6 ms·

I would presume it's a state actor. Generally in the blackhat world, attackers have very precise targets. They want to attack this company or this group of indi

by mrb 3y ago

I would presume it's a state actor. Generally in the blackhat world, attackers have very precise targets. They want to attack this company or this group of individuals. But someone who backdoors such a core piece of open source infrastructure wants to cast a wide net to attack as many as possible. So that fits the profile of a government intelligence agency who is interested in surveilling, well, everything. Or it could in theory be malware authors (ransomware, etc). However these guys tend to aim at the low hanging fruits. They want to make a buck quickly. I don't think they have the patience and persistence to infiltrate an open source project for 2 long years to finally gain enough trust and access to backdoor it. On the other hand, a state actor is in for the long term, so they would spend that much time (and more) to accomplish that. So that's my guess: Jia Tan is an employee of some intelligence agency. He chose to present an asian persona, but that's not necessarily who he truly represents. Could be anyone, really: Russia, China, Israel, or even the US, etc. Edit: given that Lasse Collin was the only maintainer of xz utils in 2022 before Jia Tan, I wouldn't be surprised if the state actor interfered with Lasse somehow. They could have done anything to distract him from the project: introduce a mistress in his life, give him a high-paying job, make his spouse sick so he has to care for her, etc. With Lasse not having as many hours to spend on the project, he would have been more likely to give access to a developer who shows up around the same time and who is highly motivated to contribute code. I would be interested to talk to Lasse to understand his circumstances around 2022.

