4 ms·

If I were a chinese hacker trying to do something evil, why on earth would I use a chinese handler/username? Wouldn’t it be better to use an English/European na

If I were a chinese hacker trying to do something evil, why on earth would I use a chinese handler/username? Wouldn’t it be better to use an English/European name to gain (even more) trust from open source maintainers? On the other hand, if I were a non-chinese hacker trying to do evil, then using a chinese handler does make more sense (China is evil, blah blah blah)

yunohn 3y ago
100% this. I don’t know why this obvious angle is being ignored. The other puppet accounts had Indian and German names - it’s very clear they were trying to obscure their real origins.
- michaellee88 3y ago
  The hacker's name "Jia Cheong Tan" actually includes phonics from both variants of Chinese from China, Singpore and Hong Kong region, hence no way it is a name of a real person, so the name probably don't indicate anything. However, since the Hong Kong and Singapore variants is rarely used, the group behind the hacker probably has good knowledge of Chinese linguistics. Either way, the fact that the hacker's account shows GMT+8 and that the hacker's activity is mostly in Southeast Asia working hours (read GMT+8) would only make sense if the hacker is originated from Asia countries. I doubt that group of people behind the hack can consistently stay late night for 2+ years just to fake the timezone.
  - mik1998 3y ago
    > that the hacker's activity is mostly in Southeast Asia working hours (read GMT+8) Opposite is true. His activity is focused around midnight in UTC+0800, with significant activity at 2AM in that timezone.
damagednoob 3y ago
Something I've observed as an English speaking immigrant is that in general, the US/UK is very forgiving when it comes to foreigners trying to speak English. Where certain types of phrasing and harsh words would not be tolerated with first language English speakers, the benefit of the doubt is given to 2nd/3rd language speakers because they 1. Might not have the vocabulary to express themselves correctly 2. Not understand the nuance and connotations that their word choices imply I've seen my colleagues get frustrated in meetings while simulatenously having to assume good intent. Choosing names like the bad actor(s) did gives them an advantage in this scenario.
- secondcoming 3y ago
  The English used in the commit messages I’ve seen was pretty much perfect, but unfortunately the repo has been suspended now.
  - supriyo-biswas 3y ago
    A mirror is here[1] for someone who wants to read the commit messages, though as I understand it is insufficient for reproducing the backdoor at compile time because it is missing the m4/ files required for this purpose. If someone has the additional details to reproduce the backdoor, please let me know and I'll add these files in the repository. [1] https://github.com/supriyo-biswas/xz-mirror https://github.com/supriyo-biswas/xz-mirror
  - IshKebab 3y ago
    I agree. Either native English or very very good second language. Given the weird laziness of some parts of the attack I'd put my money on native English.
    - fluoridation 3y ago
      It sounds to me like you're trying to seek a correlation too eagerly. It's not obvious whether it's more implausible that he's a lazy Chinese programmer with very good English, or a lazy native English-speaking programmer who wants to pretend to be Chinese.
      - IshKebab 3y ago
        The former is more implausible because Chinese people with that level of English are quite rare, whereas English people able to create a fake Chinese username are not.
        kqr 3y ago
        I feel like you're making three statistical mistakes at once. - First, we're not discussing the English level of the general Chinese population, but specifically of the group that's also good at programming. That conditional probability is much higher. - Even if we did speak of the general Chinese population, that is a lot of people so something rare in that group is true for many people still! - It's not like everyone in the US has great English either. (Though open source maintainers are again probably more likely to.)
cqqxo4zV46cp 3y ago
At the end of the day this is such low hanging fruit that I don’t think that it’s even worth paying attention to. This was almost certainly a state actor and this detail would be blindingly obvious to all state actors capable of pulling this off. You could choose to try to dissect the 10 dimensional game of chess involved in picking fake names, or you could focus your attention on more meaningful heuristics.
graemep 3y ago
According to a comment on another thread it is not a mainland Chinese name, so that might still be chosen to mislead in a more subtle way. https://news.ycombinator.com/item?id=39869047 https://news.ycombinator.com/item?id=39869047 Western and Chinese are not the only possibilities, it could be a Russian, or Indian or pretty much anywhere else that engages in intelligence gathering operation.
AnonymousPlanet 3y ago
Since we're reading tea leaves: They also used a sock puppet with a seemingly German name (Hans Jansen). However "Hans" has not been a popular baby name in German speaking countries for many decades. You'd expect any "Hans" to be over 70 or 80 by now. Unless they are American, like Hans Niemann. This could be a cultural oversight on the attacker's side, which points towards any culture that has a wide spread belief that typical German names are Hans or Fritz. From my experience, that is especially true for English speaking countries, mainly because of stereotypes displayed in Hollywood WWII movies. I wouldn't be surprised if cultural perception of Germany was different in China. Edit: some clarifications
- ginko 3y ago
  >They also used a sock puppet with a seemingly German name (Hans Jansen). However "Hans" has not been a popular baby name in German speaking countries for many decades. You'd expect any "Hans" to be over 70 or 80 by now. Unless they are American, like Hans Niemann. Jansen is a Danish/Norwegian surname and Hans is still fairly popular in Denmark. https://www.dst.dk/en/Statistik/emner/borgere/navne/navne-i-hele-befolkningen https://www.dst.dk/en/Statistik/emner/borgere/navne/navne-i-...
  - AnonymousPlanet 3y ago
    Interesting. Jansen is pretty common in Germany aswell. How old would a typical Danish Hans be? From what I can see in [1], Hans hasn't been a popular baby name for decades in Denmark either. Edit: Another country that seems to have retained popularity for "Hans" for a longer time than Germany is the Netherlands. According to [2], its popularity seems to have gone down significantly as well, with a further sharp dropoff in the 90s. There are plenty of other names to choose from if you want to create a fake personality. It's curious they chose one that sticks out among the age cohorts you would expect participating on Github. [1] https://www.dst.dk/en/Statistik/emner/borgere/navne/navne-til-nyfoedte https://www.dst.dk/en/Statistik/emner/borgere/navne/navne-ti... [2] https://www.babynamen.nl/naam/hans/ https://www.babynamen.nl/naam/hans/
    - 3y ago
silverquiet 3y ago
Seeing an Asian (any part of Asia) name wouldn’t give me any pause in the slightest. I don’t want to start anything here, but aren’t they disproportionately represented in the American software industry as compared to their percentage of the population? What would raise my hackles would be someone with a name that codes western who had grammatical idiosyncrasies common to ESL Asians.
- noobermin 3y ago
  So, a couple of thoughts, this likely be chosen in the event that they wouldn't be caught, not that they were. Thus, them choosing a Chinese sounding name to frame China or to go along with the narrative of China being the evil communist country (etc) doesn't really make sense. Also, even if they did that, only westerners would be fooled as others have pointed out "Tan" is a dialect surname (hokkien may be), pointing to someone in Southeast Asia, not mainland China. A better assumption imo is they chose their identity first and foremost with the intent to garner trust first with Lasse Collin.
kqr 3y ago
> If I were a chinese hacker trying to do something evil, why on earth would I use a chinese handler/username? 1) Why not? 2) You'd likely want a relatively common-sounding name, I suppose. Chinese names are relatively common-sounding.

