9 ms·
XZ Backdoor: Times, damned times, and scams
- Dibby053 3y agoIt would be interesting to see how the commit timestamps change around time change. If he has a job in a country that observes DST they would likely show an abrupt change.
- deleted 3y ago[deleted]
- k8svet 3y agoShame on me for not reading more before my now removed comment. Shout-out for doing this level of analysis and guessing, as with everything in this incident, fascinating and tantalizing to wonder about. It is interesting, at least one of the things listed as suspicious is something I do with some frequency. I will sometimes work on what is logically three commits and not chunk them out until the very end. A bit random, but has there been speculation on why this seemed to only target rpm/deb packaging?
- Twirrim 3y ago> A bit random, but has there been speculation on why this seemed to only target rpm/deb packaging? I don't think much speculation is needed. RPM and deb catches every Enterprise Linux distribution, to the best of my knowledge. rpm catches Red Hat and all derivatives like CentOS, Alma Linux etc, as well as SuSE, Amazon Linux, and even Microsoft's Mariner Linux (now renamed Azure Linux). deb catches Debian and Ubuntu. That's a huge global install base just through those two targets.
- k8svet 3y agoSure, but why go to the effort to exclude others? Did they think it would help avoid detection on systems that they didn't care to backdoor?
- thrdbndndn 3y agoObviously it would help avoiding detection since the backdoor has the side effect of slowing down things. So you only target the ones you really want. And to me it's less that they don't care, more that their script probably only works or only has been tested on the ones using .rpm/.deb.
- k8svet 3y ago> Obviously it would help avoiding detection since the backdoor has the side effect of slowing down things. My understanding was that this was the result of a bug? But I understand that part less than any of it, so I well could be wrong. >And to me it's less that they don't care, more that their script probably only works or only has been tested on the ones using .rpm/.deb. Now that, strikes me as more likely. Maybe they wanted to be relatively sure that they wouldn't be detected and needed to select a test matrix to test against (SELinux/landlock config across rpm/deb distros, versus across every distro.) I guess what I'm getting at is... did they have an intended set of targets and knew they were running deb/rpm, on top of any other factors?
- cozzyd 3y agoBecause random people testing an unpackaged version will not find a problem
- Twirrim 3y agoI don't think it was specific effort to exclude others, they took efforts to ensure it happened at packaging time, to reduce chances of detection. So eg other xz devs didn't notice it when compiling it, and so on.
- sihe 3y ago> A bit random, but has there been speculation on why this seemed to only target rpm/deb packaging? The payload only works on systems that connect their sshd to systemd-notify -- which is not true for many Linux distributions beyond Debian-based and RH-based anyway (e.g. Arch Linux doesn't do this).
- Olesya000 3y ago[dead]
- goalieca 3y agoOne of Jia’s followers on GitHub is form Eastern Europe. Edit: it’s a meme. Apparently. I feel like an old man. > illia-git This user is suspected to be a part of an online ransomware organization. Please report any suspicious activity to GitHub security. Poland
- mintplant 3y agoThe message is a custom status, and probably a reference to a Discord meme: https://knowyourmeme.com/memes/discord-user-is-a-suspected-terrorist-copypasta https://knowyourmeme.com/memes/discord-user-is-a-suspected-t...
- deleted 3y ago[deleted]
- deleted 3y ago[deleted]
- juitpykyk 3y agoFBI could subpoena GitHub for IP addresses.
- tobyp- 3y agoConsidering what the account was up to I sincerely doubt it was being used without Tor or a VPN.
- chgs 3y agoThis article asserts some opsec failures - time zones switching when they shouldn’t etc. It’s quite plausible that they didn’t manage perfect vpn usage every single time.
- netsharc 3y agoI'm surprised they didn't set up guards to prevent mistakes like commits with the "wrong" timezones...
- Karellen 3y agoExpert level opsec - very rarely make deliberate "mistakes" by having an inconsistent timezone, or tunneling through someone's compromised home device instead of a VPN, to throw adversaries on wild goose chases.
- fullstop 3y agoThey also committed with a different email address and a different name once or twice. This may have been intentional, though, to misdirect.
- arp242 3y agoProbably; but ask Ross Ulbricht how easy it is to screw that up. The thing is you only need to make a mistake once.
- gpm 3y agoThey probably have/will, though we are unlikely to find out what they get unless they manage to arrest/charge/try him. Jia Tan probably used a vpn though - we know that they did for accessing IRC (source: https://boehs.org/node/everything-i-know-about-the-xz-backdoor https://boehs.org/node/everything-i-know-about-the-xz-backdo...)
