3 ms·

If you really step back and think about it, this type of behavior is perfectly aligned with any number of well resourced criminal groups and state actors. Two y

If you really step back and think about it, this type of behavior is perfectly aligned with any number of well resourced criminal groups and state actors. Two years of contributing in less visible software with the goal of gaining trust and then slowly pushing your broken fix in. To me that's way more plausible than losing control of your account and the person who compromised it then having someone over a long time insert the backdoor that took a long time to develop and then obfuscate it. Likely someone at GH is talking to some government agencies right now about the behavior of the private repos of that user and their associated users.

sonicanatidae 3y ago
This would be the smarter attack vector, but I've noticed over time that these people are just assholes. They aren't patient. They are in for the smash/grab. I would not be surprised if there was a group using this approach, but I doubt most of them are/would. If they were that dedicated, they'd just have a fucking job, instead of being dicks on the internet for a living.
- Phenylacetyl 3y ago
  [flagged]
- cjbprime 3y ago
  I think you are confusing non-state e.g. ransomware groups, which are usually not part of a government (although some exceptions like North Korea likely exist) with state-sponsored hackers who are often directly working under military command. Soldiers are not "dicks on the internet".
  - willdr 3y ago
    As someone who has been in a fair few discord chats with soldiers, I'd beg to differ...
    - sonicanatidae 3y ago
      >As someone who has been in a fair few discord chats with soldiers, I'd beg to differ... As someone that's spent a lot of time in darker places, I would agree.
- wyldberry 3y ago
  For some groups they certainly are. However at this point: every developed nation has a professional offensive security group that have varying degrees of potency. All are more resourced than 99.9% of organizations defending and enjoy legal autonomy in their country and allied countries for their work. If you're getting salaried comfortably, and you have near infinite resources, a two year timeline is trivial. As an American, I always like to point to things we know our own services have done first[0]. Each actor group have their own motivations and tactics[1]. As someone who spent a lot of time dealing with a few state actors, you learn your adversaries tricks of the trade and they are patient for the long-con because they can afford to be. [0] - https://www.npr.org/2020/03/05/812499752/uncovering-the-cias-audacious-operation-that-gave-them-access-to-state-secrets https://www.npr.org/2020/03/05/812499752/uncovering-the-cias... [1] - https://learn.microsoft.com/en-us/microsoft-365/security/defender/microsoft-threat-actor-naming?view=o365-worldwide https://learn.microsoft.com/en-us/microsoft-365/security/def...
- stephc_int13 3y ago
  This is not that costly. Growing bonsai trees also takes a lot of patience, decades, but you don't have to grow only one at a time, the pros are growing them in large numbers, with minimal work on each individual trees once in a while.
- teddyh 3y ago
  There is a survivorship bias problem there; what if the stupid criminals are the only ones which you notice?

sonicanatidae 3y ago

This would be the smarter attack vector, but I've noticed over time that these people are just assholes. They aren't patient. They are in for the smash/grab. I would not be surprised if there was a group using this approach, but I doubt most of them are/would. If they were that dedicated, they'd just have a fucking job, instead of being dicks on the internet for a living.

Phenylacetyl 3y ago
[flagged]
cjbprime 3y ago
I think you are confusing non-state e.g. ransomware groups, which are usually not part of a government (although some exceptions like North Korea likely exist) with state-sponsored hackers who are often directly working under military command. Soldiers are not "dicks on the internet".
- willdr 3y ago
  As someone who has been in a fair few discord chats with soldiers, I'd beg to differ...
  - sonicanatidae 3y ago
    >As someone who has been in a fair few discord chats with soldiers, I'd beg to differ... As someone that's spent a lot of time in darker places, I would agree.
wyldberry 3y ago
For some groups they certainly are. However at this point: every developed nation has a professional offensive security group that have varying degrees of potency. All are more resourced than 99.9% of organizations defending and enjoy legal autonomy in their country and allied countries for their work. If you're getting salaried comfortably, and you have near infinite resources, a two year timeline is trivial. As an American, I always like to point to things we know our own services have done first[0]. Each actor group have their own motivations and tactics[1]. As someone who spent a lot of time dealing with a few state actors, you learn your adversaries tricks of the trade and they are patient for the long-con because they can afford to be. [0] - https://www.npr.org/2020/03/05/812499752/uncovering-the-cias-audacious-operation-that-gave-them-access-to-state-secrets https://www.npr.org/2020/03/05/812499752/uncovering-the-cias... [1] - https://learn.microsoft.com/en-us/microsoft-365/security/defender/microsoft-threat-actor-naming?view=o365-worldwide https://learn.microsoft.com/en-us/microsoft-365/security/def...
stephc_int13 3y ago
This is not that costly. Growing bonsai trees also takes a lot of patience, decades, but you don't have to grow only one at a time, the pros are growing them in large numbers, with minimal work on each individual trees once in a while.
teddyh 3y ago
There is a survivorship bias problem there; what if the stupid criminals are the only ones which you notice?