6 ms·

It's worth also noting that the spycraft involved a coordinated harassment campaign of the original maintainer, with multiple writing styles, to accelerate a tr

by btown 3y ago

It's worth also noting that the spycraft involved a coordinated harassment campaign of the original maintainer, with multiple writing styles, to accelerate a transition of maintainership to the attacker: https://www.mail-archive.com/xz-devel@tukaani.org/msg00566.html https://www.mail-archive.com/xz-devel@tukaani.org/msg00566.h... https://www.mail-archive.com/xz-devel@tukaani.org/msg00568.html https://www.mail-archive.com/xz-devel@tukaani.org/msg00568.h... https://www.mail-archive.com/xz-devel@tukaani.org/msg00569.html https://www.mail-archive.com/xz-devel@tukaani.org/msg00569.h... While this doesn't prove nation-state involvement, it certainly borrows from a wide-ranging playbook of techniques.

allanbreyes 3y ago
Ugh, that this psyops sockpuppetry may have started or contributed to the maintainer's mental health issues seems like the most depressing part of all this. Maintaining OSS is hard enough.
- __MatrixMan__ 3y ago
  No good deed goes unpunished, what a shame.
- btown 3y ago
  I hope that one takeaway from this entire situation is that if you're a maintainer and your users are pushing you outside your levels of comfort, that's a reflection on them, not on you - and that it could be reflective of something far, far worse than just their impatience. If you, as a maintainer, value stability of not only your software but also your own mental health, it is entirely something you can be proud of to resist calls for new features, scope increases, and rapid team additions.
- Delk 3y ago
  Probably didn't start them, considering that he already mentioned (long-term) mental health issues in the mailing list discussion in which the (likely) sock puppets started making demands. But it's hard to see the whole thing helping, and it is some combination of depressing and infuriating. I hope he's doing ok.
  - tapland 3y ago
    You only push after you've established your guy as the likely successor. If this was coordinated it was not the first move.
- heavyset_go 3y ago
  Yeah, that was a hard read. I think it highlights the importance of emotionally distancing yourself from your projects. It's also interesting because it exploits the current zeitgeist when it comes to maintainers' responsibilities to their users and communities. Personally, I think it puts too much expectation on maintainers' shoulders, especially when they're working for free. Personally, I think maintainers are doing favors for users, and if they don't like how the project is progressing or not, then too bad. That's not a popular sentiment, though.
mrkramer 3y ago
At first I thought the guy who did this was a lone wolf but now I believe it was indeed state actor. They coordinated and harassed original maintainer into giving them access to the project, basically they hijacked the open source project. The poor guy(the original maintainer) was alone against state actor who was persistent with the goal of hijacking and then backdooring the open source project. It seems like they were actively looking[0] which open source compression library they can inject with vulnerable code and then exploit and backdoor afterwards. [0] https://lwn.net/Articles/967763/ https://lwn.net/Articles/967763/
- asveikau 3y ago
  Reading that link, it seems like the vulnerability is that a file name gets printed, so you can add terminal control characters in a file name and have it printed. https://github.com/libarchive/libarchive/pull/1609#issuecomment-2028125584 https://github.com/libarchive/libarchive/pull/1609#issuecomm...
- pyinstallwoes 3y ago
  > “Recently I've worked off-list a bit with Jia Tan on XZ Utils and” > "In 2021, JiaT75 submitted a pull request to the libarchive repository with the title ‘Added error text to warning when untaring with bsdtar’ which seemed legitimate at first glance. " Seems “Jia” is related to both
- sofixa 3y ago
  > At first I thought the guy who did this was a lone wolf but now I believe it was indeed state actor. They coordinated and harassed original maintainer into giving them access to the project, basically they hijacked the open source project. The poor guy(the original maintainer) was alone against state actor who was persistent with the goal of hijacking and then backdooring the open source project. It could just as easily be a lone wolf capable of writing in different styles (really not difficult if one spends enough time online, one gets exposed to all sorts of styles) or even just your run of the mill criminal gang. In fact, "multiaccount" cheating (where a single person has multiple accounts that interact with one another in a favourable manner, e.g. trading for stuff for reduced fees, or letting themselves be killed to pad stats, or expressing opinions leaving the impression of mass support, etc.) has been present in many MMO games for more than a decade. I recall an online game I was really into back in high school, eRepublik, which simulated real world politics, economics and warfare (in a really dumbed down version of course), and multiacounts were especially prevalent in politics, where candidates for election would often be padded by fake groups, or even entire countries being taken over by a gang of real people with like ten accounts each. The complexity is nothing new. The only indicator this could be a state actor is the long con aspect of it. The attacker(s) were looking into years between starting and actually being able to exploit.
Voultapher 3y ago
I mean one person can use sock puppet accounts to write emails.
yread 3y ago
Maybe they weren't all sockpuppets. Here Jigar Kumar was nitpicking Jia Tan's changes: https://www.mail-archive.com/xz-devel@tukaani.org/msg00556.html https://www.mail-archive.com/xz-devel@tukaani.org/msg00556.h... That was not necessary to gain trust. Writing style is different, too. Later when Jia gained commit access he reminds him to merge it.
- barkingcat 3y ago
  that's precisely what sock puppetry does ... talk/write in a different writing style to make others believe it's different people.
  - bdowling 3y ago
    For all we know there is a whole cyber-squadron (or whatever their military units are called) behind Jia Tan and other accounts.
- asveikau 3y ago
  This looks like a very phony "debate". I think the most convincing case made about the sock puppets is around account creation dates, and also people disappearing after they get what they need. Like Jigar disappearing after Jia becomes maintainer. Or the guy "misoeater19" who creates his debian bug tracker account to say that his work is totally blocked on needing xz 5.6.1 to be in debian unstable.
  - pyinstallwoes 3y ago
    Ah, the good ol’ lever of urgency. Urgency frequency smells of deception.
furstenheim 3y ago
I actually wondered how many packages they harassed until they got access to one such
metrxqin 3y ago
I'm literally shocked by the conversations in the mail-list, it's blatantly an exploitation of others' kindness.

by btown 3y ago

allanbreyes 3y ago

Ugh, that this psyops sockpuppetry may have started or contributed to the maintainer's mental health issues seems like the most depressing part of all this. Maintaining OSS is hard enough.

