Hacker News Reader

Hacker News

Comment by magic_hamster | Hacker News Reader

Parent Full thread

magic_hamster

This is 100% a state actor. We can also kind of narrow down who.

View on HN

Based on the Chinese-sounding name alone? They also used two other sock puppet accounts that sound Indian and Anglo:

https://boehs.org/node/everything-i-know-about-the-xz-backdo...

And a Scandinavian and a Russian sock puppet too.

The chinese name may be a red herring, as it's mixing mandarin and cantonese namtes.

The author's name may be a decoy. I'd have done that.

As someone on reddit mentioned yesterday "Jia Cheong Tan" is an anagram of "CIA Agent John". Which may be accidental or a funny pun by the backdoor coder.

That would be far from unlikely.

But have we seen anything that would require more than a very smart individual with some time on his hands?

No, but the patience is quite amazing which makes me think it is someone who is employed to do this either by an intelligence agency or by a major ransomware company.

Of course it could just be a very patient person.

I think the undersold part with the patience/timeline taking years is that “Jia” surely has more identities and scams in play.

Everyone making products used as supply chain components for someone else should be looking at the timeline and considering which of their developers might match the same pattern.

I do not believe that “Jia” had only one iron in the fire.

I wouldn't make a Pikachu face if it was proven to be a major actor.

But the "amazing patience" is not at all unusual among people who work on open source projects for fun, right?

And what would the payday have been for a single individual who managed to get this backdoor deployed in all major distributions? How much is something like that worth on the black market? Tens of millions of dollars?

How?

most people now will say something about the commit timestamps indicating this is an Eastern European actor, but it seems like any sufficiently dedicated intelligence service could script their commits or even assign a person to keep certain sleep/wake hours just to falsify that data

And what do office hours mean to a dedicated hacker?

Reply on news.ycombinator.com