On the other hand, if I were a non-chinese hacker trying to do evil, then using a chinese handler does make more sense (China is evil, blah blah blah)
1. Might not have the vocabulary to express themselves correctly
2. Not understand the nuance and connotations that their word choices imply
I've seen my colleagues get frustrated in meetings while simulatenously having to assume good intent.
Choosing names like the bad actor(s) did gives them an advantage in this scenario.
If someone has the additional details to reproduce the backdoor, please let me know and I'll add these files in the repository.
- First, we're not discussing the English level of the general Chinese population, but specifically of the group that's also good at programming. That conditional probability is much higher.
- Even if we did speak of the general Chinese population, that is a lot of people so something rare in that group is true for many people still!
- It's not like everyone in the US has great English either. (Though open source maintainers are again probably more likely to.)
That's the group I was discussing. Higher for sure, but still not high. (Remember we're talking about Chinese nationals, not Chinese ethnicity.)
> so something rare in that group is true for many people still
Yes but we're talking probabilities so the total population size is irrelevant. You're the one making the statistical mistake here.
> It's not like everyone in the US has great English either. (Though open source maintainers are again probably more likely to.)
Answered your own question there.
And China has been enticing ethnic Chinese who grew up in the West to "come back to the Motherland" with promises of riches for a long time now. Quite a few made the switch, too. I very much doubt that finding a native English speaker is a problem if it's the PRC govt.
It does make it less likely to be Russia, though. Although of course this could always just be subcontracted.
Western and Chinese are not the only possibilities, it could be a Russian, or Indian or pretty much anywhere else that engages in intelligence gathering operation.
They also used a sock puppet with a seemingly German name (Hans Jansen). However "Hans" has not been a popular baby name in German speaking countries for many decades. You'd expect any "Hans" to be over 70 or 80 by now. Unless they are American, like Hans Niemann.
This could be a cultural oversight on the attacker's side, which points towards any culture that has a wide spread belief that typical German names are Hans or Fritz. From my experience, that is especially true for English speaking countries, mainly because of stereotypes displayed in Hollywood WWII movies. I wouldn't be surprised if cultural perception of Germany was different in China.
Edit: some clarifications
Jansen is a Danish/Norwegian surname and Hans is still fairly popular in Denmark.
https://www.dst.dk/en/Statistik/emner/borgere/navne/navne-i-...
Edit: Another country that seems to have retained popularity for "Hans" for a longer time than Germany is the Netherlands. According to [2], its popularity seems to have gone down significantly as well, with a further sharp dropoff in the 90s.
There are plenty of other names to choose from if you want to create a fake personality. It's curious they chose one that sticks out among the age cohorts you would expect participating on Github.
[1] https://www.dst.dk/en/Statistik/emner/borgere/navne/navne-ti...
Ironic.
> > This could be a cultural oversight on the attacker's side,
What would raise my hackles would be someone with a name that codes western who had grammatical idiosyncrasies common to ESL Asians.
A better assumption imo is they chose their identity first and foremost with the intent to garner trust first with Lasse Collin.
Opposite is true. His activity is focused around midnight in UTC+0800, with significant activity at 2AM in that timezone.
1) Why not?
2) You'd likely want a relatively common-sounding name, I suppose. Chinese names are relatively common-sounding.