Hacker News Reader

Comment by toxik | Hacker News Reader

I take it you haven’t looked into the details of this, there is no proof but there is strong evidence in name choice, language use and the MO.

View on HN

I strongly disagree. If you scratch the surface you find ”misoeater” and some russian sounding user names, and even a danish name. These are all fake profiles and gives us no information about the bad actor.

Spreading doubt is taught in bad actor-academy.

Name choice I disagree with. The attacker used at least Chinese, Indian and Scandinavian names when working on this. It is possible we can find out something by doing a statistical analysis of the language but as far as I know no such analysis has been done.

Edit: A Russian sounding alias was also used.

My current hypothesis is that the attacker(s) deliberately chose a Chinese-sounding name to make people jump to conclusions. A sophisticated state actor would be no stranger to making their actions look like somebody else's.

Or maybe they actually are Chinese, and want me to believe the sentence above. :)

Indeed - seeing the level of sophistication and long term thinking behind this attack, it seems everything about it was planned meticulously, including usernames, attack vectors, communication with the community, and when to commit the parts of the exploit. There's probably a full team of people behind it and attributing it to China because of the username may be too quick.

That is rather naive thinking. Making up a misleading identity is probably one of the first things someone with such a long term plan would do.

And time zone as well it seems

Reply on news.ycombinator.com