4 ms·
So DPRK, Russia, or China, right? The USA and any country affiliated with it can just seize servers.
by mmsc 3y ago
So DPRK, Russia, or China, right?
The USA and any country affiliated with it can just seize servers.
- dralley 3y agoWell the more likely reason for that is that the exploit doesn't work if you have the LANG env var set. The US is the primary place where it wouldn't be set and hence where the malware would be active.
- mmsc 3y agoDoes sshd normally run with any LANG env set when it’s run as a daemon?
- politelemon 3y agoDoes that mean setting a Lang environment variable is a mitigation?
- workfromspace 3y agoMy understanding was the opposite. Two examples I found where backdoor is working are: env -i LANG=en_US.UTF-8 /usr/sbin/sshd -D env -i LANG=C /usr/sbin/sshd -h
- CSMastermind 3y agoCommits had a UTC +8 timestamp, so most likely China or possibly Russia unless Australia or Taiwan decided to do something really weird. Probably not DPRK.
- kardos 3y agoThe commit timestamps are not a reliable indicator of this actor's work day. It's trivial to work on a different schedule than local 9-5, or simply falsify the time stamps [1]. [1] https://github.com/jbranchaud/blog/blob/master/_posts/2013-06-06-Fun-with-GitHubs-Contribution-Graphs.md https://github.com/jbranchaud/blog/blob/master/_posts/2013-0...
- dakiol 3y agoPeople thinking like you still astonishes me. We are talking about someone who is able to build a backdoor like this, and be so careless of: - using a name that reveals their nationality? - commiting at a timezone that reveals where are they located? Please. We have no idea who's behind this. The only legitimate question is (as usual): who benefits from this? Answer: any government on earth (most likely: USA, China, Russia, etc.)
- star-glider 3y agoThis analysis strongly suggests an Eastern European locale masquerading (with occasional oversights) as Chinese: https://rheaeve.substack.com/p/xz-backdoor-times-damned-times-and https://rheaeve.substack.com/p/xz-backdoor-times-damned-time...
- ibic 3y agoIf an attacker is so smart and patient to pull of a sneaky supply chain attack like this, I'd say he/she/they must have been quite carefully choosing the moniker and hide/obfuscate other potentially identity revealing information (afaik, there is no reliable identity information found at the moment). So by choosing a very typical Chinese name (Jia Tan), I believe this is intentially misleading/smearing. I can't believe a smart ass (potenially a state actor) would be so stupid to use his/her/their actual nationality or other information.