News for hackers. Stuff that matters.

A comment on Backdoor in upstream xz/liblzma leading to SSH server compromise.

Re:Backdoor in upstream xz/liblzma leading to SSH server com... by mikolajw on Friday March 29, 2024 @04:41PM (#39868773)
Tukaani website states "jiatan" as the nickname of the malicious code committer on Libera Chat.

WHOWAS jiatan provided me the following information:

jiatan ~jiatan 185.128.24.163 * :Jia Tan jiatan 185.128.24.163 :actually using host jiatan jiatan :was logged in as jiatan tungsten.libera.chat :Fri Mar 14:47:40 2024

WHOIS yields nothing, the user is not present on the network at the moment.

Given that 185.128.24.163 is covered with a range-block on the English Wikipedia, it appears this is a proxy.

[ Parent | on HN ]
Re:Backdoor in upstream xz/liblzma leading to SSH server com... by chrononaut on Friday March 29, 2024 @06:05PM (#39869491)
> it appears this is a proxy.

Yes, that IP address appears associated with witopia[.]net, specifically vpn.singapore.witopia[.]net points to that IP address.

[ Parent | on HN ]