3 ms·

I think there is a reasonable likelihood* that the compromise originates from Five Eyes. Would you really want to report IOCs to CISA? *Given the patience and

by dannyw 3y ago

I think there is a reasonable likelihood* that the compromise originates from Five Eyes. Would you really want to report IOCs to CISA? *Given the patience and sophistication of the attack, and my speculation that the NSA likely would’ve caught it and alerted it if it was China or Russia.

acdha 3y ago
If you’re going to be playing that game, consider that his other contributions included optimizing CRC performance on the Chinese LoongArch CPUs with which he appeared to very familiar.
- wuiheerfoj 3y ago
  The perpetrator is clearly a highly skilled dev, it doesn’t seem farfetched that they could become acquainted with a ‘foreign’ tech stack to sell a cover story
- yorwba 3y ago
  Where are you getting this from? JiaT75 reviewed a pull request by xry111 including said optimization (which hadn't yet been merged), that's all.
  - acdha 3y ago
    I saw https://news.ycombinator.com/item?id=39866716 https://news.ycombinator.com/item?id=39866716 yesterday but subsequent comments actually linked to it and a quick trip to the internet archive says you’re right.
jtc331 3y ago
The assumption that the NSA catches (and discloses) most flaws in major open source software requires a high suspension of disbelief.
- acdha 3y ago
  In particular it requires belief that the NSA ignores its mandated mission to protect U.S. infrastructure and is arrogant enough to think only they could find those problems. The federal government, state and local governments, key service providers, major utilities, etc. all rely on open source software and there’s no plausible way they wouldn’t be leaving those open to attack if they didn’t report a known vulnerability.
  - lamontcg 3y ago
    https://en.wikipedia.org/wiki/Dual_EC_DRBG https://en.wikipedia.org/wiki/Dual_EC_DRBG
    - acdha 3y ago
      Yes, that’s a good example of what I’m talking about. Even when they tried to subvert a cryptographic primitive, notice how they designed it in such a way that they could exploit it but other parties could not? Even making the attempt was unacceptable but I will say it’s categorically different than leaving an open source vulnerability unpatched. If they weren’t the ones who created it, they wouldn’t have noticed but not reported it – even our closest allies aren’t trusted with root on government servers.
      - lamontcg 3y ago
        Think you've got that backwards, there's nothing fundamental about Dual_EC_DRBG that prevents anyone else exploiting it, while the xz vulnerability is gated with a specific private key.
        acdha 3y ago
        Same story with the constants in Dual EC: http://rump2007.cr.yp.to/15-shumow.pdf http://rump2007.cr.yp.to/15-shumow.pdf The xz vulnerability is exactly the same in that guarded sense, so I’d be completely unsurprised if the NSA was behind it but I don’t think they’d otherwise help keep it quiet. Even if it was another Fives Eyes country it’s hard to imagine them being okay with that level of risk.
nixgeek 3y ago
I think there is an equally reasonable likelihood that nation state security and intelligence apparatus have disinformation capabilities that include monitoring and when necessary posting to and attempting to influence online forums like HN.
halJordan 3y ago
The nsa isnt a boogeyman you can just ascribe action. I mean you can, it's just wrong. Choosing to fill a void with a boogeyman because it's less uncomfortable than not knowing is exactly the conspiratorial thinking that gets us to chem trails and flat earth

by dannyw 3y ago

acdha 3y ago

If you’re going to be playing that game, consider that his other contributions included optimizing CRC performance on the Chinese LoongArch CPUs with which he appeared to very familiar.

wuiheerfoj 3y ago
The perpetrator is clearly a highly skilled dev, it doesn’t seem farfetched that they could become acquainted with a ‘foreign’ tech stack to sell a cover story
yorwba 3y ago
Where are you getting this from? JiaT75 reviewed a pull request by xry111 including said optimization (which hadn't yet been merged), that's all.
- acdha 3y ago
  I saw https://news.ycombinator.com/item?id=39866716 https://news.ycombinator.com/item?id=39866716 yesterday but subsequent comments actually linked to it and a quick trip to the internet archive says you’re right.

jtc331 3y ago

The assumption that the NSA catches (and discloses) most flaws in major open source software requires a high suspension of disbelief.

acdha 3y ago
In particular it requires belief that the NSA ignores its mandated mission to protect U.S. infrastructure and is arrogant enough to think only they could find those problems. The federal government, state and local governments, key service providers, major utilities, etc. all rely on open source software and there’s no plausible way they wouldn’t be leaving those open to attack if they didn’t report a known vulnerability.
- lamontcg 3y ago
  https://en.wikipedia.org/wiki/Dual_EC_DRBG https://en.wikipedia.org/wiki/Dual_EC_DRBG
  - acdha 3y ago
    Yes, that’s a good example of what I’m talking about. Even when they tried to subvert a cryptographic primitive, notice how they designed it in such a way that they could exploit it but other parties could not? Even making the attempt was unacceptable but I will say it’s categorically different than leaving an open source vulnerability unpatched. If they weren’t the ones who created it, they wouldn’t have noticed but not reported it – even our closest allies aren’t trusted with root on government servers.
    - lamontcg 3y ago
      Think you've got that backwards, there's nothing fundamental about Dual_EC_DRBG that prevents anyone else exploiting it, while the xz vulnerability is gated with a specific private key.
      - acdha 3y ago
        Same story with the constants in Dual EC: http://rump2007.cr.yp.to/15-shumow.pdf http://rump2007.cr.yp.to/15-shumow.pdf The xz vulnerability is exactly the same in that guarded sense, so I’d be completely unsurprised if the NSA was behind it but I don’t think they’d otherwise help keep it quiet. Even if it was another Fives Eyes country it’s hard to imagine them being okay with that level of risk.

nixgeek 3y ago

I think there is an equally reasonable likelihood that nation state security and intelligence apparatus have disinformation capabilities that include monitoring and when necessary posting to and attempting to influence online forums like HN.

halJordan 3y ago

The nsa isnt a boogeyman you can just ascribe action. I mean you can, it's just wrong. Choosing to fill a void with a boogeyman because it's less uncomfortable than not knowing is exactly the conspiratorial thinking that gets us to chem trails and flat earth