5 ms·

This may be a dumb question, but is law enforcement investigating this? Is it even technically a crime?

by coleca 2y ago

H8crilA 2y ago
Of course it is a crime. This is in fact more than a crime, it's a counter-intelligence problem, even if done by a non-state actor.
- magic_hamster 2y ago
  This is 100% a state actor. We can also kind of narrow down who.
  - shaky-carrousel 2y ago
    The author's name may be a decoy. I'd have done that.
    - coffeeaddicted 2y ago
      As someone on reddit mentioned yesterday "Jia Cheong Tan" is an anagram of "CIA Agent John". Which may be accidental or a funny pun by the backdoor coder.
  - fl7305 2y ago
    That would be far from unlikely. But have we seen anything that would require more than a very smart individual with some time on his hands?
    - jeltz 2y ago
      No, but the patience is quite amazing which makes me think it is someone who is employed to do this either by an intelligence agency or by a major ransomware company. Of course it could just be a very patient person.
      - SV_BubbleTime 2y ago
        I think the undersold part with the patience/timeline taking years is that “Jia” surely has more identities and scams in play. Everyone making products used as supply chain components for someone else should be looking at the timeline and considering which of their developers might match the same pattern. I do not believe that “Jia” had only one iron in the fire.
      - fl7305 2y ago
        I wouldn't make a Pikachu face if it was proven to be a major actor. But the "amazing patience" is not at all unusual among people who work on open source projects for fun, right? And what would the payday have been for a single individual who managed to get this backdoor deployed in all major distributions? How much is something like that worth on the black market? Tens of millions of dollars?
  - saagarjha 2y ago
    How?
    - irobeth 2y ago
      most people now will say something about the commit timestamps indicating this is an Eastern European actor, but it seems like any sufficiently dedicated intelligence service could script their commits or even assign a person to keep certain sleep/wake hours just to falsify that data
      - fl7305 2y ago
        And what do office hours mean to a dedicated hacker?
  - greggsy 2y ago
    Based on the Chinese-sounding name alone? They also used two other sock puppet accounts that sound Indian and Anglo: https://boehs.org/node/everything-i-know-about-the-xz-backdoor https://boehs.org/node/everything-i-know-about-the-xz-backdo...
    - jeltz 2y ago
      And a Scandinavian and a Russian sock puppet too.
    - VHRanger 2y ago
      The chinese name may be a red herring, as it's mixing mandarin and cantonese namtes.
- alickz 2y ago
  What would the crime be? Misuse of computers? Espionage? Curious as to the legal angle of it
  - H8crilA 2y ago
    This is a ChatGPT-level question :) . Pasting GPT-4 response: If someone is caught installing a backdoor into a software library such as libxz, particularly one that interacts with a secure communication protocol like OpenSSH, they could be charged with several offenses under United States law. The specific charges would depend on the details of the case, but here are some possibilities: 1. Computer Fraud and Abuse Act (CFAA) Violations: The CFAA is the primary federal law in the U.S. for computer crime. It prohibits a variety of different types of computer-related activities, including unauthorized access to a computer system, causing damage to a computer system, trafficking in passwords or similar information, and more. A person who installs a backdoor could be charged with unauthorized access and/or causing damage. 2. Wire Fraud: If the backdoor was used to obtain sensitive information or to cause harm, the person could be charged with wire fraud. This is a federal crime that involves using interstate wire communications to carry out a fraudulent scheme. 3. Identity Theft: If the backdoor was used to steal personal identifying information, the person could be charged with identity theft. 4. Economic Espionage Act (EEA) Violations: If the backdoor was used to steal trade secrets, the person could be charged under the EEA. 5. National Stolen Property Act (NSPA) Violations: If the backdoor was used to steal data or other "property," the person could be charged under the NSPA. 6. The USA PATRIOT Act: If the backdoor was used in a way that could be considered "cyberterrorism," such as causing harm to a critical infrastructure system, the person could be charged under the USA PATRIOT Act. It's also worth noting that if the person was working on behalf of a foreign government or organization, they could be charged with additional crimes, such as espionage. Keep in mind that this is a complex legal issue, and the specific charges would depend on the details of the case. If you're dealing with a situation like this in real life, you should consult with a legal professional.
  - PennRobotics 2y ago
    just a guess: Illegal Electronic Surveillance more of a guess from the below link? 18 U.S.C. § 2512, which prohibits the manufacture, possession, advertisement, sale, and transportation in interstate or foreign commerce of devices that are primarily useful for the surreptitious interception of communications (although is this a hardware-specific prohibition?) https://www.justice.gov/archives/jm/criminal-resource-manual-1040-introduction-criminal-sanctions-illegal-electronic-surveillance https://www.justice.gov/archives/jm/criminal-resource-manual...
- brookst 2y ago
  I’m not sure that all counter-espionage problems are necessarily crimes, in the sense that a specific law was violated.
lambersley 2y ago
In Canada, it would fall into a number of federal laws (Criminal Code) Unauthorized use - 342(1) Mischief in Relation to Data - 430(1.1) Interception private communications - 184(1) Deceit/fraud - 380(1) 1. https://laws-lois.justice.gc.ca/eng/acts/C-46/section-342.1.html https://laws-lois.justice.gc.ca/eng/acts/C-46/section-342.1.... 2. https://laws-lois.justice.gc.ca/eng/acts/c-46/section-430.html https://laws-lois.justice.gc.ca/eng/acts/c-46/section-430.ht... 3. https://laws-lois.justice.gc.ca/eng/acts/c-46/section-184.html https://laws-lois.justice.gc.ca/eng/acts/c-46/section-184.ht... 4. https://laws-lois.justice.gc.ca/eng/acts/c-46/section-380.html https://laws-lois.justice.gc.ca/eng/acts/c-46/section-380.ht...
EasyMark 2y ago
Doubtful if law enforcement is, you can bet that the CIA and NSA and SS are looking into it though hoping to find a thread to pull on the sweater.

