5 ms·
Where is the law enforcement angle on this? This individual/organization needs to be on the top of every country's most wanted lists.
by jmward01 3y ago
Where is the law enforcement angle on this? This individual/organization needs to be on the top of every country's most wanted lists.
- ganeshkrishnan 3y ago[flagged]
- stephc_int13 3y agoHow do you know that?
- deleted 3y ago[deleted]
- delfinom 3y ago[flagged]
- deleted 3y ago[deleted]
- greyface- 3y agoI understand the impulse to seek justice, but what crime have they committed? It's illegal to gain unauthorized access, but not to write vulnerable code. Is there evidence that this is being exploited in the wild?
- jmward01 3y agoI am definitely not a lawyer so I have no claim to knowing what is or is not a crime. However, if backdooring SSH on a potentially wide scale doesn't trip afoul of laws then we need to seriously have a discussion about the modern world. I'd argue that investigating this as a crime is likely in the best interest of public safety and even (I hesitate to say this) national security considering the potential scale of this. Finally, I would say there is a distinction between writing vulnerable code and creating a backdoor with malicious intent. It appears (from the articles I have been reading so far) that this was malicious, not an accident or lack of skill. We will see over the next few days though as more experts get eyes on this.
- greyface- 3y agoAgreed on a moral level, and it's true that describing this as simply "vulnerable code" doesn't capture the clear malicious intent. I'm just struggling to find a specific crime. CFAA requires unauthorized access to occur, but the attacker was authorized to publish changes to xz. Code is speech. It was distributed with a "no warranty" clause in the license.
- stephc_int13 3y agoIt is like opening the door of a safe and letting someone else rob the money inside. This is way beyond "moral level".
- fragmede 3y agoCFAA covers distribution of malicious software without the owners consent, the Wire Fraud Act covers malware distribution schemes intended to defraud for property, Computer Misuse act in the UK is broad and far reaching like the CFAA, so this likely fall afoul of that. The GDPR protects personal data, so there's possibly a case that could be made that this violates that as well, though that might be a bit of reach.
- javajosh 3y agoIn which case the defense will claim, correctly, that this malware was never distributed. It was caught. "Attempted malware distribution" may not actually be a crime (but IANAL so I don't know).
- timschmidt 3y agoFolks who run Debian SID or Fedora testing may disagree.
- deleted 3y ago[deleted]
- ndriscoll 3y agoIf more than one person was involved, it'd presumably fall under criminal conspiracy. Clearly this was an overt act in furtherance of a crime (unauthorized access under CFAA, at the least).
- ronsor 3y agoIt's not simply vulnerable code: it's an actual backdoor. That is malware distribution (without permission) and is therefore illegal.
- greyface- 3y agoIs it illegal to distribute malware? I see security researchers doing it all the time for analysis purposes.
- ronsor 3y agoNo, it is not illegal to distribute malware by itself, but it is illegal to trick people into installing malware. The latter was the goal of the XZ contributor.
- pbhjpbhj 3y agoI assume you're talking from a USC perspective? Can you say which specific law, chapter, and clause applies?
- dvhh 3y agoI would somewhat agree, but then come to mind "what is the "legal" definition of malware ?". Some people would say that most drm software would act like malware/ransomware. And tricking people to install such software is only matter of an ambiguously worded checkbox.
- fragmede 3y agospecifically, thevCFAA covers distribution of malicious software without the owners consent. Security researchs downloading malware implicitly give consent to be downloading malware marked as such.
- deleted 3y ago[deleted]
- M2Ys4U 3y agoIn the UK, at least, unauthorised access to computer material under section 1 of the Computer Misuse Act 1990 - and I would also assume that it would also fall foul of sections 2 ("Unauthorised access with intent to commit or facilitate commission of further offences") and 3A ("Making, supplying or obtaining articles for use in offence under section 1, 3 or 3ZA") as well. Though proving jurisdiction would be tricky...
- stephc_int13 3y agoCalling this backdoor "vulnerable code" is a gross mischaracterization. This is closer to a large scale trojan horse, that does not have to be randomly discovered by a hacker to be exploited, but is readily available for privileged remote code execution by whoever have the private key to access this backdoor.
- Seattle3503 3y agoI'd be surprised if the attacker didn't meet the criteria for mens rea.
- hnarn 3y agoWhat is constantly overlooked here on HN is that in legal terms, one of the most important things is intent. Commenters on HN always approach legal issues from a technical perspective but that is simply not how the judicial system works. Whether something is “technically X” or not is irrelevant, laws are usually written with the purpose of catching people based on their intent (malicious hacking), not merely on the technicalities (pentesters distributing examples).
- drowsspa 3y agoYeah, it bothers me so much. They really seem to think that "law is code".