- optimalsolver 3y agoPoor Jia. Two whole years of work down the drain. If you're reading this Jia, remember that you miss 100% of the shots you don't take. Chin up, brother.
- sva_ 3y agoWho knows how many alter egos the individual behind that online personality has, and what other projects they poisoned through those.
- rudedogg 3y agoYeah, with a 2-3 year wait to know whether you succeeded or not, I doubt you'd put all your eggs in one basket.
- tiahura 3y agoDon't worry, they (it's a team) also contribute to image libraries, webkit, Kubernetes, ...
- krick 3y agoYes, unironically, that, being a huge leak, really convinces me that we all have multiple RCEs on each of our systems. I mean, we already kinda knew that, of course, but even now that I'm typing this it's a bit hard for me to actually believe it. But realistically I think it's pretty much a proven fact. This level of sophistication… what did I even expect? Of course well-payed teams of high-level professionals are working in this area for a very long time by now. This is basically like professional football players competing against office workers in their late thirties who like to kick a ball on weekends. I am comforting myself by thinking that something a bit more high-level, written in python or even golang, or, oh hell, maybe even rust would be more a bit more transparent for other contributors… but even this is probably a lie. And if it wouldn't be, surely tons of super-popular low-level packages written in C/C++ are as good as incomprehensible for somebody who isn't specifically security-auditing this.
- 3y ago
- throwawayyy9237 3y agoSetting aside the gravity of the situation, I'm 100% gripped by the "mystery novel" side of this. Seeing the internet piecing together the Who? the How? an the Why? is fascinating.
- deleted 3y ago[deleted]
- mavili 3y agoI dont know what the XZ backdoor is about but, to assume someone putting backdoors into software would work usual working days and hours has to be very naïve. The whole premise of the article is based on a false assumption IMO.
- chgs 3y agoIf you’ve missed probably the largest cyber security story since stuxnet, and arguably bigger than that, I suggest you start looking at the last few days. Start here. https://news.ycombinator.com/item?id=39865810 https://news.ycombinator.com/item?id=39865810
- deleted 3y ago[deleted]
- deleted 3y ago[deleted]
- vsnf 3y ago> arguably bigger than that That’s a stretch. Stuxnet was the first acknowledged state cyber attack, utilized multiple zero days, and destroyed nuclear weapons manufacturing facilities. Bigger in scope sure, but bigger unconditionally? I don’t know about that.
- transpute 3y agoDepends on the set of global resources, including development, CI/CD and production systems, reachable by compromised sshd.
- kelnos 3y agoAnd that would likely be precious few, at least today. Only a teeny tiny percentage of servers out there were updated to a vulnerable version. And an even smaller percentage likely had their sshd port exposed to the public internet. Sure, if the backdoor hadn't been found for a couple more years, the impact would have been much higher, as the backdoored version would have made it into actual current releases of the popular server distros, and companies gradually upgraded.
- thrdbndndn 3y agoI suggest not putting a UTC+8 timezone graph as header image, when the conclusion is he's likely from Eastern Europe (not saying you should put one showing EET timezone instead). I understand that people should read the full article instead of drawing any conclusion from a mere image, but lots of people don't (hence why clickbait works). I also think it's a little tasteless, if not misleading. Disclaimer: I'm a Chinese.
- willsmith72 3y agohow is it tasteless? the only fact is that, almost always, Jia Tan's timezone was UTC+8. the rest is mostly speculation about where else they could have been from given holidays and times
- deleted 3y ago[deleted]
- pvg 3y agoThe whole enterprise is a little tasteless with a chance of worse. Not some substacker or tweeter speculating in itself - people are obviously free to let their speculation flag fly. But you start amplifying this stuff on an open internet messageboard and next thing you know, it's reddit 'found' the Boston bomber. The local downsides outweigh the gawking value and I say this as a dyed-in-the-wool internet gawker.
- gmassman 3y agoIt seems no more misleading than Jia Tan assuming an identity based on git commit timestamps…
- ShamelessC 3y ago> understand that people should read the full article instead of drawing any conclusion from a mere image, but lots of people don't People who don’t read the article and find themselves lacking an informed or nuanced understanding of the contents of said article are the only ones to blame here. Full stop. That HN doesn’t have a culture of shaming those who don’t read the article is partly the fault of the rules here which finds “read the article please” to be a distraction/nuisance but don’t mind that this often results in misinformed discussion propagating toward the top of a thread.