This may be a dumb question, but is law enforcement investigating this? Is it even technically a crime?

by coleca 2y ago

This may be a dumb question, but is law enforcement investigating this? Is it even technically a crime?

Of course it is a crime. This is in fact more than a crime, it's a counter-intelligence problem, even if done by a non-state actor.

magic_hamster 2y ago
This is 100% a state actor. We can also kind of narrow down who.
- shaky-carrousel 2y ago
  The author's name may be a decoy. I'd have done that.
  - coffeeaddicted 2y ago
    As someone on reddit mentioned yesterday "Jia Cheong Tan" is an anagram of "CIA Agent John". Which may be accidental or a funny pun by the backdoor coder.
- fl7305 2y ago
  That would be far from unlikely. But have we seen anything that would require more than a very smart individual with some time on his hands?
  - jeltz 2y ago
    No, but the patience is quite amazing which makes me think it is someone who is employed to do this either by an intelligence agency or by a major ransomware company. Of course it could just be a very patient person.
    - SV_BubbleTime 2y ago
      I think the undersold part with the patience/timeline taking years is that “Jia” surely has more identities and scams in play. Everyone making products used as supply chain components for someone else should be looking at the timeline and considering which of their developers might match the same pattern. I do not believe that “Jia” had only one iron in the fire.
    - fl7305 2y ago
      I wouldn't make a Pikachu face if it was proven to be a major actor. But the "amazing patience" is not at all unusual among people who work on open source projects for fun, right? And what would the payday have been for a single individual who managed to get this backdoor deployed in all major distributions? How much is something like that worth on the black market? Tens of millions of dollars?
- saagarjha 2y ago
  How?
  - irobeth 2y ago
    most people now will say something about the commit timestamps indicating this is an Eastern European actor, but it seems like any sufficiently dedicated intelligence service could script their commits or even assign a person to keep certain sleep/wake hours just to falsify that data
    - fl7305 2y ago
      And what do office hours mean to a dedicated hacker?
- greggsy 2y ago
  Based on the Chinese-sounding name alone? They also used two other sock puppet accounts that sound Indian and Anglo: https://boehs.org/node/everything-i-know-about-the-xz-backdoor https://boehs.org/node/everything-i-know-about-the-xz-backdo...
  - jeltz 2y ago
    And a Scandinavian and a Russian sock puppet too.
  - VHRanger 2y ago
    The chinese name may be a red herring, as it's mixing mandarin and cantonese namtes.
alickz 2y ago
What would the crime be? Misuse of computers? Espionage? Curious as to the legal angle of it
- H8crilA 2y ago