janc_ 3y ago
Or they have just one or a small number of targets, but don’t want the target(s) to know that they were the only target(s), so they backdoor a large number of victims to “hide in the crowd”. I agree that this is likely a state actor, or at least a very large & wealthy private actor who can play the long game…
dist-epoch 3y ago
According to top comment he committed multiple binary files to xz for the last two years. Most likely this is not the first backdoor, just the first one to be discovered, so it wasn't two years of work until there were results. But I still agree that he's probably a state actor.
- bombcar 3y ago
  Don't forget that you could have state actors who are otherwise interested in open source code, and working to actually improve it. In fact, that'd be the best form of deep cover. It'll be interested to watch as people more knowledgable than I pour over every single commit and change.
  - hobobaggins 3y ago
    (not to be overly pedantic, but you probably meant pore, not pour: https://www.merriam-webster.com/grammar/pore-over-vs-pour-over-poor-usage-difference https://www.merriam-webster.com/grammar/pore-over-vs-pour-ov... )
- apitman 3y ago
  If you have a backdoor in a specific piece of software already, what is the purpose of trying to introduce another backdoor (and risk it getting caught)?
  - dist-epoch 3y ago
    This backdoor targeted only sshd. There could be other backdoors for other targets.
  - dgacmu 3y ago
    There are two general attack targets I'd use if I had access to a library/binary like xz: (1) A backdoor like this one, which isn't really about its core functions, but about the fact that it's a library linked into critical code, so that you can use it to backdoor _other things_. Those are complex and tricky because you have to manipulate the linking/GOT specifically for a target. (2) Insert an exploitable flaw such as a buffer overflow so that you can craft malicious .xz files that result in a target executing code if they process your file. This is a slightly more generic attack vector but that requires a click/download/action. Not every machine or person you want to compromise has an exposed service like ssh, and not every target will download/decompress a file you send to them. These are decently orthogonal attack vectors even though they both involve a library. (Note that there's as yet no evidence for #2 - I'm just noting how I'd try to leverage this to maximum effect if I wanted to.)
5p4n911 3y ago
[flagged]
- mrb 3y ago
  Brand new anon HN account created 17 minutes ago to defend China? Hmm, suspicious :-)
  - wyldberry 3y ago
    Plus China does not care about obfuscation. They smash and grab and then deny, deny, deny + counter accuse.
    - wyldberry 3y ago
      I love that i get downvoted on this immediately like I haven't worked IR cases from CN threat actors that did just this.
      - deleted 3y ago
        [deleted]
  - adamrezich 3y ago
    To be fair, if I worked for the responsible state and it wasn't China, then this is what I would do to deflect…
- rpigab 3y ago
  Yeah, could be Venezuela. Though I'm not trying to make random statements to create uncertainty and doubt, so take this with a gigantic grain of salt.
- fooker 3y ago
  > Though I'm not a malicious actor Yeah, the actor part seems unnecessary now.
fullstop 3y ago
If anyone here happens to know Lasse, it might be good to check up on him and see how he's doing.
Delk 3y ago
> I wouldn't be surprised if the state actor interfered with Lasse somehow People could also just get tired after years of active maintainership or become busier with life. Being the sole maintainer of an active open source project on top of work and perhaps family takes either a lot of enthusiasm or a lot of commitment. It's not really a given that people want to (or can) keep doing that forever at the same pace. Someone then spots the opportunity. I have no idea what the story is here but it might be something rather mundane.
hk__2 3y ago
> I haven't lost interest but my ability to care has been fairly limited mostly due to longterm mental health issues but also due to some other things. Recently I've worked off-list a bit with Jia Tan on XZ Utils and perhaps he will have a bigger role in the future, we'll see. https://www.mail-archive.com/xz-devel@tukaani.org/msg00567.html https://www.mail-archive.com/xz-devel@tukaani.org/msg00567.h...
- ibic 3y ago
  That "Jigar Kumar" is like fake and one-time throw-off account, probably from the same state actor to orchestrate the painstakingly prepared supply chain attack (under the sun).
  - 4cao 3y ago