- widdma 3y ago> given that Australia does daylight savings time DST varies by state in Australia. Western Australia (UTC+8) does not observe DST.
- mik1998 3y agoI don't think he was from Eastern Europe, but if you want to look at UTC+0200/+0300, in Europe this only includes Finland, Baltics, Ukraine, Romania, Moldavia, and Greece. But notably if you look a bit down it also includes a good chunk of the Middle East, including Israel.
- deleted 3y ago[deleted]
- bradleyjg 3y agoWhat about the daylight savings time and holidays points? How do they line up for Israel?
- mik1998 3y agoI don't know about holidays but Israel uses the same daylight savings as the mentioned Eastern Europe countries, ie switching from UTC+0200 to +0300 at around the same time - only difference is that they start daylight savings on Friday instead of Sunday the same week.
- ufo 3y agoI don't know all the holidays but they have commits on Yom Kippur dates in 2021 and 2022. For 2023 it's harder to say because their commit activity is sparser.
- hnthrowaway0328 3y agoIsraelis usually are off on Fridays so it doesn't match the git commit records.
- AnonHP 3y agoIsraelis are usually off from the evening of Friday (sundown) till the evening of Saturday (sundown) for Shabbat. Where did you get the idea that they’re off on Fridays during daytime? In this context, middle eastern countries with Islam as the majority religion have the day off on Fridays.
- BluSyn 3y agoFor years I've had `gc` in my terminal mapped to `TZ=UTC0 git commit` for exactly this reason. No need to change system times or git settings. (though perhaps a better way in global config?) It's not even for nefarious reasons. I travel a lot, and don't like leaking my travel itinerary on public repos.
- nerdponx 3y agoHow about this? alias git='TZ=UTC0 git'
- deleted 3y ago[deleted]
- yanateras 3y agoEven without the zero! alias git='TZ=UTC git'
- sneak 3y agoI travel a lot but never change my workstation’s time zone out of PST/PDT these days. That would be a manual step and I don’t use Location Services.
- akira2501 3y agoTime zone is purely a displayed time consideration. I'm not bothered that the display time on my computer is different from the time zone I'm actually in.
- kelnos 3y agoSame. My phone automatically changes, and I'll manually change my watch, but when I travel, I leave my laptop in my home time zone. Part of it is I just can't be bothered, and part of it is I want an easy way to know what time it is at home without having to fiddle with a world clock.
- SmartHypercube 3y agoI have been using a small tool I made to hide the time information in my git commits: https://github.com/SmartHypercube/git-date-truncate https://github.com/SmartHypercube/git-date-truncate It not only sets the timezone to UTC, but also sets the time to 00:00. So my commits will only have date information. I think only saving the date permanently in the git commit is good enough. No need to leak the precise time I made commits.
- lapcat 3y ago> who regularly works in the early morning? Me > For a hacker, it is much more plausible to work in the afternoon and late at night c/hacker/younger person
- lucb1e 3y ago> c/hacker/younger person What is this syntax? I know s/a/b/ for sed substitution but not such a thing starting with c
- someplaceguy 3y ago> What is this syntax? I know s/a/b/ for sed substitution but not such a thing starting with c It's the syntax for sed substitution for someone who mistypes, is dyslexic or does not have an excellent memory.
- jtuple 3y agoThe "hacker" stereotype is certainly stale, but subbing "young person" (and implying not "old person") is equally silly. I'm 41 and have been awake before 7am maybe 20 times in the past 10 years. Half the reason I still put up with computers is because it's one of the few professions where I can work a 11-7pm schedule most days and still excel. There are morning people and night people. You are what you are, no judgements, but it isn't something you grow in/out of, nor should be expected to.
- lapcat 3y ago> There are morning people and night people. You are what you are, no judgements, but it isn't something you grow in/out of, nor should be expected to. Oh, my sweet summer child. Talk to me again in another decade or so.
- naruhodo 3y agoI'm in my mid fifties. I rarely start work before 2pm. My colleagues regularly receive emails from me sent after 1am. Are you saying I will grow out of this and become a lark? Or are you saying I will eventually conform, oh wise one?
- lenerdenator 3y ago> Generally, anonymity in the free software sphere is a good thing: software is inherently based on accomplishment and merit, and there is no reason to know anything about a person’s identity. This is an interesting take. Most software engineers I know love to show off their FOSS contributions. It's a place to do what _you_ want to do, free of budgets and MBA interference. I guess in certain parts of the world you probably want to keep that sort of skill set under wraps, though.
