4 ms·

Are we ever going to figure out who Satoshi is? Probably not anytime soon but we can look for clues. Jia was obviously interested in OSS security and fuzzing[0]

Are we ever going to figure out who Satoshi is? Probably not anytime soon but we can look for clues. Jia was obviously interested in OSS security and fuzzing[0] but my wild guess is that s/he is not a state actor. I would rather assume s/he is a hobbyist opportunistic hacker who got trigged by the thought "If I can exploit this, why not?". I assume he intended to build a botnet and do whatever s/he came up with. The initial motivation could've been like I said opportunism and perhaps technical challenge of exploiting the software. [0] https://github.com/JiaT75/oss-fuzz https://github.com/JiaT75/oss-fuzz

4bpp 3y ago
The interest in OSS-Fuzz was because it was used to monitor libxz, and so one of the necessary subgoals was to trick its maintainers into exempting libxz from a check that may have caught the backdoor, or at least drawn attention to it for unrelated reasons: https://github.com/google/oss-fuzz/pull/10667 https://github.com/google/oss-fuzz/pull/10667
- mrkramer 3y ago
  So did he plan all this from the beginning or somewhere down the line he went full yolo?! I am looking at his mailing chat[0] and he seemed pretty enthusiastic about improving and fixing XZ. [0] https://www.mail-archive.com/search?l=xz-devel@tukaani.org&q=from:%22Jia+Tan%22 https://www.mail-archive.com/search?l=xz-devel@tukaani.org&q...
  - chpatrick 3y ago
    I mean if I was working for a state and had the job of compromising xz that's exactly what I would do.
    - CommitSyn 3y ago
      > Either way, it's your preference and I will follow your lead. Jia Tan > It's out of the scope for this patch, but it is something worth considering. Just trying to do my part as a helper elf! Jia Tan Sounds like someone pulling the strings and using the "it's your idea, I'm just following!" strategy. My hunch from reading over all the language used is that this person spent a good deal of time in America and has a carefully crafted 'customer service' manner of speaking. I may be wrong on the spending time in America part, but they are most definitely used to putting people at ease with their word choice. I also found this bit interesting, as it's one of the few times they referred to "us" and "we" > https://www.mail-archive.com/xz-devel@tukaani.org/msg00644.html https://www.mail-archive.com/xz-devel@tukaani.org/msg00644.h... > Please let us know if there are any concerns about the license change. We are looking forward to releasing 5.6.0 later this month!
      - nebulous1 3y ago
        I read that as "us" being the xz dev team.
      - mrkramer 3y ago
        >The contributors to this project are hobbyists so we can't dedicate 40+ hours a week for fast releases of high quality. Thank you for your understanding and if you want to help work on anything you can always submit a patch :) Jia Tan source: https://www.mail-archive.com/xz-devel@tukaani.org/msg00556.html https://www.mail-archive.com/xz-devel@tukaani.org/msg00556.h... What a guy....he is trying his best to gain people's trust and then shove a backdoor down your throat. And that smiley face at the end is just straight out trolling.
    - bombcar 3y ago
      From what I've seen (and I've not seen much, mind you) - someone went through and carefully categorized various libraries by the ability to be injected into OpenSSH on the target systems AND those that were lightly maintained, if at all. xz was the winner, but there are likely others that could have been used.
rcxdude 3y ago
I think this is somewhat unlikely. Timezone/timestamp analysis of their commits seems to show them working on it as a day job. And that they were obfuscating their location from the get-go (not 100% successfully). It may not have been a state actor or even paid, but it seems like they started with at least the intent to deceive about their identity and origin, and that they were working on it as more than just a hobby.
- glenstein 3y ago
  Do you have a link or any place I can learn more about the analysis of their time zone and timestamp?
dan_mctree 3y ago
Possibly if language use fingerprinting ever becomes reliable enough to be able to connect multiple online pseudonyms together. That'd be a fun time

4bpp 3y ago

The interest in OSS-Fuzz was because it was used to monitor libxz, and so one of the necessary subgoals was to trick its maintainers into exempting libxz from a check that may have caught the backdoor, or at least drawn attention to it for unrelated reasons: https://github.com/google/oss-fuzz/pull/10667 https://github.com/google/oss-fuzz/pull/10667

mrkramer 3y ago
So did he plan all this from the beginning or somewhere down the line he went full yolo?! I am looking at his mailing chat[0] and he seemed pretty enthusiastic about improving and fixing XZ. [0] https://www.mail-archive.com/search?l=xz-devel@tukaani.org&q=from:%22Jia+Tan%22 https://www.mail-archive.com/search?l=xz-devel@tukaani.org&q...
- chpatrick 3y ago
  I mean if I was working for a state and had the job of compromising xz that's exactly what I would do.
  - CommitSyn 3y ago
    > Either way, it's your preference and I will follow your lead. Jia Tan > It's out of the scope for this patch, but it is something worth considering. Just trying to do my part as a helper elf! Jia Tan Sounds like someone pulling the strings and using the "it's your idea, I'm just following!" strategy. My hunch from reading over all the language used is that this person spent a good deal of time in America and has a carefully crafted 'customer service' manner of speaking. I may be wrong on the spending time in America part, but they are most definitely used to putting people at ease with their word choice. I also found this bit interesting, as it's one of the few times they referred to "us" and "we" > https://www.mail-archive.com/xz-devel@tukaani.org/msg00644.html https://www.mail-archive.com/xz-devel@tukaani.org/msg00644.h... > Please let us know if there are any concerns about the license change. We are looking forward to releasing 5.6.0 later this month!
    - nebulous1 3y ago
      I read that as "us" being the xz dev team.
    - mrkramer 3y ago
      >The contributors to this project are hobbyists so we can't dedicate 40+ hours a week for fast releases of high quality. Thank you for your understanding and if you want to help work on anything you can always submit a patch :) Jia Tan source: https://www.mail-archive.com/xz-devel@tukaani.org/msg00556.html https://www.mail-archive.com/xz-devel@tukaani.org/msg00556.h... What a guy....he is trying his best to gain people's trust and then shove a backdoor down your throat. And that smiley face at the end is just straight out trolling.
  - bombcar 3y ago
    From what I've seen (and I've not seen much, mind you) - someone went through and carefully categorized various libraries by the ability to be injected into OpenSSH on the target systems AND those that were lightly maintained, if at all. xz was the winner, but there are likely others that could have been used.

rcxdude 3y ago

I think this is somewhat unlikely. Timezone/timestamp analysis of their commits seems to show them working on it as a day job. And that they were obfuscating their location from the get-go (not 100% successfully). It may not have been a state actor or even paid, but it seems like they started with at least the intent to deceive about their identity and origin, and that they were working on it as more than just a hobby.

glenstein 3y ago
Do you have a link or any place I can learn more about the analysis of their time zone and timestamp?

dan_mctree 3y ago

Possibly if language use fingerprinting ever becomes reliable enough to be able to connect multiple online pseudonyms together. That'd be a fun time