yunohn 3y ago

100% this. I don’t know why this obvious angle is being ignored. The other puppet accounts had Indian and German names - it’s very clear they were trying to obscure their real origins.

michaellee88 3y ago
The hacker's name "Jia Cheong Tan" actually includes phonics from both variants of Chinese from China, Singpore and Hong Kong region, hence no way it is a name of a real person, so the name probably don't indicate anything. However, since the Hong Kong and Singapore variants is rarely used, the group behind the hacker probably has good knowledge of Chinese linguistics. Either way, the fact that the hacker's account shows GMT+8 and that the hacker's activity is mostly in Southeast Asia working hours (read GMT+8) would only make sense if the hacker is originated from Asia countries. I doubt that group of people behind the hack can consistently stay late night for 2+ years just to fake the timezone.
- mik1998 3y ago
  > that the hacker's activity is mostly in Southeast Asia working hours (read GMT+8) Opposite is true. His activity is focused around midnight in UTC+0800, with significant activity at 2AM in that timezone.

damagednoob 3y ago

Something I've observed as an English speaking immigrant is that in general, the US/UK is very forgiving when it comes to foreigners trying to speak English. Where certain types of phrasing and harsh words would not be tolerated with first language English speakers, the benefit of the doubt is given to 2nd/3rd language speakers because they 1. Might not have the vocabulary to express themselves correctly 2. Not understand the nuance and connotations that their word choices imply I've seen my colleagues get frustrated in meetings while simulatenously having to assume good intent. Choosing names like the bad actor(s) did gives them an advantage in this scenario.