- gmassman 3y agoI think personality matters a lot here. One person may flaunt their open source contributions to their colleagues because they like the kudos. Another person may quietly commit and never publicize themselves because they don’t like being the center of attention. Both can even be true of the same person at different points in their careers!
- s_Hogg 3y agoSaying "Eastern Europe" as opposed to "Moscow" is a little coy, isn't it? They're in the same time zone and one seems likelier than the other, to put it one way. Edit: speaking of, these guys might also have some time pressure at the moment with regards to hacking stuff lol. Kind of fits the bill with what we know about the hack
- chgs 3y agoMoscow is UTC+3 year round, not UTC+2 in winter and +3 in summer
- alisonatwork 3y agoIsrael is perhaps more likely given daylight savings.
- sureglymop 3y agoWhy? There would be a number of plausible location based on the time zones. Just asking why you would make that conclusion in terms of rationality.
- tete 3y agoWhat if it is an American (random other place) pretending to be an Eastern European pretending to be Chinese? ;) If I would be pretending something I'd certainly put at least one more indirection in.
- rvba 3y agoOr a Chinese pretending to be an eastern european or israeli pretending to be a chinese? In such setup nothing bad happens in such a leak.
- qiqitori 3y ago> Notably, on Tuesday, Jun 27, 2023, we see two commits: 23:38:32 +0800 and 17:27:09 +0300. If we do the math, there is about a 9-hour difference between the two commits. Isn't 17:27:09 +0300 == 22:27:09 +0800, making the commits just about one hour apart?
- someplaceguy 3y ago> Isn't 17:27:09 +0300 == 22:27:09 +0800, making the commits just about one hour apart? Yes, and even worse: > Even more damning, on 6 Oct 2022, we see the following: one commit at 21:53:09 +0300 followed by another at 17:00:38 +0800. This is only a difference in a matter of minutes! No, this is a difference of almost 10 hours... Maybe the author inadvertently switched the two analyses? Or maybe the author is just not very good with timezone math... :)
- deleted 3y ago[deleted]
- sihe 3y agoAuthor here. Thanks for pointing this out – we switched the examples. (although we also are very bad with timezone math at 2 am.)
- someplaceguy 3y agoNo problem, all of you are welcome! Very enjoyable article.
- deleted 3y ago[deleted]
- Sophira 3y agoI would remind people that it is not difficult at all to have someone's sleep schedule match another country, particularly when we're dealing with what seems to be a state-sponsored attack. Times are a red herring - don't be fooled.
- tgsovlerkhgsel 3y agoAnd yet in many clearly-attributed cases the times lined up with the attacking country's office hours.
- wannacboatmovie 3y agoEveryone here is acting as if it's impossible to script git commits or email replies as a scheduled task or even put someone on the night shift to click send - to give the appearance of being somewhere you're not. There was WAY more than one person involved here. Every email, commit, etc. was a deliberate task that was carefully planned.
- krick 3y agoWould be nice if whoever made the analysis would attach the actual data in csv or something. I mean, it's a bit handier to overview than actually cloning the repo(s) ang using git log, if I'm not gonna dive deep.
- broknbottle 3y agoWhy not include the timestamps for their replies to the mailing list? https://www.mail-archive.com/xz-devel@tukaani.org/ https://www.mail-archive.com/xz-devel@tukaani.org/
- cozzyd 3y agoDo you understand the time format there? It lists things as -700 or -800 for me, is that because of my local time zone (Chicago) vs. the mailing list (Finland?).
- Delk 3y agoI think mail-archive.com just shows time stamps in UTC-0700 or UTC-0800 regardless of where you are. That's how time stamps appear on all of the few mailing lists I checked out there, regardless of the sender of the message.
- dc-programmer 3y agoEastern Orthodox Christmas is not on Dec 25 so the argument for EE is not as air tight as the author thinks it is
- deleted 3y ago[deleted]
- cozzyd 3y agoDepends on the country. Greece, Bulgaria, Romania and now Ukraine celebrate on Dec 25.
- BlueFalconHD 3y agoIf some nation state actor dis this, I imagine they couldve easily modified times of their commits, takin into consideration holidaya and such. Also, nation state actors have tons of resources. They could have people waiting to make commits or schedule it with something like cron.
