Deep Dive into XZ Utils Backdoor – Columbia Engineering Guest Lecture [video]

Re:Deep Dive into XZ Utils Backdoor – Columbia Engineering G... by throwaway4good on Tuesday April 30, 2024 @02:29AM (#40207847)

And from Microsoft / GitHub - who would have a lot additional information (logs, ip-adresses, use of two-factor auth etc.)? Have they made a statement?

Usually Microsoft etc. don't hold back identifying "threat actors".

Is there a US police investigation ongoing that could ask Microsoft? The target of this attack has been US firms / persons so if they report it, I assume a US police investigation would be required.

[ Parent | on HN ]

Re:Deep Dive into XZ Utils Backdoor – Columbia Engineering G... by chrizel on Tuesday April 30, 2024 @03:10AM (#40208074)

> And from Microsoft / GitHub - who would have a lot additional information (logs, ip-adresses, use of two-factor auth etc.)? Have they made a statement?

Based on a HN comment from a couple of weeks ago, by analyzing the attackers IP addresses from IRC chat logins, it seems they used a VPN service. If you think about it, it makes sense to always use VPN when doing an operation like this. So I think the ip addresses won't be of much use.

[ Parent | on HN ]

Re:Deep Dive into XZ Utils Backdoor – Columbia Engineering G... by heavyset_go on Tuesday April 30, 2024 @03:27AM (#40208158)

Might be able to tell which VPN service they used and can then subpoena it.

[ Parent | on HN ]

Re:Deep Dive into XZ Utils Backdoor – Columbia Engineering G... by gzer0 on Tuesday April 30, 2024 @04:19AM (#40208460)

Based on the sophistication we've seen, they probably used Mullvad for their VPN. In that case, a subpoena wouldn't turn up anything.

[ Parent | on HN ]

Re:Deep Dive into XZ Utils Backdoor – Columbia Engineering G... by mtsr on Tuesday April 30, 2024 @04:44AM (#40208627)

I don’t know if it’s been tried, but if not it would be in everyone’s interest to see what Mullvad will actually cough up.

[ Parent | on HN ]

Re:Deep Dive into XZ Utils Backdoor – Columbia Engineering G... by emayljames on Tuesday April 30, 2024 @05:13AM (#40208809)

it would be the end of their business if they did, as they have a strict no retention policy. This would mean they are lying to all their customers, so it is not going to happen.

[ Parent | on HN ]

Re:Deep Dive into XZ Utils Backdoor – Columbia Engineering G... by trogdor on Tuesday April 30, 2024 @01:38PM (#40213667)

I have seen NordVPN’s response to a subpoena. Their response was that they had no records connecting an IP address at a specific date/time to any particular person.

[ Parent | on HN ]

Re:Deep Dive into XZ Utils Backdoor – Columbia Engineering G... by INTPenis on Tuesday April 30, 2024 @02:35AM (#40207884)

Not that I know of. I'm sure that statement will be reserved for law enforcement.

[ Parent | on HN ]