    At first glance I thought it was a far-fetched conclusion but then I read in a subsequent reply he wrote: > With your current rate, I very doubt to see 5.4.0 release this year. The only progress since april has been small changes to test code. You ignore the many patches bit rotting away on this mailing list. Right now you choke your repo. Why wait until 5.4.0 to change maintainer? Why delay what your repo needs? https://www.mail-archive.com/xz-devel@tukaani.org/msg00568.html https://www.mail-archive.com/xz-devel@tukaani.org/msg00568.h... The last two sentences really make it look as if he were trying to pressure the original author.
    - MantraMuse 3y ago
      Oh wow, all his posts are trying to pressure Lasse, or guilt him into getting Jia on board. They're definitely conspiring. "Your efforts are good but based on the slow release schedule it will unfortunatly be years until the community actually gets this quality of life feature." "Patches spend years on this mailing list. 5.2.0 release was 7 years ago. There is no reason to think anything is coming soon." "With your current rate, I very doubt to see 5.4.0 release this year. The only progress since april has been small changes to test code. You ignore the many patches bit rotting away on this mailing list. Right now you choke your repo. Why wait until 5.4.0 to change maintainer? Why delay what your repo needs?" "Progress will not happen until there is new maintainer. XZ for C has sparse commit log too. Dennis you are better off waiting until new maintainer happens or fork yourself. Submitting patches here has no purpose these days. The current maintainer lost interest or doesn't care to maintain anymore. It is sad to see for a repo like this." "Is there any progress on this? Jia I see you have recent commits. Why can't you commit this yourself?" "Over 1 month and no closer to being merged. Not a suprise."
deleted 3y ago
[deleted]
jnxx 3y ago
> They want to attack this company or this group of individuals. But someone who backdoors such a core piece of open source infrastructure wants to cast a wide net to attack as many as possible. The stuxnet malware, which compromised Siemens industrial controls to attack specific centrifuges in uranium enrichment plants in Iran, is a counterexample to that.
- mrb 3y ago
  Stuxnet wasn't similar to this xz backdoor. The Stuxnet creators researched (or acquired) four Windows zero-days, a relatively short-term endeavor. Whereas the xz backdoor was a long-term 2.5 years operation to slowly gain trust from Lasse Collin. But, anyway, I'm sure we can find other counter-examples.
  - Repulsion9513 3y ago
    If a government wants to cast a wide nest and catch what they can, they'll just throw a tap in some IXP. If a government went to this much effort to plant this vulnerability, they absolutely have targets in mind - just like they did when they went to the effort of researching (or acquiring) four separate Windows zero-days, combining them, and delivering them...
  - jhugo 3y ago
    > a long-term 2.5 years operation to slowly gain trust from Lasse Collin Couldn't the account that committed the backdoor have been compromised recently?
2OEH8eoCRo0 3y ago
It's ridiculous to think it's the US as it would be an attack on Red Hat a US company and an attack on Americans. It's a good way to be dragged in front of Congress.
- guinea-unicorn 3y ago
  The US has backdoored RSA's RNG and thus endangered the security of American companies. It is naive to think that US intelligence agencies will act in the best interest of US citizens or companies.
  - 2OEH8eoCRo0 3y ago
    That is speculation and has never been confirmed.
    - occamsrazorwit 3y ago
      What type of confirmation do you want? The documents aren't going to be declassified in the next couple of decades, if ever. I've never heard anyone claim that Dual_EC_DRBG is most likely not intentionally backdoored, but there's literally no way to confirm because of how its written. If we can't analyze intention from the code, we can look at the broader context for clues. The NSA spent an unusual amount of effort trying to push forward an algorithm that kept getting shot down because it was slower than similar algorithms with no additional benefits (the $10 million deal specified it as a requirement [1]). If you give the NSA the benefit of the doubt, they spent a lot of time and money to... intentionally slow down random number generation?! As an American, I'd prefer a competent NSA than an incompetent NSA that spends my tax dollars to make technology worse for literally no benefit... [1] https://www.reuters.com/article/us-usa-security-rsa-idUSBRE9BJ1C220131220 https://www.reuters.com/article/us-usa-security-rsa-idUSBRE9...
    - hex4def6 3y ago