__MatrixMan__ 3y ago
No good deed goes unpunished, what a shame.
btown 3y ago
I hope that one takeaway from this entire situation is that if you're a maintainer and your users are pushing you outside your levels of comfort, that's a reflection on them, not on you - and that it could be reflective of something far, far worse than just their impatience. If you, as a maintainer, value stability of not only your software but also your own mental health, it is entirely something you can be proud of to resist calls for new features, scope increases, and rapid team additions.
Delk 3y ago
Probably didn't start them, considering that he already mentioned (long-term) mental health issues in the mailing list discussion in which the (likely) sock puppets started making demands. But it's hard to see the whole thing helping, and it is some combination of depressing and infuriating. I hope he's doing ok.
- tapland 3y ago
  You only push after you've established your guy as the likely successor. If this was coordinated it was not the first move.
heavyset_go 3y ago
Yeah, that was a hard read. I think it highlights the importance of emotionally distancing yourself from your projects. It's also interesting because it exploits the current zeitgeist when it comes to maintainers' responsibilities to their users and communities. Personally, I think it puts too much expectation on maintainers' shoulders, especially when they're working for free. Personally, I think maintainers are doing favors for users, and if they don't like how the project is progressing or not, then too bad. That's not a popular sentiment, though.

mrkramer 3y ago

At first I thought the guy who did this was a lone wolf but now I believe it was indeed state actor. They coordinated and harassed original maintainer into giving them access to the project, basically they hijacked the open source project. The poor guy(the original maintainer) was alone against state actor who was persistent with the goal of hijacking and then backdooring the open source project. It seems like they were actively looking[0] which open source compression library they can inject with vulnerable code and then exploit and backdoor afterwards. [0] https://lwn.net/Articles/967763/ https://lwn.net/Articles/967763/

asveikau 3y ago
Reading that link, it seems like the vulnerability is that a file name gets printed, so you can add terminal control characters in a file name and have it printed. https://github.com/libarchive/libarchive/pull/1609#issuecomment-2028125584 https://github.com/libarchive/libarchive/pull/1609#issuecomm...
pyinstallwoes 3y ago
> “Recently I've worked off-list a bit with Jia Tan on XZ Utils and” > "In 2021, JiaT75 submitted a pull request to the libarchive repository with the title ‘Added error text to warning when untaring with bsdtar’ which seemed legitimate at first glance. " Seems “Jia” is related to both
sofixa 3y ago
> At first I thought the guy who did this was a lone wolf but now I believe it was indeed state actor. They coordinated and harassed original maintainer into giving them access to the project, basically they hijacked the open source project. The poor guy(the original maintainer) was alone against state actor who was persistent with the goal of hijacking and then backdooring the open source project. It could just as easily be a lone wolf capable of writing in different styles (really not difficult if one spends enough time online, one gets exposed to all sorts of styles) or even just your run of the mill criminal gang. In fact, "multiaccount" cheating (where a single person has multiple accounts that interact with one another in a favourable manner, e.g. trading for stuff for reduced fees, or letting themselves be killed to pad stats, or expressing opinions leaving the impression of mass support, etc.) has been present in many MMO games for more than a decade. I recall an online game I was really into back in high school, eRepublik, which simulated real world politics, economics and warfare (in a really dumbed down version of course), and multiacounts were especially prevalent in politics, where candidates for election would often be padded by fake groups, or even entire countries being taken over by a gang of real people with like ten accounts each. The complexity is nothing new. The only indicator this could be a state actor is the long con aspect of it. The attacker(s) were looking into years between starting and actually being able to exploit.

Voultapher 3y ago

I mean one person can use sock puppet accounts to write emails.

yread 3y ago

Maybe they weren't all sockpuppets. Here Jigar Kumar was nitpicking Jia Tan's changes: https://www.mail-archive.com/xz-devel@tukaani.org/msg00556.html https://www.mail-archive.com/xz-devel@tukaani.org/msg00556.h... That was not necessary to gain trust. Writing style is different, too. Later when Jia gained commit access he reminds him to merge it.

barkingcat 3y ago
that's precisely what sock puppetry does ... talk/write in a different writing style to make others believe it's different people.
- bdowling 3y ago
  For all we know there is a whole cyber-squadron (or whatever their military units are called) behind Jia Tan and other accounts.
asveikau 3y ago
This looks like a very phony "debate". I think the most convincing case made about the sock puppets is around account creation dates, and also people disappearing after they get what they need. Like Jigar disappearing after Jia becomes maintainer. Or the guy "misoeater19" who creates his debian bug tracker account to say that his work is totally blocked on needing xz 5.6.1 to be in debian unstable.
- pyinstallwoes 3y ago
  Ah, the good ol’ lever of urgency. Urgency frequency smells of deception.

furstenheim 3y ago

I actually wondered how many packages they harassed until they got access to one such

metrxqin 3y ago

I'm literally shocked by the conversations in the mail-list, it's blatantly an exploitation of others' kindness.