Deep Dive into XZ Utils Backdoor – Columbia Engineering Guest Lecture [video]

Re:Deep Dive into XZ Utils Backdoor – Columbia Engineering G... by rwmj on Tuesday April 30, 2024 @03:40AM (#40208230)

CISA (https://cisa.gov) are investigating. They got the emails between me and "Jia Tan" and other information we have. They can subpoena Google to get IP addresses behind the emails, but it depends on whether and where a VPN was used if they'll get any further than that. If we will ever see a fully public report is anyone's guess.

[ Parent | on HN ]

Re:Deep Dive into XZ Utils Backdoor – Columbia Engineering G... by emayljames on Tuesday April 30, 2024 @05:17AM (#40208839)

I doubt much will end up public, as most vpns have a zero retention policy, so that leaves the NSA being able to track things at a lower level.

[ Parent | on HN ]

Re:Deep Dive into XZ Utils Backdoor – Columbia Engineering G... by yonatan8070 on Tuesday April 30, 2024 @08:00AM (#40210048)

If it's a state actor, it's not unreasonable to think they'd spin up their own VPN

All you need a Raspberry Pi and some public Wi-Fi network to create a jump point and hide among the 100s of devices going on and off that one public IP. With projects like TailScale you could set it up and plant it somewhere in a matter of hours

[ Parent | on HN ]

Re:Deep Dive into XZ Utils Backdoor – Columbia Engineering G... by lrvick on Tuesday April 30, 2024 @08:18AM (#40210206)

If it is a state actor like China or North Korea, they own the gateways and firewalls and can ensure any traffic they do not want to be identified ever will be.

[ Parent | on HN ]

Re:Deep Dive into XZ Utils Backdoor – Columbia Engineering G... by nailer on Tuesday April 30, 2024 @06:39AM (#40209443)

> most vpns have a zero retention policy

I thought most VPNs sold usage data to ad companies?

[ Parent | on HN ]

Re:Deep Dive into XZ Utils Backdoor – Columbia Engineering G... by acheong08 on Tuesday April 30, 2024 @07:35AM (#40209863)

You would think they’d choose a good one.

I also recently wrote a single ephemeral socks5 proxy over a hidden service in Rust. Since they’ve probably compromised other machines in the past, they could’ve easily used something similar to proxy their connection through tor and to some random computer (access some vulnerable router through tor, proxy through it, etc). Hiding your tracks aren’t hard

[ Parent | on HN ]

Re:Deep Dive into XZ Utils Backdoor – Columbia Engineering G... by hnarn on Tuesday April 30, 2024 @07:35AM (#40209865)

I think we can safely assume they did not use one of those.

[ Parent | on HN ]