XZ backdoor in a nutshell

You're viewing a single thread.

157 comments

Any additional information been found on the user?
- as long as you're up to date on everything here: https://boehs.org/node/everything-i-know-about-the-xz-backdoor
  the only additional thing i've seen noted is a possibilty that they were using Arch based on investigation of the tarball that they provided to distro maintainers
- Probably Chinese?
  
  Can't confirm but unlikely.
  Via https://boehs.org/node/everything-i-know-about-the-xz-backdoor
  They found this particularly interesting as Cheong is new information. I’ve now learned from another source that Cheong isn’t Mandarin, it’s Cantonese. This source theorizes that Cheong is a variant of the 張 surname, as “eong” matches Jyutping (a Cantonese romanisation standard) and “Cheung” is pretty common in Hong Kong as an official surname romanisation. A third source has alerted me that “Jia” is Mandarin (as Cantonese rarely uses J and especially not Ji). The Tan last name is possible in Mandarin, but is most common for the Hokkien Chinese dialect pronunciation of the character 陳 (Cantonese: Chan, Mandarin: Chen). It’s most likely our actor simply mashed plausible sounding Chinese names together.
  
  So this doesn’t really tell us one way or the other who this person is or isn’t.
  
  That actually suggests not Chinese due to naming inconsistencies
  
  Could be Chinese creating reasonable doubt. Making this sort of mistake makes explanations that this wasn't Chinese sound plausible. Even if evidence other than the name comes out, this rebuttal can be repeated and create confusion amongst the public, reasonable suspicions against accusers and a plausible excuse for other states to not blame China (even if they believe it was China).
  Confusion and multiple narratives is a technique carried out often by Soviet, Russian and Chinese government. We are unlikely to be able to answer the question ourselves. It will be up to the intelligence agencies to do that.
  If someone wanted to blame China for this, they would take the name of a real Chinese person to do it. There is over a billion real people they could take a name from. It unlikely that a person creating a name for someone for this type of espionage would make a mistake like picking an implausible name accidentally.
  
  They're more likely to be based in Eastern Europe based on the times of their commits (during working hours in Eastern European Time) and the fact that while most commits used a UTC+8 time zone, some of them used UTC+2 and UTC+3: https://rheaeve.substack.com/p/xz-backdoor-times-damned-times-and
  
  I'm not suggesting one way or another, only that the quoted explanation taken at face value isn't suggesting China based on name analysis.
  There's also no reason to assume a nation state. This is completely within the realm of a single or small group of hackers. Organized crime another possibility. Errors with naming are plausible just as the initial mistakes with timing analysis and valgrind errors.
  Even assuming a nation state, you name Russia as a possibility. Russia has shown themselves to be completely capable of errors, in their hacks (2016 election interference that was traced back to their intelligence base), their wars, their assassination attempts, etc.
  And to me it doesn't seem any more likely that China would point to themselves but sprinkle doubt with inconsistent naming versus just outright pointing to someone else.
  It's all guesses, nothing points one way or another. I think we agree on that.
  
  A big part of it is also letting other people know you did it. China and Russia are big on this. The create dangerous situations, then say they aren't responsible all while sowing confusion. The want plausible deniability, confusion and credit for doing it.
  
  They're more likely to be based in Eastern Europe based on the times of their commits (during working hours in Eastern European Time) and the fact that while most commits used a UTC+8 time zone, some of them used UTC+2 and UTC+3: https://rheaeve.substack.com/p/xz-backdoor-times-damned-times-and
  
  It is also hard to be certain as they could be a night owl or a early riser.
  
  Yeah - The post goes into a lot of detail, and they did take that into account. It's worth reading.
  
  Just because somebody picked a vaguely Chinese-sounding handle doesn't mean much about who or where.
  
  That's why I put the question mark

157 comments