      You are understating the level of evidence that points to the NSA being fully aware of what it was doing. To be clear, the method of attack was something that had been described in a paper years earlier, the NSA literally had a program (BULLRUN) around compromising and attacking encryption, and there were security researchers at NIST and other places that raised concerns even before it was implemented as a standard. Oh, and the NSA paid the RSA $10 million to implement it. Heck, even the chairman of the RSA implies they got used by the NSA: In an impassioned speech, Coveillo said RSA, like many in industry, has worked with the NSA on projects. But in the case of the NSA-developed algorithm which he didn’t directly name, Coviello told conference attendees that RSA feels NSA exploited its position of trust. In its job, NSA plays two roles, he pointed out. In the information assurance directorate (IAD) arm of NSA, it decides on security technologies that might find use in the government, especially the military. The other side of the NSA is tasked with vacuuming up data for cyber-espionage purposes and now is prepared to take an offensive role in cyber-attacks and cyberwar. “We can’t be sure which part of the NSA we’re working with,” said Coviello with a tone of anguish. He implied that if the NSA induced RSA to include a secret backdoor in any RSA product, it happened without RSA’s consent or awareness. https://www.networkworld.com/article/687628/security-rsa-chief-nsa-exploited-position-of-trust-should-spin-out-security-tech-group.html https://www.networkworld.com/article/687628/security-rsa-chi...
occamsrazorwit 3y ago
Given the details from another comment [1], it sounds like both maintainers are suspicious. Lasse's behavior has changed recently, and he's been pushing to get Jia Tan's changes into the Linux kernel. It's possible both accounts aren't even run by the original Lasse Collin and Jia Tan anymore. Edit: Also, Github has suspended both accounts. Perhaps they know something we don't. [1] https://news.ycombinator.com/item?id=39865810#39866275 https://news.ycombinator.com/item?id=39865810#39866275
- gamer191 3y ago
  Where does that comment mention the other maintainer (Lasse Collin)?
  - occamsrazorwit 3y ago
    Whoops, I linked the wrong comment. I meant to link this one [1]. Anyway, seems like there's potentially a whole trail of compromised and fake accounts [2]. Someone in a government agency somewhere is pretty disappointed right now. [1] https://news.ycombinator.com/item?id=39867593 https://news.ycombinator.com/item?id=39867593 [2] https://news.ycombinator.com/item?id=39866936 https://news.ycombinator.com/item?id=39866936
- salamandar 3y ago
  According to Webarchive, https://tukaani.org/contact.html https://tukaani.org/contact.html changed very recently (between 11/02/2024 and 29/02/2024) to add Lasse Collin's PGP key fingerprint. That timing is weird, considering his git activity at that time is almost non existent. Although, i checked, this key existed back in 2012.
  - Denvercoder9 3y ago
    > considering his git activity at that time is almost non existent Are you looking at the same repositories I am? He's made 88 commits to xz in that time period, two-thirds of the total.
Repulsion9513 3y ago
> Generally in the blackhat world, attackers have very precise targets Lol, what > wants to cast a wide net to attack as many as possible. So that fits the profile of a government intelligence agency That's quite backwards. Governments are far more likely to deploy a complex attack against a single target (see also: Stuxnet); other attackers (motivated primarily by money) are far more likely to cast a wide net.
- gamer191 3y ago
  > That's quite backwards. Governments are far more likely to deploy a complex attack against a single target (see also: Stuxnet); other attackers (motivated primarily by money) are far more likely to cast a wide net. Governments are well known to keep vulnerabilities hidden (see EternalBlue). Intentionally introducing a vulnerability doesn’t seem that backwards tbh
  - Repulsion9513 3y ago
    Oh for sure. I'm not suggesting that this wasn't a government actor, although I'd only give you 50/50 odds on it myself. It coulda just been someone with a bunch of time, like phreakers of old.
pyrolistical 3y ago
Literally this https://xkcd.com/2347/ https://xkcd.com/2347/
Havoc 3y ago
Bit much speculating about mistresses and poisoned spouses with well anything to go on...
ibic 3y ago
Yes, I believe it's an state actor, and the intention of choosing a typical Chinese name Jia Tan is intentially and malicious.
Muntzer 3y ago
Adding some unreadable binary to the source code is a really dangerous thing to do. We also need tools to quickly detect the addition of indentation symbols that can be easily overlooked. BYW,I had a classmate who used to play DOTA1(on war3) under this name at the University of Science and Technology of China a long time ago, and this was his first girlfriend name (maybe) . His father was a high-ranking official. Then he joined the parent department of the Internal Security Detachment, a secret service that has gained a lot of power in the last few years. I hope I'm not awake . lol.