- deleted 3y ago[deleted]
- ufmace 3y agoProbably worth considering here - if this was a state-sponsored attack, it's entirely possible (and exactly what I would do if I was running such a program) that there is one person or department actually writing the code and list messages etc, and another person or team who sits between that department and the internet and whose entire job is to ensure that everything that comes out from the development team takes place at actual times and with timestamps that are consistent with whatever story they're using for the project. Possibly even once in a while intentionally inserting a "mistake" to hint to investigators that the person's real location is another chosen place, which is also different from the real place where the project is being run.
- bombcar 3y agoExactly. Once you assume that it’s more than “a lone wolf/single guy” many more things become possible. Including carefully curating things to appear in a location and to NOT appear to be more than one person.
- dotps1 3y agoAlways .. however the holiday schedule thing does stand out as something that could have been missed by the orchestrators.
- apantel 3y agoThis is the real point.
- omoikane 3y agoIt's likely that there is a whole team behind this operation, and part of that team might include tasks such as "socially engineer XZ project to accept a maintainer of our choice." This was suggested in a different post[1], where there seem to be newly created accounts that came out of nowhere to create a sense of urgency, which might have accelerated the maintainer role transition. [1] https://connortumbleson.com/2024/03/31/watching-xz-unfold-from-afar/ https://connortumbleson.com/2024/03/31/watching-xz-unfold-fr... via: https://news.ycombinator.com/item?id=39888854 https://news.ycombinator.com/item?id=39888854 Search for "Progress will not happen until there is new maintainer" for the relevant text.
- 4bpp 3y agoGMT+8, the name (Mandarin/mixed-dialect first name + Hokkien surname) and most importantly the circumstance that the user was seen connecting from a likely VPN exit or hosted server in Singapore [1] are all consistent with a Singaporean identity, whether real or cover. For that reason, the opinion of [1]'s source that the name sounds fake should also be taken with some amount of salt (Mainland Chinese are not always well-informed about Diaspora Chinese communities). Worth noting that many of the holidays mentioned, likewise, are not public holidays in SG [2] - Jan 24th was, but Jan 22nd (listed as working) was a Sunday, inconsistent with a "working on regular working days" pattern most anywhere. Would be interesting to see a greater corpus of Jia Tan's writings, especially older ones. There are fairly distinctive idiosyncrasies that may be used to distinguish Singaporeans, Mainland Chinese and speakers of various Slavic languages (and Anglo natives). [1] https://boehs.org/node/everything-i-know-about-the-xz-backdoor https://boehs.org/node/everything-i-know-about-the-xz-backdo... [2] https://www.mom.gov.sg/employment-practices/public-holidays https://www.mom.gov.sg/employment-practices/public-holidays
- qsi 3y agoIn the few commits from Jia Tan that I've seen, the English parses (to me at least) idiomatically as a native speaker from either the US or UK, and I did not encounter any signs of Singaporean English. Obviously, this is a very small sample so one cannot read too much into it. Almost 10% of Singaporeans share the family name Tan. [1] [1] https://en.wikipedia.org/wiki/File:Singaporean_surnames_by_frequency.png https://en.wikipedia.org/wiki/File:Singaporean_surnames_by_f...
- delta_p_delta_x 3y ago> the English parses (to me at least) idiomatically as a native speaker from either the US or UK, and I did not encounter any signs of Singaporean English Singapore is an Anglophone country. Many Singaporeans are perfectly capable of writing (idiomatic) BrE or NAmE, given the medium of instruction in Singaporean education from kindergarten to university is English. Example: me.
- 3y ago
- idlephysicist 3y agoSomething feels weird about the timezone arithmetic here, though maybe I am nuts. Take this for example: > Notably, on Tuesday, Jun 27, 2023, we see two commits: 23:38:32 +0800 and 17:27:09 +0300. If we do the math, there is about a 9-hour difference between the two commits. Putting it all into UTC we get: 23:38 - 8 = 15:38 17:27 - 3 = 14:27 That's not 9 hours by my numbers. Or another example: > Even more damning, on 6 Oct 2022, we see the following: one commit at 21:53:09 +0300 followed by another at 17:00:38 +0800. This is only a difference in a matter of minutes! Putting it all into UTC we get: 21:53 - 3 = 18:53 17:00 - 8 = 09:00 I think these timezones were swapped (accidentally) by the article's author. If we do the calculation again: 21:53 - 8 = 13:53 17:00 - 3 = 14:00 That _is_ a matter of minutes.