- deleted 3y ago[deleted]
- golergka 3y agoIt is code, but it runs on human wetware which can decode input about actual events into output about intent, and reach consensus about this output via proper court procedures.
- kmeisthax 3y agoIf CFAA doesn't get this guy behind bars then the CFAA is somehow even worse. Not only is it an overbroad and confusing law, it's also not broad enough to actually handcuff people who write malicious code.
- mik1998 3y ago[flagged]
- hnarn 3y agobased on what?
- mik1998 3y agoI did my own research. If you look at the git repository commit log and some mailing list messages, you will see that the author ("Jia Tan", fake name) speaks impeccable English (already lessens the chance of being a Chinese operative), however he commits in the +0800 time zone (Beijing). He works during Chinese holidays and doesn't work during Western holidays. However, the times don't make sense: It looks like he works mostly at 2am: https://files.catbox.moe/6mdtez.png https://files.catbox.moe/6mdtez.png (hours in the +0800 timezone). I understand this to be indicative of using a different timezone on the computer than where he actually worked, possibly knowing that git commits include the timezone. If you shift the timezone to US East Coast -0400, it suddenly looks like a very comfortable full-time job, including a fall in commit rate right where the lunch break should be: https://files.catbox.moe/dtvjzr.png https://files.catbox.moe/dtvjzr.png To me, considering that this appears to be a nation-state tier attack, heavily indicates that it was the Americans. Obviously not conclusive proof, but I think it is useful evidence.
- dolmen 3y agoDo you have some scripts publicly available to reproduce your research?
- mik1998 3y agoI used the git repo at https://git.phial.org/d6/xz-analysis-mirror/commits/branch/master/search?q=Jia+Tan https://git.phial.org/d6/xz-analysis-mirror/commits/branch/m... and simply did git log --format=%cd --author="Jia Tan" and then processed it a bit with gnuplot. Should not be difficult to reproduce this graph, but I am not too much of a gnuplot wizard so I first preprocessed this into some different files in a REPL. Don't have the full code of what I did but it should not be difficult to reproduce, just parse the dates and look at the hours.
- 1oooqooq 3y agoeasy there. calling the cops on the NSA might be treason or something
- BlueFalconHD 3y agoLike that spiderman meme, it's all the NSA
- concordDance 3y agoI would have thought NSA would have hardware/firmware backdoor everywhere and wouldn't need this.
- redox99 3y agoProbably not for fully Chinese hardware. Although this backdoor is only x86 so it still wouldn't work there.
- bawolff 3y agoIts been all of 24 hours, these things take time. Presumably someone doing an attack this audacious took steps to cover their tracks and is using a fake name.
- tootie 3y agoCISA had a report on this pretty quickly. I think they refer cases to Secret Service for enforcement. But really, we seemingly have no idea who or where the perpetrator is located. This could easily be a state actor. It could be a lone wolf. And the effects of the attack would be global too, so jurisdiction is tricky. We really have no idea at this point. The personas used to push the commits and push for inclusion were almost certainly fronts. I'm sure github is sifting through a slew of subpoenas right now.
- grepfru_it 3y agogithub retains an incredible amount of data to review. but if it is a state actor, they likely covered their tracks very well. when i found the original address of the person who hacked elon musk's twitter account it led to an amazon ec2 instance. that instance was bought with stolen financial information and accessed via several vpns and proxies. i would expect state actors to further obfuscate their tracks with shell companies and the like
- Randalthorro 3y agoState actors get to invent people. Literally.
- pcthrowaway 3y agoBased on the level of sophistication being alluded to, I'm personally inclined to assume this is a state actor, possible even some arm of the U.S. govt.
- tejohnso 3y ago> possible even some arm of the U.S. govt. Possible. But why mention U.S. specifically? Is it more likely than Russia, Iran, China, France ... ?
- mardifoufs 3y agoThe US is behind more documented backdoors than those other countries.
- EasyMark 3y agoHighly likely, China has been estimated to have cyberhacking resources that are 10-50x what the USA has currently. It's not even close. The USA will have to up it's game soon or accept China being able to shut down large swathes of the grid and critical infrastructure at will
- pcthrowaway 3y ago> This individual/organization needs to be on the top of every country's most wanted lists Because if the "organization" is a U.S. agency, not much is going to happen here. Russia or China or North Korea might make some strongly worded statements, but nothing is going to happen. It's also very possible that security researchers won't be able to find out, and government agencies will finger-point as a means of misdirection. For example, a statement comes out in a month that this was North Korea. Was it really? Or are they just a convenient scapegoat so the NSA doesn't have to play defense on its lack of accountability again?
- dboreham 3y agoTo me it seems too clumsy to be USG. They seem to prefer back doors that are undetectable or hide in plain sight. But it might be an NSA op designed to instigate a much needed serious examination of the supply chain.
- lulznews 3y agoLmao it’s a state actor bro