5 ms·
FBI could subpoena GitHub for IP addresses.
by juitpykyk 2y ago
FBI could subpoena GitHub for IP addresses.
- tobyp- 2y agoConsidering what the account was up to I sincerely doubt it was being used without Tor or a VPN.
- chgs 2y agoThis article asserts some opsec failures - time zones switching when they shouldn’t etc. It’s quite plausible that they didn’t manage perfect vpn usage every single time.
- netsharc 2y agoI'm surprised they didn't set up guards to prevent mistakes like commits with the "wrong" timezones...
- Karellen 2y agoExpert level opsec - very rarely make deliberate "mistakes" by having an inconsistent timezone, or tunneling through someone's compromised home device instead of a VPN, to throw adversaries on wild goose chases.
- fullstop 2y agoThey also committed with a different email address and a different name once or twice. This may have been intentional, though, to misdirect.
- arp242 2y agoProbably; but ask Ross Ulbricht how easy it is to screw that up. The thing is you only need to make a mistake once.
- gpm 2y agoThey probably have/will, though we are unlikely to find out what they get unless they manage to arrest/charge/try him. Jia Tan probably used a vpn though - we know that they did for accessing IRC (source: https://boehs.org/node/everything-i-know-about-the-xz-backdoor https://boehs.org/node/everything-i-know-about-the-xz-backdo...)
- cft 2y agoMost (but not all ) VPN providers keep logs and payment info that are subpoenable. You could use something like Mulvad with Lightning Network payments, but I am not sure that even that is fully anonymous. The Witopia VPN that he used for IRC [1] is US based: https://www.personalvpn.com/contact-us/ https://www.personalvpn.com/contact-us/ and they don't mention neither LN payments nor not keeping logs. 1. "~jiatan@185.128.24.163" https://boehs.org/node/everything-i-know-about-the-xz-backdoor https://boehs.org/node/everything-i-know-about-the-xz-backdo...
- FredFS456 2y agoMullvad accepts cash in an envelope with no return address, good luck tracing that
- transpute 2y agoPostal mail has non-zero metadata, e.g. origin can be traced at least to departure postal code.
- jeltz 2y agoDeparture postal code could be an area with like 1 million people. And if it is a nation state I am sure they could send the mail from another country.
- transpute 2y agoMost populous US zip code is less than 150K people, https://worldpopulationreview.com/zips https://worldpopulationreview.com/zips
- pquki4 2y agoNot going to be useful if they consistently used a VPN to access GitHub. But people make mistakes sometimes.
- earslap 2y agohistory shows that it is generally very hard to not slip up here and there, especially if you are not expecting to be a huge target.
- deleted 2y ago[deleted]
- deleted 2y ago[deleted]
- xuki 2y agoBut Sir The Calls Are Coming from Inside the House!
- BlueFalconHD 2y agothis [1] but with handcuffs [1] https://i.redd.it/obvqaa0lhn841.jpg https://i.redd.it/obvqaa0lhn841.jpg
- champtar 2y agoThe ssh public key might also be interesting, given the opsec failures, they might have used it for other accounts / at other providers
- BlueFalconHD 2y agoIf a US gov. agency is "Jia Tan" then this might not happen.