Put yourself in Jia Tan's shoes, the malicious contributor to the xz backdoor...
It's been, what, two... three?... years since you started this campaign. You've had the entire support of your team and of your chain of command.
Your coders created a complex and sublime backdoor. A secure! backdoor that only you and your team could connect to. Heck it can even be deleted remotely. This is clean code. A responsible hack that doesn't open up the backdoor for others to hijack.
You spend years on your long con - your social engineering skills are at the top of the game. You've ingratiated yourself painstakingly into multiple teams. Finally it all pays off and you're ready to go!
You succeed multiple times in getting your backdoor inserted in all the major Linux distributions!!! Now its just a matter of weeks before it makes it to production and stable releases!
This is the culmination of years of labor and planning and of a massive team and budget.
You did good.
This will get you promoted. Esteemed by your colleagues and leadership alike. Your spouse and kids will understsnd why you haven't been at home lately and why you've spent all those late nights at the office.
It's finally going to pay off.
But what's this?! Some rando poking around in their box running a pre-release unstable version of linux has found everything?!?! It's all being ripped down?! And on a Friday before a western holiday weekend?!?!
Fuck. Fuck. FUCK!!!
Three years for nothing!!! My wife is going to leave me! I missed my kid's recital for this!!! They'll hate me because I told them it was worth it. Daddy will be able to play with you again once Daddy finishes this last bit of work. But it was all for nothing!!!
Leadership took a big risk on me and my team but I kept assuring them it would pay off!
It would be one thing if another nation state found it and stopped it. But one random dude poking his nose where it shouldn't belong?! Ohhh fuck, I'm going to be fired. We're going to lose our budget. My team is going to be fired. I've let down everyone that ever believed in me and supported me and relied on me!
Oh fuck!!!
#xz #backdoor #cve #cve20243094 #infosec #hacking #FOSS
Tinker ☀️ /
npub1hq…ent6l
2024-04-01 13:24:08
Author Public Key
npub1hqevlj9hckkq0t30yachlqr06pcf8avevw9v5h8areekx3z2y54shent6lPublished at
2024-04-01 13:24:08Event JSON
{
"id": "e8d46a451e7f6b2341f3ca9b2ccbb3160a375f60b6234c9a4c93163f032c81b9",
"pubkey": "b832cfc8b7c5ac07ae2f27717f806fd07093f599638aca5cfd1e7363444a252b",
"created_at": 1711977848,
"kind": 1,
"tags": [
[
"t",
"xz"
],
[
"t",
"hacking"
],
[
"t",
"foss"
],
[
"t",
"backdoor"
],
[
"t",
"cve"
],
[
"t",
"cve20243094"
],
[
"t",
"infosec"
],
[
"proxy",
"https://infosec.exchange/users/tinker/statuses/112196180295212632",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://infosec.exchange/users/tinker/statuses/112196180295212632",
"pink.momostr"
]
],
"content": "Put yourself in Jia Tan's shoes, the malicious contributor to the xz backdoor...\n\nIt's been, what, two... three?... years since you started this campaign. You've had the entire support of your team and of your chain of command.\n\nYour coders created a complex and sublime backdoor. A secure! backdoor that only you and your team could connect to. Heck it can even be deleted remotely. This is clean code. A responsible hack that doesn't open up the backdoor for others to hijack.\n\nYou spend years on your long con - your social engineering skills are at the top of the game. You've ingratiated yourself painstakingly into multiple teams. Finally it all pays off and you're ready to go!\n\nYou succeed multiple times in getting your backdoor inserted in all the major Linux distributions!!! Now its just a matter of weeks before it makes it to production and stable releases!\n\nThis is the culmination of years of labor and planning and of a massive team and budget.\n\nYou did good.\n\nThis will get you promoted. Esteemed by your colleagues and leadership alike. Your spouse and kids will understsnd why you haven't been at home lately and why you've spent all those late nights at the office.\n\nIt's finally going to pay off.\n\nBut what's this?! Some rando poking around in their box running a pre-release unstable version of linux has found everything?!?! It's all being ripped down?! And on a Friday before a western holiday weekend?!?!\n\nFuck. Fuck. FUCK!!!\n\nThree years for nothing!!! My wife is going to leave me! I missed my kid's recital for this!!! They'll hate me because I told them it was worth it. Daddy will be able to play with you again once Daddy finishes this last bit of work. But it was all for nothing!!!\n\nLeadership took a big risk on me and my team but I kept assuring them it would pay off!\n\nIt would be one thing if another nation state found it and stopped it. But one random dude poking his nose where it shouldn't belong?! Ohhh fuck, I'm going to be fired. We're going to lose our budget. My team is going to be fired. I've let down everyone that ever believed in me and supported me and relied on me!\n\nOh fuck!!!\n\n#xz #backdoor #cve #cve20243094 #infosec #hacking #FOSS",
"sig": "dbb213f3a9f7aca1602cd8e26d7d4969070f6f5990566e9d7935613071c70263947d509f7a2b77272503a3c8b38974bbf0674f39a3958efc9322e7fb7c89d236"
}