Hacker News Reader

Comment by juitpykyk | Hacker News Reader

FBI could subpoena GitHub for IP addresses.

They probably have/will, though we are unlikely to find out what they get unless they manage to arrest/charge/try him.

Jia Tan probably used a vpn though - we know that they did for accessing IRC (source: https://boehs.org/node/everything-i-know-about-the-xz-backdo...)

Most (but not all ) VPN providers keep logs and payment info that are subpoenable. You could use something like Mulvad with Lightning Network payments, but I am not sure that even that is fully anonymous.

The Witopia VPN that he used for IRC [1] is US based: https://www.personalvpn.com/contact-us/ and they don't mention neither LN payments nor not keeping logs.

1. "~jiatan@185.128.24.163" https://boehs.org/node/everything-i-know-about-the-xz-backdo...

If he used a well known vpn, he probably used a fake id and stolen credit card to pay it.

I had a hard time choosing which comment to select to reply, so I chose yours since it's higher up. Apologies if it's irrelevant.

I don't know why most people assume that hackers even bother with stolen credit cards in the first place. I mean, they sure do, but those are your average Joes in the business of refund reshipping and other types of scams.

Those who want the maximum anonymity don't even bother with buying anything. It's as simple as going to one of the popular websites who leak databases, setting up OpenBullet software or spending anywhere from 1 to 5 hours writing custom mail:pass validators to spam requests to either API or login form through (once again) leaked proxies, etc. using leaked credentials. Or simply going into one of those threads titled 'x100 Mullvad accounts" which have already validated accounts with anywhere from 1m pre-paid to multiple years. And there's even a bonus of not being shown as a user of this account if you do not use official App and simply load configuration manually through ovpn, etc.

And then there's proxy-chaining if you're doing something truly nefarious. It's super easy to chain multiple VPNs with few socks proxies.

People behind XZ backdoor to me look much more smarter than myself, so I would bet they took care of this angle and will be untraceable.

But well-known VPNs mostly keep IP logs - I know from experience; in my company the FBI found a DDoSer this way.

Mullvad accepts cash in an envelope with no return address, good luck tracing that

Postal mail has non-zero metadata, e.g. origin can be traced at least to departure postal code.

There's... actually very little that stops you from sending mail from a non-local postal code.

I've occasionally sent packages postmarked as being from one zipcode from another; as long as it's in the same region, much of the postal processing doesn't care so much.

There's also remailers and forwarders.

How do you do that? Walk up to the postal counter, ask them to postmark it, then ask for it back, drive to another post office and slip it in their outgoing pile?

Semi-Presorted post can be acquired pretty easily. Places like Shippo and PirateShip offer it. As long as you put enough money into the postage paid, the post office doesn't really give a shit if it comes out of somewhere weird. There is no requirement that "return address" and "sent from" area are the same so long as they're within the same postal zone.

This is why AMZN packages have a return address in Vegas or similar sometimes.

You seem to assume Mullvad stores something that allows correlating a Mullvad account to a specific incoming envelope.

Or that they store something that allows correlating an IP+time to a Mullvad account.

Correlation is about combining metadata to incrementally narrow datasets.

When a VPN provider isn't cooperative, metadata can be sought upstream.

Mullvad deserves much credit for accepting non-digital payments, which increases the cost of deanonymization.

Departure postal code could be an area with like 1 million people. And if it is a nation state I am sure they could send the mail from another country.

Most populous US zip code is less than 150K people, https://worldpopulationreview.com/zips

I mean, even if I live in Manhattan, I can easily take a subway train to an area with a different zip code and mail it there. And that's almost the easiest thing you could do -- if you want to hide where the mail is from, it is trivial.

Dense urban areas are often blanketed by a range of spectrum sensors for the purpose of retroactive correlation (e.g Palantir) with other metadata sources.

Considering what the account was up to I sincerely doubt it was being used without Tor or a VPN.

This article asserts some opsec failures - time zones switching when they shouldn’t etc.

It’s quite plausible that they didn’t manage perfect vpn usage every single time.

Expert level opsec - very rarely make deliberate "mistakes" by having an inconsistent timezone, or tunneling through someone's compromised home device instead of a VPN, to throw adversaries on wild goose chases.

They also committed with a different email address and a different name once or twice. This may have been intentional, though, to misdirect.

I'm surprised they didn't set up guards to prevent mistakes like commits with the "wrong" timezones...

Probably; but ask Ross Ulbricht how easy it is to screw that up.

The thing is you only need to make a mistake once.

The ssh public key might also be interesting, given the opsec failures, they might have used it for other accounts / at other providers

Not going to be useful if they consistently used a VPN to access GitHub. But people make mistakes sometimes.

history shows that it is generally very hard to not slip up here and there, especially if you are not expecting to be a huge target.

If a US gov. agency is "Jia Tan" then this might not happen.

But Sir The Calls Are Coming from Inside the House!

this [1] but with handcuffs

[1] https://i.redd.it/obvqaa0lhn841.jpg

Reply on news.ycombinator.com