhat law do you think is being broken here?
- AlexCoventry 3y agoMaybe https://www.law.cornell.edu/uscode/text/18/1030#a_5 https://www.law.cornell.edu/uscode/text/18/1030#a_5 ? > knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer;
- jethro_tell 3y agoHow does posting an exploit POC differ here?
- schlauerfox 3y agoIntent. It's a big part of law and prosecution.
- cjbprime 3y agoNo, freedom of speech (as far as I know) protects even exploit code. The statutes being linked would cover using the backdoor to gain unauthorized entry to a system. I think the question of whether anything illegal has occurred from the public facts is unclear, at least to me, and interesting.
- jethro_tell 3y agoI see a dev on the project has just posted that it has been seen in the wild, so I guess you'd have standing there. https://gist.github.com/thesamesam/223949d5a074ebc3dce9ee78baad9e27 https://gist.github.com/thesamesam/223949d5a074ebc3dce9ee78b...
- wtallis 3y agoThe first amendment might overrule the cited law if that law didn't already include a requirement for intentional harm. But since the law does already have that requirement, there's not really an opportunity for a freedom of speech justification to be what protects a non-malicious publication of a proof of concept. The law isn't trying to infringe on freedom of speech.
- computerfriend 3y agoFrom their Git commits, they're in China's time zone.
- stephenr 3y agoI assume you mean UTC+8... that covers about 20% of the earth's population, besides China it includes parts of Russia, a bunch of SEA and Western Australia.
- fmajid 3y agoChina is 20& of the world's population...
- jcgrillo 3y agoMy git commits are sometimes in UTC, depending on which computer I make them from. Sometimes my laptop just switches timezones depending on whether I'm using wifi or LTE. I wouldn't put much weight on the timezone.
- jnxx 3y agoThe time stamp of a git commit depends on the system clock of the computer the commit was checked in. This cannot be checked by github & co (except that they could reject commits which have time stamps in the future).
- supposemaybe 3y agoRemember that agencies like NSA, GCHQ etc will always use false flags in their code, even when it doesn’t have as high risk of exposure as a backdoor in public has. Looking at the times of commits shouldn’t be given much value at all. A pretty pointless endeavour.
- astrange 3y agoState actors are actually known for not doing that; after all, there's no need to hide when what you're doing is legal. They also tend to work 9-5 in their own timezones.
- rubymamis 3y agoWe shouldn't rule out the probability that this account is from a U.S. agency as well.
- wannacboatmovie 3y agoJust so I understand, you're alleging that a U.S. agency was, among other things, submitting patches for a mainland Chinese home-grown CPU architecture (Loongson)?
- yorwba 3y agoAren't you confusing JiaT75 and xry111? And if someone wanted to attack a target running on Loongson, they would certainly have to make sure the code can actually run there in the first place.
- boutique 3y agoNo, they're not. They are saying that due to the extraordinary circumstances with this case US agencies cannot be excluded from suspicion. At this time no actor seems to be a more likely perpetrator than the next. (Keep in mind that false-flag operations are a very common occurrence in cyber warfare and this cannot be ruled out yet.)
- FLT8 3y agoIt doesn't seem out of the question that the U.S. or allied nations might want to be involved in the development effort around these CPUs. Even if initially it's just to build some credibility for this account so future adversarial patches are accepted with less suspicion? If you think that's implausible, I'm interested why?
- EthanHeilman 3y agoWe shouldn't rule it out, but it seems unlikely to me. This is more reckless than any backdoor I can think of by a US agency . NSA backdoored Dual EC DRBG, which was extremely reckless, but this makes that look careful and that was the Zenith of NSA recklessness. The attackers here straight up just cowboy'd the joint. I can't think of any instance in which US intelligence used sock puppets on public forums and mailinglists to encourage deployment of the backdoored software and I maintain a list of NSA backdoors: https://www.ethanheilman.com/x/12/index.html https://www.ethanheilman.com/x/12/index.html It just doesn't seem like their style.
- offmycloud 3y agoCISA Advisory: https://www.cisa.gov/news-events/alerts/2024/03/29/reported-supply-chain-compromise-affecting-xz-utils-data-compression-library-cve-2024-3094 https://www.cisa.gov/news-events/alerts/2024/03/29/reported-... Note that it say "Fedora 41" in the CISA page link to Red Hat, but Red Hat changed the blog title to "Fedora 40" and left the HTML page title as "Fedora 41".
- weinberg 3y agoAnd I bet if it ended up on a NATO system, things escalate quickly for the person / nation states being scrutinized (https://www.nato.int/cps/en/natohq/topics_78170.htm https://www.nato.int/cps/en/natohq/topics_78170.htm)
- oceanplexian 3y agoA federal investigation into what, itself? The primary actors doing this type of thing are the US Government.
- progbits 3y ago> Getting punched in the face is actually a necessary human condition for a healthy civilization. Aside from signed commits, we need to bring back GPG key parties and web of trust. When using a project you would know how many punches away from the committers you are.
- woodruffw 3y agoPGP is more famous for "web of trust" topologies, not chains of trust. For all of their nerd cred, key parties didn't accomplish very much (as evidenced by the fact that nothing on the Internet really broke when the WoT imploded a few years ago[1]). The "real" solution here is mostly cultural: treating third-party software like the risky thing it actually is, rather than a free source of pre-screened labor. [1]: https://inversegravity.net/2019/web-of-trust-dead/ https://inversegravity.net/2019/web-of-trust-dead/
- progbits 3y agoChain/web was typo, corrected, thanks. I know of the key party issues. But there is some value to knowing how far removed from me and people I trust the project authors are.
- woodruffw 3y ago> But there is some value to knowing how far removed from me and people I trust the project authors are That's true!
- msm_ 3y agoNowadays i achieve this with linkedin[1] connections. Less nerd cred, but achieves roughly the same purpose (most of the people I care about in my niche are at most a 3rd degree connection - a friend of a friend of a friend). [1] formerly also twitter, at least partially.
- weinzierl 3y agoYes, but there was also little pressure to really build the WOT. People, like myself, did it because it was fun, but no one really relied on it. This could change, but it is still far from certain if it'd work given enough pressure.
- throw10920 3y ago> Getting punched in the face is actually a necessary human condition for a healthy civilization. This is factually false - in fact, it's literally the direct opposite of the truth. "Getting punched in the face" is base violence that is incompatible with a healthy civilization. A good government with a robust justice system is what is actually needed for a healthy civilization.