secondcoming 3y ago
The English used in the commit messages I’ve seen was pretty much perfect, but unfortunately the repo has been suspended now.
- supriyo-biswas 3y ago
  A mirror is here[1] for someone who wants to read the commit messages, though as I understand it is insufficient for reproducing the backdoor at compile time because it is missing the m4/ files required for this purpose. If someone has the additional details to reproduce the backdoor, please let me know and I'll add these files in the repository. [1] https://github.com/supriyo-biswas/xz-mirror https://github.com/supriyo-biswas/xz-mirror
- IshKebab 3y ago
  I agree. Either native English or very very good second language. Given the weird laziness of some parts of the attack I'd put my money on native English.
  - fluoridation 3y ago
    It sounds to me like you're trying to seek a correlation too eagerly. It's not obvious whether it's more implausible that he's a lazy Chinese programmer with very good English, or a lazy native English-speaking programmer who wants to pretend to be Chinese.
    - IshKebab 3y ago
      The former is more implausible because Chinese people with that level of English are quite rare, whereas English people able to create a fake Chinese username are not.
      - kqr 3y ago
        I feel like you're making three statistical mistakes at once. - First, we're not discussing the English level of the general Chinese population, but specifically of the group that's also good at programming. That conditional probability is much higher. - Even if we did speak of the general Chinese population, that is a lot of people so something rare in that group is true for many people still! - It's not like everyone in the US has great English either. (Though open source maintainers are again probably more likely to.)

cqqxo4zV46cp 3y ago

At the end of the day this is such low hanging fruit that I don’t think that it’s even worth paying attention to. This was almost certainly a state actor and this detail would be blindingly obvious to all state actors capable of pulling this off. You could choose to try to dissect the 10 dimensional game of chess involved in picking fake names, or you could focus your attention on more meaningful heuristics.

graemep 3y ago

According to a comment on another thread it is not a mainland Chinese name, so that might still be chosen to mislead in a more subtle way. https://news.ycombinator.com/item?id=39869047 https://news.ycombinator.com/item?id=39869047 Western and Chinese are not the only possibilities, it could be a Russian, or Indian or pretty much anywhere else that engages in intelligence gathering operation.

AnonymousPlanet 3y ago

Since we're reading tea leaves: They also used a sock puppet with a seemingly German name (Hans Jansen). However "Hans" has not been a popular baby name in German speaking countries for many decades. You'd expect any "Hans" to be over 70 or 80 by now. Unless they are American, like Hans Niemann. This could be a cultural oversight on the attacker's side, which points towards any culture that has a wide spread belief that typical German names are Hans or Fritz. From my experience, that is especially true for English speaking countries, mainly because of stereotypes displayed in Hollywood WWII movies. I wouldn't be surprised if cultural perception of Germany was different in China. Edit: some clarifications

ginko 3y ago
>They also used a sock puppet with a seemingly German name (Hans Jansen). However "Hans" has not been a popular baby name in German speaking countries for many decades. You'd expect any "Hans" to be over 70 or 80 by now. Unless they are American, like Hans Niemann. Jansen is a Danish/Norwegian surname and Hans is still fairly popular in Denmark. https://www.dst.dk/en/Statistik/emner/borgere/navne/navne-i-hele-befolkningen https://www.dst.dk/en/Statistik/emner/borgere/navne/navne-i-...
- AnonymousPlanet 3y ago
  Interesting. Jansen is pretty common in Germany aswell. How old would a typical Danish Hans be? From what I can see in [1], Hans hasn't been a popular baby name for decades in Denmark either. Edit: Another country that seems to have retained popularity for "Hans" for a longer time than Germany is the Netherlands. According to [2], its popularity seems to have gone down significantly as well, with a further sharp dropoff in the 90s. There are plenty of other names to choose from if you want to create a fake personality. It's curious they chose one that sticks out among the age cohorts you would expect participating on Github. [1] https://www.dst.dk/en/Statistik/emner/borgere/navne/navne-til-nyfoedte https://www.dst.dk/en/Statistik/emner/borgere/navne/navne-ti... [2] https://www.babynamen.nl/naam/hans/ https://www.babynamen.nl/naam/hans/
  - 3y ago

silverquiet 3y ago

Seeing an Asian (any part of Asia) name wouldn’t give me any pause in the slightest. I don’t want to start anything here, but aren’t they disproportionately represented in the American software industry as compared to their percentage of the population? What would raise my hackles would be someone with a name that codes western who had grammatical idiosyncrasies common to ESL Asians.

noobermin 3y ago
So, a couple of thoughts, this likely be chosen in the event that they wouldn't be caught, not that they were. Thus, them choosing a Chinese sounding name to frame China or to go along with the narrative of China being the evil communist country (etc) doesn't really make sense. Also, even if they did that, only westerners would be fooled as others have pointed out "Tan" is a dialect surname (hokkien may be), pointing to someone in Southeast Asia, not mainland China. A better assumption imo is they chose their identity first and foremost with the intent to garner trust first with Lasse Collin.

kqr 3y ago

> If I were a chinese hacker trying to do something evil, why on earth would I use a chinese handler/username? 1) Why not? 2) You'd likely want a relatively common-sounding name, I suppose. Chinese names are relatively common-sounding.