4 ms·

Whoever hired these people to infiltrate this project spent a shit ton of hours building it in such a way to avoid detection this long. Fortunately, it was so c

by xyst 3y ago

Whoever hired these people to infiltrate this project spent a shit ton of hours building it in such a way to avoid detection this long. Fortunately, it was so complicated that they couldn't account for all of the factors. This is why open source will always outperform closed source in terms of security. Sure it pointed a massive flaw in the supply chain. Sure it highlights how under appreciated the foundational elements of FOSS, leaving maintainers subject to manipulation. But the same attack within a private company? Shit, probably wouldn't even need advanced obfuscation. With a large enough PR and looming deadlines, could easily sneak something like this with a minimal amount of effort into production systems. By the time company even realizes what happens, you are already flying off to a non-extradition country and selling the exfiltrated data on Tor (or dark web).

skrtskrt 3y ago
off topic, but how many actual non-extradition countries are there these days (for the US)? Even countries we have strained relationships with will extradite as part of a negotiation when it's convenient for them politically. Russia probably wouldn't have even kept Snowden if it wasn't state secrets he revealed. If it was just some random data breach they would have prisoner-swapped him for an oligarch caught money laundering elsewhere.
- moopitydoop 3y ago
  Our adversaries aren't going to extradite their citizens to the west. And obviously if it's a state-level actor they aren't going to extradite their own actors. As someone old enough to remember the tail end of the early hacker eras (e.g. Mitnick), I don't think anyone SHOULD be extradited over this, in particular if they're not being charged with actually using the exploit. Prosecute them where they live. Should they be prosecuted 193 times over in every state on Earth? What's the nexus? Github? Every server that installed the compromised xz utils? But you are right they will deport (not extradite) foreigners who are inconvenient to them or when it is politically expedient to do so, if the foreigners are a nuisance, or as part of a political negotiation or prisoner exchange. The whole "extradition treaties" meme is a misconception. You will only get extradited if you flee to a country where you are a citizen (even dual citizen), or the ability to assert citizenship/nationality there. A fugitive fleeing to a country without an extradition treaty is subject to deportation. Every country on earth reserves the right to deny entry to or deport foreign fugitives. They might choose not to if someone is found to be a refugee, subject to the death penalty in a non-death-penalty state, etc.
- EasyMark 3y ago
  Russia and China would never extradite for this, they would hire the people involved if they aren't already in their employ, and I wouldn't blame them. I'm not even sure if they could be charged with more than misdemeanor charges anyway.
- cesarb 3y ago
  > off topic, but how many actual non-extradition countries are there these days (for the US)? Several countries do not extradite their own citizens. For citizens of these countries, going back to their own home country would be enough.
bsza 3y ago
I’m gonna cry survivorship bias here. How do we know how many similar attempts succeeded? How many of the ones discovered have been written off as honest mistakes? How can we know for sure that e.g. Heartbleed wasn’t put there by someone on purpose (and that that someone isn’t filthy rich now)? When you get hired to a private company, they know who you are. That’s an immediate deterrent against trying anything funny. On Github, no one knows who you are. It might be harder to backdoor a project without getting noticed, but there is no risk to getting noticed. You can try as many times as you like. Jia Tan is still at large, and didn’t even have to plan their whole life around living in a non-extraditing country (if they aren’t in one already).
- xyst 3y ago
  https://en.wikipedia.org/wiki/Industrial_espionage https://en.wikipedia.org/wiki/Industrial_espionage (aka corporate espionage) Happens all the time. Maybe it's a state actor. Maybe it's a disgruntled employee. It's just not in the same lens as you expect (software supply chain attack). Apple has trouble keeping the lid on top secret projects. Leaks about designs happen all the time prior to scheduled debut at WWDC. MS has had trouble in the past as well when it came to developing the Xbox (One?). "Owners of China-Based Company Charged With Conspiracy to Send Trade Secrets Belonging to Leading U.S.-Based Electric Vehicle Company" - https://www.justice.gov/usao-edny/pr/owners-china-based-company-charged-conspiracy-send-trade-secrets-belonging-leading-us https://www.justice.gov/usao-edny/pr/owners-china-based-comp... "Ex-Google engineer charged with stealing AI trade secrets while working with Chinese companies" - https://www.latimes.com/world-nation/story/2024-03-07/ex-google-engineer-charged-with-stealing-ai-trade-secrets-while-working-with-chinese-companies https://www.latimes.com/world-nation/story/2024-03-07/ex-goo... "The US Hits Huawei With New Charges of Trade Secret Theft" - https://www.wired.com/story/us-hits-huawei-new-charges-trade-secret-theft/ https://www.wired.com/story/us-hits-huawei-new-charges-trade... "U.S. charges China-controlled company in trade secrets theft" - https://www.pbs.org/newshour/economy/u-s-charges-china-controlled-company-in-trade-secrets-theft https://www.pbs.org/newshour/economy/u-s-charges-china-contr... "Ex-Google and Uber engineer Anthony Levandowski charged with trade secret theft" - https://www.theverge.com/2019/8/27/20835368/google-uber-engineer-trade-theft-secrets-anthony-levandowski-charged https://www.theverge.com/2019/8/27/20835368/google-uber-engi... In the case of Levandowski, the dude didn't even bother with covering his tracks. Straight up just downloads trade secrets from source control and transfers them to personal computer - https://www.justice.gov/usao-ndca/press-release/file/1197991/download https://www.justice.gov/usao-ndca/press-release/file/1197991... In this small sample of cases, were the exfiltration attempts as elaborate as the "xz attack"? Probably not, but all of these people were vetted by internal procedures and that did nothing to stop them from acting maliciously. Forget back dooring the project when getting through the front door is so much easier! People are very relaxed in their walled off garden and cubicle :)
yongjik 3y ago
I don't buy it. Most private companies would require a face-to-face meeting when you start. Even if you're fully remote, the expectation would be that at some point you would meet your coworkers at meetspace, most likely before you get to commit anything substantial. The ones that are worth penetrating will almost certainly require a background check. And then, once you're in, you cannot just commit to your target project willy-nilly, as your manager and your manager's manager will have other priorities. A for-profit company's frequently dysfunctional management would actually work as deterrent here: you don't just need to justify your code, you will have to justify why you were working on it in the first place.
- ThePowerOfFuet 3y ago
  https://rigor-mortis.nmrc.org/@simplenomad/112184869681420177 https://rigor-mortis.nmrc.org/@simplenomad/11218486968142017...
- deleted 3y ago
  [deleted]
- xyst 3y ago
  face to face, background checks. they are all superficial. A smooth talker can get you to relax your guard. Identity can be faked, especially if you have a nation state backing you.
  - breadwinner 3y ago
    Today no one knows what Jia Tan looks like. That means Jia Tan come back as Gary Smith and work on the next exploit. If we knew what he looked like, we could have at least prevented him from coming back.
    - not2b 3y ago
      Jia Tan might be more than one person.
      - 3y ago
EasyMark 3y ago
Could be interesting as a class project to investigate other small relatively innocuous but near ubiquitous projects that could be treated the same way and investigate whether something similar could be done or has been done already. Just making a list of them would be useful if nothing else.