by mrb 3y ago

janc_ 3y ago

Or they have just one or a small number of targets, but don’t want the target(s) to know that they were the only target(s), so they backdoor a large number of victims to “hide in the crowd”. I agree that this is likely a state actor, or at least a very large & wealthy private actor who can play the long game…

dist-epoch 3y ago

According to top comment he committed multiple binary files to xz for the last two years. Most likely this is not the first backdoor, just the first one to be discovered, so it wasn't two years of work until there were results. But I still agree that he's probably a state actor.

bombcar 3y ago
Don't forget that you could have state actors who are otherwise interested in open source code, and working to actually improve it. In fact, that'd be the best form of deep cover. It'll be interested to watch as people more knowledgable than I pour over every single commit and change.
- hobobaggins 3y ago
  (not to be overly pedantic, but you probably meant pore, not pour: https://www.merriam-webster.com/grammar/pore-over-vs-pour-over-poor-usage-difference https://www.merriam-webster.com/grammar/pore-over-vs-pour-ov... )
apitman 3y ago
If you have a backdoor in a specific piece of software already, what is the purpose of trying to introduce another backdoor (and risk it getting caught)?
- dist-epoch 3y ago
  This backdoor targeted only sshd. There could be other backdoors for other targets.
- dgacmu 3y ago
  There are two general attack targets I'd use if I had access to a library/binary like xz: (1) A backdoor like this one, which isn't really about its core functions, but about the fact that it's a library linked into critical code, so that you can use it to backdoor _other things_. Those are complex and tricky because you have to manipulate the linking/GOT specifically for a target. (2) Insert an exploitable flaw such as a buffer overflow so that you can craft malicious .xz files that result in a target executing code if they process your file. This is a slightly more generic attack vector but that requires a click/download/action. Not every machine or person you want to compromise has an exposed service like ssh, and not every target will download/decompress a file you send to them. These are decently orthogonal attack vectors even though they both involve a library. (Note that there's as yet no evidence for #2 - I'm just noting how I'd try to leverage this to maximum effect if I wanted to.)

5p4n911 3y ago

[flagged]

mrb 3y ago
Brand new anon HN account created 17 minutes ago to defend China? Hmm, suspicious :-)
- wyldberry 3y ago
  Plus China does not care about obfuscation. They smash and grab and then deny, deny, deny + counter accuse.
  - wyldberry 3y ago
    I love that i get downvoted on this immediately like I haven't worked IR cases from CN threat actors that did just this.
    - deleted 3y ago
      [deleted]
- adamrezich 3y ago
  To be fair, if I worked for the responsible state and it wasn't China, then this is what I would do to deflect…
rpigab 3y ago
Yeah, could be Venezuela. Though I'm not trying to make random statements to create uncertainty and doubt, so take this with a gigantic grain of salt.
fooker 3y ago
> Though I'm not a malicious actor Yeah, the actor part seems unnecessary now.

fullstop 3y ago

If anyone here happens to know Lasse, it might be good to check up on him and see how he's doing.

Delk 3y ago

> I wouldn't be surprised if the state actor interfered with Lasse somehow People could also just get tired after years of active maintainership or become busier with life. Being the sole maintainer of an active open source project on top of work and perhaps family takes either a lot of enthusiasm or a lot of commitment. It's not really a given that people want to (or can) keep doing that forever at the same pace. Someone then spots the opportunity. I have no idea what the story is here but it might be something rather mundane.

hk__2 3y ago

> I haven't lost interest but my ability to care has been fairly limited mostly due to longterm mental health issues but also due to some other things. Recently I've worked off-list a bit with Jia Tan on XZ Utils and perhaps he will have a bigger role in the future, we'll see. https://www.mail-archive.com/xz-devel@tukaani.org/msg00567.html https://www.mail-archive.com/xz-devel@tukaani.org/msg00567.h...

ibic 3y ago
That "Jigar Kumar" is like fake and one-time throw-off account, probably from the same state actor to orchestrate the painstakingly prepared supply chain attack (under the sun).
- 4cao 3y ago
  At first glance I thought it was a far-fetched conclusion but then I read in a subsequent reply he wrote: > With your current rate, I very doubt to see 5.4.0 release this year. The only progress since april has been small changes to test code. You ignore the many patches bit rotting away on this mailing list. Right now you choke your repo. Why wait until 5.4.0 to change maintainer? Why delay what your repo needs? https://www.mail-archive.com/xz-devel@tukaani.org/msg00568.html https://www.mail-archive.com/xz-devel@tukaani.org/msg00568.h... The last two sentences really make it look as if he were trying to pressure the original author.
  - MantraMuse 3y ago
    Oh wow, all his posts are trying to pressure Lasse, or guilt him into getting Jia on board. They're definitely conspiring. "Your efforts are good but based on the slow release schedule it will unfortunatly be years until the community actually gets this quality of life feature." "Patches spend years on this mailing list. 5.2.0 release was 7 years ago. There is no reason to think anything is coming soon." "With your current rate, I very doubt to see 5.4.0 release this year. The only progress since april has been small changes to test code. You ignore the many patches bit rotting away on this mailing list. Right now you choke your repo. Why wait until 5.4.0 to change maintainer? Why delay what your repo needs?" "Progress will not happen until there is new maintainer. XZ for C has sparse commit log too. Dennis you are better off waiting until new maintainer happens or fork yourself. Submitting patches here has no purpose these days. The current maintainer lost interest or doesn't care to maintain anymore. It is sad to see for a repo like this." "Is there any progress on this? Jia I see you have recent commits. Why can't you commit this yourself?" "Over 1 month and no closer to being merged. Not a suprise."

