Other countries such as Israel are playing the long-con with very well engineered, multi-year software backdoors. A much harder game to play.
Basing this stuff on email times (especially replies to emails sent that same day) would be more relevant. However. if this operation was pulled off with the precision and opsec that it seems to have been, I wouldn't be too surprised if whatever group is behind this attack would've sent over + funded a developer somewhere in a time zone of their choice.
No doubt any nation state is able to station someone in Russia/Israel/one of the n-eyes countries.
I doubt OSINT will figure out who is really behind this, but I'm sure governments will, soon enough. Whether or not they report the truth of their findings, and if one should trust the official reporting, is yet another tough question.
See the writeup here: https://til.simonwillison.net/clickhouse/github-explorer
That activity look 100% to be from a paid employee to me. He works in the morning and does git maintenance in the afternoon like clockwork... Between 12 and 18... It might also have been multiple employee.
He didn't work on Christmas or new year eve which is extremely telling...
But note that he comes back next year on the 5th, then disappears for 6th and 7th, and comes back at 8th. 7th is the old-style Eastern Orthodox Christmas, as celebrated in e.g. Russia, Serbia, and Georgia, and 6th is therefore the Christmas Eve. Although in Russia official holidays are the entire week from January, 1 to January, 8 inclusive... still, for this kind of work I wouldn't expect them to stick to the letter of the law there.
What is this in reference to?
They are an Israel based company, that sell zero-click RCEs for phones and more. Such malicious software was involved in the murder of journalist Jamal Khashoggi.
Their exploits, developed in-house as well as presumably partially bought on the black market, are some of the most sophisticated exploits found in the wild, e.g. https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i...
> JBIG2 doesn't have scripting capabilities, but when combined with a vulnerability, it does have the ability to emulate circuits of arbitrary logic gates operating on arbitrary memory. So why not just use that to build your own computer architecture and script that!? That's exactly what this exploit does. Using over 70,000 segment commands defining logical bit operations, they define a small computer architecture with features such as registers and a full 64-bit adder and comparator which they use to search memory and perform arithmetic operations. It's not as fast as Javascript, but it's fundamentally computationally equivalent.
Exactly my point. They do not sell backdoors.
Don't get me wrong, still icky, but definitely not a "very well engineered, multi-year software backdoors"
And i mean, i'm genuinely curious. I don't think they would be above doing so if they had the opportunity, i just haven't heard of any instances where they were caught doing so.
RCE is a broad category and includes many things. That said, while technically the liblzma thing is an RCE, supply chain attacks aren't really what most people mean when they talk about an RCE vulnerability.
"The Maxwell-Mossad team steals spy software PROMIS from the United States, Mossad puts an undetectable trap door in it so Mossad can track the activities of anyone using it, then Maxwell sells it around the world (including back to the U.S. -- with the trap door)."
What are some examples?
The NSA's capabilities back in 2008 were pretty astonishing: "RAGEMASTER" A $30 device that taps a VGA cable and transmits the contents of your screen to the NSA van sitting outside! Crazy stuff. Makes you wonder what they've built in the last 15 years.
https://en.wikipedia.org/wiki/Triton_(malware) (https://www.justice.gov/opa/pr/four-russian-government-emplo...)