by xyst 3y ago

skrtskrt 3y ago

off topic, but how many actual non-extradition countries are there these days (for the US)? Even countries we have strained relationships with will extradite as part of a negotiation when it's convenient for them politically. Russia probably wouldn't have even kept Snowden if it wasn't state secrets he revealed. If it was just some random data breach they would have prisoner-swapped him for an oligarch caught money laundering elsewhere.

moopitydoop 3y ago
Our adversaries aren't going to extradite their citizens to the west. And obviously if it's a state-level actor they aren't going to extradite their own actors. As someone old enough to remember the tail end of the early hacker eras (e.g. Mitnick), I don't think anyone SHOULD be extradited over this, in particular if they're not being charged with actually using the exploit. Prosecute them where they live. Should they be prosecuted 193 times over in every state on Earth? What's the nexus? Github? Every server that installed the compromised xz utils? But you are right they will deport (not extradite) foreigners who are inconvenient to them or when it is politically expedient to do so, if the foreigners are a nuisance, or as part of a political negotiation or prisoner exchange. The whole "extradition treaties" meme is a misconception. You will only get extradited if you flee to a country where you are a citizen (even dual citizen), or the ability to assert citizenship/nationality there. A fugitive fleeing to a country without an extradition treaty is subject to deportation. Every country on earth reserves the right to deny entry to or deport foreign fugitives. They might choose not to if someone is found to be a refugee, subject to the death penalty in a non-death-penalty state, etc.
EasyMark 3y ago
Russia and China would never extradite for this, they would hire the people involved if they aren't already in their employ, and I wouldn't blame them. I'm not even sure if they could be charged with more than misdemeanor charges anyway.
cesarb 3y ago
> off topic, but how many actual non-extradition countries are there these days (for the US)? Several countries do not extradite their own citizens. For citizens of these countries, going back to their own home country would be enough.

