News for hackers. Stuff that matters.

A comment on XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable.". Parent comment

Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by sneak on Saturday March 30, 2024 @05:21PM (#39878791)
Nah, the CIA assassinates people in MLAT zones all the time. The laws that apply to you and I don’t apply to the privileged operators of the state’s prerogatives.

We don’t even know that this specific backdoor wasn’t the NSA or CIA. Assuming it was a foreign intelligence service because the fake name was asian-sounding is a bit silly. The people who wrote this code might be sitting in Virginia or Maryland already.

[ Parent | on HN ]
Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by tomoyoirl on Saturday March 30, 2024 @05:48PM (#39879010)
> Virginia or Maryland

Eastern Europe, suggest the timestamp / holiday analysts. https://rheaeve.substack.com/p/xz-backdoor-times-damned-time...

[ Parent | on HN ]
Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by WesolyKubeczek on Saturday March 30, 2024 @07:19PM (#39879602)
Note that while “Eastern Europe” has firm connotations with countries of which some are known for having corrupt autocracies, booming shady businesses, and organized crime and cybercrime gangs in varying proportions, the time zone mentioned also covers Finland, from which the other author is supposed to be.
[ Parent | on HN ]
Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by daurentius523 on Sunday March 31, 2024 @04:07AM (#39882390)
Eastern Europe - 25th? Not 24th?
[ Parent | on HN ]
Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by ceejayoz on Saturday March 30, 2024 @05:37PM (#39878932)
> The people who wrote this code might be sitting in Virginia or Maryland already.

Sure, that’s possible. They will as a result probably avoid traveling to unfriendly jurisdictions without a diplomatic passport.

[ Parent | on HN ]
Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by rl3 on Saturday March 30, 2024 @06:38PM (#39879371)
>They will as a result probably avoid traveling to unfriendly jurisdictions without a diplomatic passport.

First of all, it's not like their individual identities would ever be known.

Second, they would already know that traveling to a hostile country is a great way to catch bullshit espionage charges, maybe end up tortured, and certainly be used as a political pawn.

Third, this is too sloppy to have originated from there anyways—however clever it was.

[ Parent | on HN ]