- sihe 3y agoYes, thanks for pointing this out! As somebody else already speculated, we got the two examples swapped. Already updated the post.
- deleted 3y ago[deleted]
- fullstop 3y agoIf you don't have your BIOS clock set to UTC and your OS is expecting it to be, you can get strange behavior like this. If they were switching between Windows and Linux, that could explain some of the offsets.
- teddyh 3y agoYou can fix that in Windows: <https://wiki.archlinux.org/title/System_time#UTC_in_Microsoft_Windows https://wiki.archlinux.org/title/System_time#UTC_in_Microsof...>
- sihe 3y agoHi all! One of the authors of the original piece here. Thanks for all your comments – we picked up a lot of cool ideas for future analyses. Just to address four common objections: - We agree it's unclear whether this was one person, or several ones. But even if it was a team, the timezone idea would still tell us where the team is located (the timings seem too much like regular office hours for a globally distributed team). - It's also absolutely possible that commit times were changed, or commits were made/uploaded using timed scripts. Still seems like it would be hard in practice to use this to cover up a massive difference in timezone, though, because it would require adding a massive latency -- and xz wasn't developed in a vacuum, but in reaction to other online events like the filing of issues or mailing list posts. - yes, we did get the two examples mixed up (the two times we say are 10-ish hours apart are actually only minutes apart, and the times we say are minutes apart, are 10-ish hours apart). Update is on the way. - and finally, yes, UTC+2/3 goes beyond just Eastern Europe and includes part of the Middle East. We also clarified this in an update to the article.
- 1letterunixname 3y agoGiant, fragile, pointless build infrastructure is always suspicious. Just take k8s or any other Go cli utility unable to build directly as it was originally intended back when there was go get and now go install. Simplicity and clarity translate into security, maintainability, and reliability.
- kijin 3y ago> you will often not be able to change the time without adding latency, i.e., withholding commits and thus delaying project development -- and even then, getting it right every time is hard. Someone with access to the right machines could easily check whether this is the case. A lot of projects have set up webhooks on github to sync new commits with their own bug tracker, for example, or testing infrastructure. Logs on these systems would tell you exactly when the commits were pushed.
- fbdab103 3y agoI wonder what the "Lessons Learned" look like from the other side? Are they whiteboarding the best strategy for distributing the timestamps of commits? Mandatory performance evaluations on all RCEs? Distribute the poisoned commits amongst more authors?
- farmdve 3y agoThey will likely now optimize the code to not trigger high latency and also ensure no Valgrind will find any issues.
- someotherperson 3y agoMaybe something that can be done if it hasn't been done already: semantic analysis across the different platforms they communicated on, to determine if it was the same person. Also semantic analysis on the same platforms using different cohorts of time (days of the week, months of the year, quarters, whatever). Also: analysis on the email chains they interacted with. It's a possibility that they may have responded to their own emails in their mailing lists with fix suggestions/requests for clarification etc.
- deleted 3y ago[deleted]
- someotherperson 3y agoMaybe a consideration: this isn't necessarily a nation state. It could literally just be one or more individuals trying to set up some sort of crypto heist. At this point we need some sort of new adage to the effect of "never attribute to nation states what can be attributed to crypto"
- farmdve 3y agoTo me this is false. They usually like quick profits. Look no further than Ethereum and defi chains like Optimism,Polygon etc. It is so easy to write a malicious contract that even I with more than 12 years in the cryptocurrency space got had and lost 1k.
- dotps1 3y agoThe attackers would have to know the distributions used by the company they are targeting, that connections are open to the internet, that the company won't change their setup over the course of several years. Everything you are saying is so far out of the realm of possibility that it makes me wonder if you follow this stuff at all. If you had 2+ years of spare time, and these type of skills, the attacker would be far better off just trying to get a job inside the organization they are targeting.
- someotherperson 3y ago> If you had 2+ years of spare time, and these type of skills, the attacker would be far better off just trying to get a job inside the organization they are targeting. Who says they don't? :-)
- crem 3y agoHere is the a distribution of commit times and days of week (hopefully I didn't mess up time zones and plot everything in UTC): https://imgur.com/a/1js5T8L https://imgur.com/a/1js5T8L ~~It has surprisingly many commits on Sundays.~~ UPD. Weekday 0 is actually Monday, not Sunday.
- knorker 3y agoYou can commit while on a plane, with git. And on many flights even upload these changes. So that's not really a slam dunk. Everything else: Very interesting!