deleted 3y ago

[deleted]

jnxx 3y ago

> They want to attack this company or this group of individuals. But someone who backdoors such a core piece of open source infrastructure wants to cast a wide net to attack as many as possible. The stuxnet malware, which compromised Siemens industrial controls to attack specific centrifuges in uranium enrichment plants in Iran, is a counterexample to that.

mrb 3y ago
Stuxnet wasn't similar to this xz backdoor. The Stuxnet creators researched (or acquired) four Windows zero-days, a relatively short-term endeavor. Whereas the xz backdoor was a long-term 2.5 years operation to slowly gain trust from Lasse Collin. But, anyway, I'm sure we can find other counter-examples.
- Repulsion9513 3y ago
  If a government wants to cast a wide nest and catch what they can, they'll just throw a tap in some IXP. If a government went to this much effort to plant this vulnerability, they absolutely have targets in mind - just like they did when they went to the effort of researching (or acquiring) four separate Windows zero-days, combining them, and delivering them...
- jhugo 3y ago
  > a long-term 2.5 years operation to slowly gain trust from Lasse Collin Couldn't the account that committed the backdoor have been compromised recently?

2OEH8eoCRo0 3y ago

It's ridiculous to think it's the US as it would be an attack on Red Hat a US company and an attack on Americans. It's a good way to be dragged in front of Congress.

guinea-unicorn 3y ago
The US has backdoored RSA's RNG and thus endangered the security of American companies. It is naive to think that US intelligence agencies will act in the best interest of US citizens or companies.
- 2OEH8eoCRo0 3y ago
  That is speculation and has never been confirmed.
  - occamsrazorwit 3y ago
    What type of confirmation do you want? The documents aren't going to be declassified in the next couple of decades, if ever. I've never heard anyone claim that Dual_EC_DRBG is most likely not intentionally backdoored, but there's literally no way to confirm because of how its written. If we can't analyze intention from the code, we can look at the broader context for clues. The NSA spent an unusual amount of effort trying to push forward an algorithm that kept getting shot down because it was slower than similar algorithms with no additional benefits (the $10 million deal specified it as a requirement [1]). If you give the NSA the benefit of the doubt, they spent a lot of time and money to... intentionally slow down random number generation?! As an American, I'd prefer a competent NSA than an incompetent NSA that spends my tax dollars to make technology worse for literally no benefit... [1] https://www.reuters.com/article/us-usa-security-rsa-idUSBRE9BJ1C220131220 https://www.reuters.com/article/us-usa-security-rsa-idUSBRE9...
  - hex4def6 3y ago
    You are understating the level of evidence that points to the NSA being fully aware of what it was doing. To be clear, the method of attack was something that had been described in a paper years earlier, the NSA literally had a program (BULLRUN) around compromising and attacking encryption, and there were security researchers at NIST and other places that raised concerns even before it was implemented as a standard. Oh, and the NSA paid the RSA $10 million to implement it. Heck, even the chairman of the RSA implies they got used by the NSA: In an impassioned speech, Coveillo said RSA, like many in industry, has worked with the NSA on projects. But in the case of the NSA-developed algorithm which he didn’t directly name, Coviello told conference attendees that RSA feels NSA exploited its position of trust. In its job, NSA plays two roles, he pointed out. In the information assurance directorate (IAD) arm of NSA, it decides on security technologies that might find use in the government, especially the military. The other side of the NSA is tasked with vacuuming up data for cyber-espionage purposes and now is prepared to take an offensive role in cyber-attacks and cyberwar. “We can’t be sure which part of the NSA we’re working with,” said Coviello with a tone of anguish. He implied that if the NSA induced RSA to include a secret backdoor in any RSA product, it happened without RSA’s consent or awareness. https://www.networkworld.com/article/687628/security-rsa-chief-nsa-exploited-position-of-trust-should-spin-out-security-tech-group.html https://www.networkworld.com/article/687628/security-rsa-chi...

