5 ms·
The concern about other projects is fine, but let's be careful with attacks directed at the person. Maybe their account is compromised, maybe the username borr
by tux3 3y ago
The concern about other projects is fine, but let's be careful with attacks directed at the person.
Maybe their account is compromised, maybe the username borrows the identity of an innocent person with the same name.
Focus on the code, not people. No point forming a mob.
(e: post above was edited and is no longer directed at the person. thanks for the edit.)
- deleted 3y ago[deleted]
- simiones 3y agoIt's important to focus on people, not just code, when suspecting an adversary. Now, I have no idea if this is the right account, and if it has recently been compromised/sold/lost, or if it has always been under the ownership of the person who committed the backdoor. But IF this is indeed the right account, then it's important to block any further commit from it to any project, no matter how innocuous it seems, and to review thoroughly any past commit. For the most security-conscious projects, it would be a good idea to even consider reverting and re-implementing any work coming from this account if it's not fully understood. An account that has introduced a backdoor is not the same thing as an account who committed a bug.
- tux3 3y agoI agree we should look at the account and its contributions, I make a distinction between the account and the person. Sometimes the distinction is not meaningful, but better safe than sorry.
- tsimionescu 3y agoOh, agreed then.
- kevin_b_er 3y agoThey appear to have moved carefully to set this up over the course of weeks by setting up the framework to perform this attack. I would now presume this person to be a hostile actor and their contributions anywhere and everywhere must be audited. I would not wait for them to cry 'but my bother did it', because an actual malicious actor would say the same thing. The 'mob' should be pouring over everything they've touched. Audit now and audit aggressively.
- b112 3y agoMy above post shows the primary domain for xz moving from tukaani.org to xz.tukaani.org. While it's hosted on github: $ host xz.tukaani.org host xz.tukaani.org is an alias for tukaani-project.github.io. And originally it was not: $ host tukaani.org tukaani.org has address 5.44.245.25 (seemingly in Finland) It was moved there in Jan of this year, as per the commit listed in my prior post. By this same person/account. This means that instead of Lasse Collin's more restrictive webpage, an account directly under the control of the untrusted account, is now able to edit the webpage without anyone else's involvement. For example, to make subtle changes in where to report security issues to, and so on. So far I don't see anything nefarious, but at the same time, isn't this the domain/page hosting bad tarballs too?
- buildbot 3y ago> tukaani.org has address 5.44.245.25 (seemingly in Finland) Hetzner?
- TimWolla 3y agoNo: route: 5.44.240.0/21 descr: Zoner Oy origin: AS201692 mnt-by: MNT-ZONER created: 2014-09-03T08:09:00Z last-modified: 2014-09-03T08:09:00Z source: RIPE
- buildbot 3y agoInteresting, seems to be a tiny finnish hosting company: https://www.zoner.fi/english/ https://www.zoner.fi/english/
- whizzter 3y agoIt's Finnish, Oy is short for "Osake Yhtiö" (share-association, basically a LLC), seems to be registered/hosted at https://www.zoner.fi/ https://www.zoner.fi/
- 3y ago
- mort96 3y agoIf the owner of the account is innocent and their account was compromised, it's on them to come out and say that. All signs currently point to the person being a malicious actor, so I'll proceed on that assumption.
- londons_explore 3y agoDoes the person exist at all? Maybe they're a persona of a team working at some three letter agency...
- bonzini 3y agoOr for some three letter party.
- Citizen8396 3y agoProbably not. I did some pattern of life analysis on their email/other identifiers. It looks exactly like when I set up a burner online identity- just enough to get past platform registration, but they didn't care enough to make it look real. For example, their email is only registered to GitHub and Twitter. They haven't even logged into their Google account for almost a year. There's also no history of it being in any data breaches (because they never use it). Burn the witch.
- ancientMariner 3y agoIt would be interesting to hear the whole arc of social engineering behind getting access to the repo. Although, as a maintainer of a large-ish OSS project myself, I know that under a lot of burden any help will be welcomed with open arms, and I've never really talked about private stuff with any of them.
- Ill_Yam_689 3y agodid you find the Twitter account associated to Jia's email?
- deleted 3y ago