Hacker News Reader

Comment by mattlondon | Hacker News Reader

I often wonder with these sort of things, where there are lots of write-ups by geeks who dive-deep into the details, why do people say "This has to be state sponsored!", "Look at the timestamps! Irrefutable proof!"

Yes this was sneaky and yes this was a "slow burn" but is there really anything in the xz case that requires more than just a single competent person? Anything that requires state-level of sponsorship? The fact that random individuals online are able to dissect it and work things out suggests that it is comprehendible by a single person.

What is to say it that this was not just one smart-yet-disgruntled person acting alone?

View on HN

The biggest thing for me that points to a state actor is the amount of time committed to the social engineering attack versus the expected value of the prize. A for-profit scheme built this way would be irrational, which doesn't preclude it being an irrational actor (or an individual with a motive other than profit) but does point to a state actor as a likely candidate.

The total value of the prize, if successful, would be worth a lot if you could sell it, but the odds of successfully getting an exploit into major infrastructure that goes undetected for long enough for your customers to buy and use it are tiny. States can afford moonshots, but I tend to expect private individuals to seek targets with a higher expected value.

Of course, that doesn't mean it was a competent state actor or that they allocated a ton of resources to it.

> I tend to expect private individuals to seek targets with a higher expected value.

If you're a very skilled and dedicated hacker, what other targets do you have that can net you many millions of dollars?

> or an individual with a motive other than profit

Isn't one of the most striking things about the hacker community the extreme amounts of time and effort that are put into things that are not expected to generate any profit?

I mean, there are people who spend all their free time over several decades just digging tunnels under their property. Or build a 6502 CPU from discrete transistors. Etc.

> Isn't one of the most striking things about the hacker community the extreme amounts of time and effort that are put into things that are not expected to generate any profit?

You're conflating the hacker-as-in-threat-actor community with the hacker-as-in-Linux-maintainer community.

Sure, generally speaking, people who try to break into computer systems for profit do not have a lot of overlap with people who spends lots of time writing open source software for fun.

But in this case it is not hard to imagine that the XZ-perpetrator came from the second group, right?

Edit: I mean, this wouldn't be that different from when Ken Thompson demonstrated how to do a hidden backdoor in the C compiler?

I agree.

The hack took someone with a lot of skills, determination and time.

But doesn't that describe a significant portion of open source developers?

There is also clear motivation. Wouldn't the exploit have been worth many millions on the black market?

There is nothing. Nobody has any idea who he is

> "...Irrefutable proof!"

Cite, on that? I have seen a lot of speculation from people in the know, but not this.

Reply on news.ycombinator.com