bsza 3y ago

I’m gonna cry survivorship bias here. How do we know how many similar attempts succeeded? How many of the ones discovered have been written off as honest mistakes? How can we know for sure that e.g. Heartbleed wasn’t put there by someone on purpose (and that that someone isn’t filthy rich now)? When you get hired to a private company, they know who you are. That’s an immediate deterrent against trying anything funny. On Github, no one knows who you are. It might be harder to backdoor a project without getting noticed, but there is no risk to getting noticed. You can try as many times as you like. Jia Tan is still at large, and didn’t even have to plan their whole life around living in a non-extraditing country (if they aren’t in one already).

xyst 3y ago
https://en.wikipedia.org/wiki/Industrial_espionage https://en.wikipedia.org/wiki/Industrial_espionage (aka corporate espionage) Happens all the time. Maybe it's a state actor. Maybe it's a disgruntled employee. It's just not in the same lens as you expect (software supply chain attack). Apple has trouble keeping the lid on top secret projects. Leaks about designs happen all the time prior to scheduled debut at WWDC. MS has had trouble in the past as well when it came to developing the Xbox (One?). "Owners of China-Based Company Charged With Conspiracy to Send Trade Secrets Belonging to Leading U.S.-Based Electric Vehicle Company" - https://www.justice.gov/usao-edny/pr/owners-china-based-company-charged-conspiracy-send-trade-secrets-belonging-leading-us https://www.justice.gov/usao-edny/pr/owners-china-based-comp... "Ex-Google engineer charged with stealing AI trade secrets while working with Chinese companies" - https://www.latimes.com/world-nation/story/2024-03-07/ex-google-engineer-charged-with-stealing-ai-trade-secrets-while-working-with-chinese-companies https://www.latimes.com/world-nation/story/2024-03-07/ex-goo... "The US Hits Huawei With New Charges of Trade Secret Theft" - https://www.wired.com/story/us-hits-huawei-new-charges-trade-secret-theft/ https://www.wired.com/story/us-hits-huawei-new-charges-trade... "U.S. charges China-controlled company in trade secrets theft" - https://www.pbs.org/newshour/economy/u-s-charges-china-controlled-company-in-trade-secrets-theft https://www.pbs.org/newshour/economy/u-s-charges-china-contr... "Ex-Google and Uber engineer Anthony Levandowski charged with trade secret theft" - https://www.theverge.com/2019/8/27/20835368/google-uber-engineer-trade-theft-secrets-anthony-levandowski-charged https://www.theverge.com/2019/8/27/20835368/google-uber-engi... In the case of Levandowski, the dude didn't even bother with covering his tracks. Straight up just downloads trade secrets from source control and transfers them to personal computer - https://www.justice.gov/usao-ndca/press-release/file/1197991/download https://www.justice.gov/usao-ndca/press-release/file/1197991... In this small sample of cases, were the exfiltration attempts as elaborate as the "xz attack"? Probably not, but all of these people were vetted by internal procedures and that did nothing to stop them from acting maliciously. Forget back dooring the project when getting through the front door is so much easier! People are very relaxed in their walled off garden and cubicle :)

yongjik 3y ago

I don't buy it. Most private companies would require a face-to-face meeting when you start. Even if you're fully remote, the expectation would be that at some point you would meet your coworkers at meetspace, most likely before you get to commit anything substantial. The ones that are worth penetrating will almost certainly require a background check. And then, once you're in, you cannot just commit to your target project willy-nilly, as your manager and your manager's manager will have other priorities. A for-profit company's frequently dysfunctional management would actually work as deterrent here: you don't just need to justify your code, you will have to justify why you were working on it in the first place.

ThePowerOfFuet 3y ago
https://rigor-mortis.nmrc.org/@simplenomad/112184869681420177 https://rigor-mortis.nmrc.org/@simplenomad/11218486968142017...
deleted 3y ago
[deleted]
xyst 3y ago
face to face, background checks. they are all superficial. A smooth talker can get you to relax your guard. Identity can be faked, especially if you have a nation state backing you.
- breadwinner 3y ago
  Today no one knows what Jia Tan looks like. That means Jia Tan come back as Gary Smith and work on the next exploit. If we knew what he looked like, we could have at least prevented him from coming back.
  - not2b 3y ago
    Jia Tan might be more than one person.
    - 3y ago

EasyMark 3y ago

Could be interesting as a class project to investigate other small relatively innocuous but near ubiquitous projects that could be treated the same way and investigate whether something similar could be done or has been done already. Just making a list of them would be useful if nothing else.