Deep Dive into XZ Utils Backdoor – Columbia Engineering Guest Lecture [video]

Re:Deep Dive into XZ Utils Backdoor – Columbia Engineering G... by defrost on Tuesday April 30, 2024 @05:42AM (#40209008)

> or is meant to.

Indeed. If it's nation state and years in the making then the idea of all the commit times being faked isn't a stretch.

Hell, even five-eyes (UK+AU+US+etc) could seek a linux backdoor and use Perth, Australia (GMT+8) timezones or have a submission bot in the UK that just commits at preset time from preset IP proxy.

[ Parent | on HN ]

Re:Deep Dive into XZ Utils Backdoor – Columbia Engineering G... by throwaway4good on Tuesday April 30, 2024 @07:11AM (#40209672)

I would guess the guy that maintained the Jia Tan identity was working out of Australia.

The time zone is consistent with Western Australia and the work starts by "branching out" a not widely used Australian test framework.

The actual attack is probably done by someone else.

[ Parent | on HN ]