4 ms·

The fundamental question remains: considering the in-depth knowledge of low-level (a small scale disassembler), system programming and the practical application

The fundamental question remains: considering the in-depth knowledge of low-level (a small scale disassembler), system programming and the practical application of data structures (i.e. using a trie for all string operations to avoid the use of string constants), was it a state sponsored attack, or it was a one man show who did it for personal gain? Attempting to backdoor nearly every single Linux instance of sshd goes beyond the definition of just being brazen.

codezero 3y ago
That nobody is talking about the person's IP addresses (the xz project was hosted on a personal server of the maintainer), or any details about their actions indicates to me it was a state actor and the original xz maintainer is cooperating with law enforcement to uncover their actions.
- rwmj 3y ago
  CISA is investigating it.
- cdelsolar 3y ago
  I thought it was on GitHub pages?
  - codezero 3y ago
    Before pages the project was hosted on the server of the original maintainer.
- willvarfar 3y ago
  Whilst the ip addresses and email headers etc should be examined meticulously, in the distant hope that they lead somewhere, the chances are that they won't. Very basic opsec.
- miohtama 3y ago
  Based on working hours Israeli is likely https://rheaeve.substack.com/p/xz-backdoor-times-damned-times-and https://rheaeve.substack.com/p/xz-backdoor-times-damned-time... There are other countries on the same time zone, but only Israel has history of using and selling hacks of this level.
  - fl7305 3y ago
    Or someone further west who did this after work during the evenings. Or someone further east with a classical hacker "let's get up late in the afternoon, and start the serious hacking late at night."
    - cesarb 3y ago
      From that article, "To further investigate, we can try to see if he worked on weekends or weekdays: was this a hobbyist or was he paid to do this? The most common working days for Jia were Tue (86), Wed (85), Thu (89), and Fri (79)." That makes it more likely this work was done during working hours; someone doing things outside of work hours would be more likely to produce the same amount (or more) on weekends and holidays.
      - fl7305 3y ago
        Yes, that would point towards regular office hours and not hacking hours.
  - tonypace 3y ago
    Moscow is the same time zone as Israel.
dataflow 3y ago
> The fundamental question remains: considering the in-depth knowledge of low-level (a small scale disassembler), system programming and the practical application of data structures (i.e. using a trie for all string operations to avoid the use of string constants), was it a state sponsored attack I think you're missing where the difficulty is. I'd argue the technical knowledge here isn't the hard part here. You can find more than enough folks who would know how to do everything you listed outside of any state-sponsored context. The hard part is the methodical execution, including the opsec, backup plans, plausible deniability, false identities, knowing how to play the long game, being able to precisely target what you want, understanding human psychological tendencies, identifying unforeseen security vulnerabilities, etc... these are the things that I imagine are likely to distinguish talented individuals from state-sponsored actors, not something like "knows tries and x86 assembly". And taking all those into account, this absolutely smells state-sponsored. I just see no way that a private entity had enough of an incentive, foresight, experience, and patience to play such a long game with such careful maneuvers.
- inkyoto 3y ago
  I do not think I am missing out: the supply chain attack which included playing the long game, subverting the trust of the development community is the real issue that the open source community has no defences against – the thwarted attack has surpassed the scale of all previous supply chain attacks on NodeJs, Python and similar ecosystems and went deep down into the low level, technical layers as well. The assault was comprehensive, holistic and systematic in its approach – this article does not mention it, but other reports have indicated that the person behind it also managed to compromise the PKI layer at the edge between OpenSSL and sshd which brings an extra level of complexity to the backdoor.
- bradleyjg 3y ago
  A lot of the filter is just limited time and energy. A college kid has plenty of that, but not the right skills. There are more than a small number of people with the right skills but they have day jobs. That’s what makes think whoever was working on this was being paid upfront to do so. That said an obsessive with an easy day job and not a ton of family responsibilities is always a possibility.
AtNightWeCode 3y ago
I think it is a professional attempt. It does not have to be a goverment. There are other cyber criminals.
- lmm 3y ago
  > It does not have to be a goverment. There are other cyber criminals. Criminals with the resources to maintain such a complex operation for two years?
  - trallnag 3y ago
    Hobbyist around the world maintain projects for years and decades
  - AtNightWeCode 3y ago
    Difficult but not impossible. Some of the malware and ransomeware stuff is also created by experts.
  - rvnx 3y ago
    Yes, crypto-boys for example. If the reward is 1B USD in crypto stolen from wallets why not do spend a year adding a backdoor ?