occamsrazorwit 3y ago

Given the details from another comment [1], it sounds like both maintainers are suspicious. Lasse's behavior has changed recently, and he's been pushing to get Jia Tan's changes into the Linux kernel. It's possible both accounts aren't even run by the original Lasse Collin and Jia Tan anymore. Edit: Also, Github has suspended both accounts. Perhaps they know something we don't. [1] https://news.ycombinator.com/item?id=39865810#39866275 https://news.ycombinator.com/item?id=39865810#39866275

gamer191 3y ago
Where does that comment mention the other maintainer (Lasse Collin)?
- occamsrazorwit 3y ago
  Whoops, I linked the wrong comment. I meant to link this one [1]. Anyway, seems like there's potentially a whole trail of compromised and fake accounts [2]. Someone in a government agency somewhere is pretty disappointed right now. [1] https://news.ycombinator.com/item?id=39867593 https://news.ycombinator.com/item?id=39867593 [2] https://news.ycombinator.com/item?id=39866936 https://news.ycombinator.com/item?id=39866936
salamandar 3y ago
According to Webarchive, https://tukaani.org/contact.html https://tukaani.org/contact.html changed very recently (between 11/02/2024 and 29/02/2024) to add Lasse Collin's PGP key fingerprint. That timing is weird, considering his git activity at that time is almost non existent. Although, i checked, this key existed back in 2012.
- Denvercoder9 3y ago
  > considering his git activity at that time is almost non existent Are you looking at the same repositories I am? He's made 88 commits to xz in that time period, two-thirds of the total.

Repulsion9513 3y ago

> Generally in the blackhat world, attackers have very precise targets Lol, what > wants to cast a wide net to attack as many as possible. So that fits the profile of a government intelligence agency That's quite backwards. Governments are far more likely to deploy a complex attack against a single target (see also: Stuxnet); other attackers (motivated primarily by money) are far more likely to cast a wide net.

gamer191 3y ago
> That's quite backwards. Governments are far more likely to deploy a complex attack against a single target (see also: Stuxnet); other attackers (motivated primarily by money) are far more likely to cast a wide net. Governments are well known to keep vulnerabilities hidden (see EternalBlue). Intentionally introducing a vulnerability doesn’t seem that backwards tbh
- Repulsion9513 3y ago
  Oh for sure. I'm not suggesting that this wasn't a government actor, although I'd only give you 50/50 odds on it myself. It coulda just been someone with a bunch of time, like phreakers of old.

pyrolistical 3y ago

Literally this https://xkcd.com/2347/ https://xkcd.com/2347/

Havoc 3y ago

Bit much speculating about mistresses and poisoned spouses with well anything to go on...

ibic 3y ago

Yes, I believe it's an state actor, and the intention of choosing a typical Chinese name Jia Tan is intentially and malicious.

Muntzer 3y ago

Adding some unreadable binary to the source code is a really dangerous thing to do. We also need tools to quickly detect the addition of indentation symbols that can be easily overlooked. BYW,I had a classmate who used to play DOTA1(on war3) under this name at the University of Science and Technology of China a long time ago, and this was his first girlfriend name (maybe) . His father was a high-ranking official. Then he joined the parent department of the Internal Security Detachment, a secret service that has gained a lot of power in the last few years. I hope I'm not awake . lol.