Hacker News Reader

Comment by ddalex | Hacker News Reader

How do you know it is a guy, and it is Chinese?

At best there’s an account with a Chinese sounding name. I’m never going to carry water for the PLA or the CCP, but I’d need to see stronger evidence before agreeing it’s them.

What about water for ZND or CBSOM?

If you’re implying that I used incomprehensible initialisms, I’d argue that they’re easily understandable in the context of an alleged state sponsored attack from China.

I think your comment is facetious and adds nothing to the conversation.

I as well think your comment adds nothing to the conversation.

Neither this one, nor the previous one.

I take it you haven’t looked into the details of this, there is no proof but there is strong evidence in name choice, language use and the MO.

Name choice I disagree with. The attacker used at least Chinese, Indian and Scandinavian names when working on this. It is possible we can find out something by doing a statistical analysis of the language but as far as I know no such analysis has been done.

Edit: A Russian sounding alias was also used.

My current hypothesis is that the attacker(s) deliberately chose a Chinese-sounding name to make people jump to conclusions. A sophisticated state actor would be no stranger to making their actions look like somebody else's.

Or maybe they actually are Chinese, and want me to believe the sentence above. :)

Indeed - seeing the level of sophistication and long term thinking behind this attack, it seems everything about it was planned meticulously, including usernames, attack vectors, communication with the community, and when to commit the parts of the exploit. There's probably a full team of people behind it and attributing it to China because of the username may be too quick.

That is rather naive thinking. Making up a misleading identity is probably one of the first things someone with such a long term plan would do.

And time zone as well it seems

I strongly disagree. If you scratch the surface you find ”misoeater” and some russian sounding user names, and even a danish name. These are all fake profiles and gives us no information about the bad actor.

Spreading doubt is taught in bad actor-academy.

The commit history from bad actor set tomezone to +0800 Source: https://boehs.org/node/everything-i-know-about-the-xz-backdo...

> It’s most likely our actor just mashed plausible-sounding Chinese names together.

Also from that writeup. It also links to https://rheaeve.substack.com/p/xz-backdoor-times-damned-time... which suggests the actual TZ of 'Jia Tan' to be UTC+02/03

In other discussions the Chinese person in question has been spoken about at length

Good point. We just don’t know.

He is Taiwanese. At least he posted on Taiwanese boards.

Jie would be female, Jia male

Occurrences of "jiat0218" on Taiwanese websites are clearly copypasta from some other website that's probably defunct now.

While gendered names do exist, you can't easily tell from the romanization, it depends on the exact characters used. And most likely "Jia" is the surname, or rather the romanization of one of five different surnames.

Tan is a common Chinese surname that's the Hokkien/Teochew transliteration of Chen. It's more commonly seen in overseas Chinese but I wouldn't jump to any conclusions

Reply on news.ycombinator.com