  This is a ChatGPT-level question :) . Pasting GPT-4 response: If someone is caught installing a backdoor into a software library such as libxz, particularly one that interacts with a secure communication protocol like OpenSSH, they could be charged with several offenses under United States law. The specific charges would depend on the details of the case, but here are some possibilities: 1. Computer Fraud and Abuse Act (CFAA) Violations: The CFAA is the primary federal law in the U.S. for computer crime. It prohibits a variety of different types of computer-related activities, including unauthorized access to a computer system, causing damage to a computer system, trafficking in passwords or similar information, and more. A person who installs a backdoor could be charged with unauthorized access and/or causing damage. 2. Wire Fraud: If the backdoor was used to obtain sensitive information or to cause harm, the person could be charged with wire fraud. This is a federal crime that involves using interstate wire communications to carry out a fraudulent scheme. 3. Identity Theft: If the backdoor was used to steal personal identifying information, the person could be charged with identity theft. 4. Economic Espionage Act (EEA) Violations: If the backdoor was used to steal trade secrets, the person could be charged under the EEA. 5. National Stolen Property Act (NSPA) Violations: If the backdoor was used to steal data or other "property," the person could be charged under the NSPA. 6. The USA PATRIOT Act: If the backdoor was used in a way that could be considered "cyberterrorism," such as causing harm to a critical infrastructure system, the person could be charged under the USA PATRIOT Act. It's also worth noting that if the person was working on behalf of a foreign government or organization, they could be charged with additional crimes, such as espionage. Keep in mind that this is a complex legal issue, and the specific charges would depend on the details of the case. If you're dealing with a situation like this in real life, you should consult with a legal professional.
- PennRobotics 2y ago
  just a guess: Illegal Electronic Surveillance more of a guess from the below link? 18 U.S.C. § 2512, which prohibits the manufacture, possession, advertisement, sale, and transportation in interstate or foreign commerce of devices that are primarily useful for the surreptitious interception of communications (although is this a hardware-specific prohibition?) https://www.justice.gov/archives/jm/criminal-resource-manual-1040-introduction-criminal-sanctions-illegal-electronic-surveillance https://www.justice.gov/archives/jm/criminal-resource-manual...
brookst 2y ago
I’m not sure that all counter-espionage problems are necessarily crimes, in the sense that a specific law was violated.

lambersley 2y ago

In Canada, it would fall into a number of federal laws (Criminal Code) Unauthorized use - 342(1) Mischief in Relation to Data - 430(1.1) Interception private communications - 184(1) Deceit/fraud - 380(1) 1. https://laws-lois.justice.gc.ca/eng/acts/C-46/section-342.1.html https://laws-lois.justice.gc.ca/eng/acts/C-46/section-342.1.... 2. https://laws-lois.justice.gc.ca/eng/acts/c-46/section-430.html https://laws-lois.justice.gc.ca/eng/acts/c-46/section-430.ht... 3. https://laws-lois.justice.gc.ca/eng/acts/c-46/section-184.html https://laws-lois.justice.gc.ca/eng/acts/c-46/section-184.ht... 4. https://laws-lois.justice.gc.ca/eng/acts/c-46/section-380.html https://laws-lois.justice.gc.ca/eng/acts/c-46/section-380.ht...

EasyMark 2y ago

Doubtful if law enforcement is, you can bet that the CIA and NSA and SS are looking into it though hoping to find a thread to pull on the sweater.