codezero 3y ago

That nobody is talking about the person's IP addresses (the xz project was hosted on a personal server of the maintainer), or any details about their actions indicates to me it was a state actor and the original xz maintainer is cooperating with law enforcement to uncover their actions.

rwmj 3y ago
CISA is investigating it.
cdelsolar 3y ago
I thought it was on GitHub pages?
- codezero 3y ago
  Before pages the project was hosted on the server of the original maintainer.
willvarfar 3y ago
Whilst the ip addresses and email headers etc should be examined meticulously, in the distant hope that they lead somewhere, the chances are that they won't. Very basic opsec.
miohtama 3y ago
Based on working hours Israeli is likely https://rheaeve.substack.com/p/xz-backdoor-times-damned-times-and https://rheaeve.substack.com/p/xz-backdoor-times-damned-time... There are other countries on the same time zone, but only Israel has history of using and selling hacks of this level.
- fl7305 3y ago
  Or someone further west who did this after work during the evenings. Or someone further east with a classical hacker "let's get up late in the afternoon, and start the serious hacking late at night."
  - cesarb 3y ago
    From that article, "To further investigate, we can try to see if he worked on weekends or weekdays: was this a hobbyist or was he paid to do this? The most common working days for Jia were Tue (86), Wed (85), Thu (89), and Fri (79)." That makes it more likely this work was done during working hours; someone doing things outside of work hours would be more likely to produce the same amount (or more) on weekends and holidays.
    - fl7305 3y ago
      Yes, that would point towards regular office hours and not hacking hours.
- tonypace 3y ago
  Moscow is the same time zone as Israel.

dataflow 3y ago

> The fundamental question remains: considering the in-depth knowledge of low-level (a small scale disassembler), system programming and the practical application of data structures (i.e. using a trie for all string operations to avoid the use of string constants), was it a state sponsored attack I think you're missing where the difficulty is. I'd argue the technical knowledge here isn't the hard part here. You can find more than enough folks who would know how to do everything you listed outside of any state-sponsored context. The hard part is the methodical execution, including the opsec, backup plans, plausible deniability, false identities, knowing how to play the long game, being able to precisely target what you want, understanding human psychological tendencies, identifying unforeseen security vulnerabilities, etc... these are the things that I imagine are likely to distinguish talented individuals from state-sponsored actors, not something like "knows tries and x86 assembly". And taking all those into account, this absolutely smells state-sponsored. I just see no way that a private entity had enough of an incentive, foresight, experience, and patience to play such a long game with such careful maneuvers.

inkyoto 3y ago
I do not think I am missing out: the supply chain attack which included playing the long game, subverting the trust of the development community is the real issue that the open source community has no defences against – the thwarted attack has surpassed the scale of all previous supply chain attacks on NodeJs, Python and similar ecosystems and went deep down into the low level, technical layers as well. The assault was comprehensive, holistic and systematic in its approach – this article does not mention it, but other reports have indicated that the person behind it also managed to compromise the PKI layer at the edge between OpenSSL and sshd which brings an extra level of complexity to the backdoor.
bradleyjg 3y ago
A lot of the filter is just limited time and energy. A college kid has plenty of that, but not the right skills. There are more than a small number of people with the right skills but they have day jobs. That’s what makes think whoever was working on this was being paid upfront to do so. That said an obsessive with an easy day job and not a ton of family responsibilities is always a possibility.

AtNightWeCode 3y ago

I think it is a professional attempt. It does not have to be a goverment. There are other cyber criminals.

lmm 3y ago
> It does not have to be a goverment. There are other cyber criminals. Criminals with the resources to maintain such a complex operation for two years?
- trallnag 3y ago
  Hobbyist around the world maintain projects for years and decades
- AtNightWeCode 3y ago
  Difficult but not impossible. Some of the malware and ransomeware stuff is also created by experts.
- rvnx 3y ago
  Yes, crypto-boys for example. If the reward is 1B USD in crypto stolen from wallets why not do spend a year adding a backdoor ?