> A bit random, but has there been speculation on why this seemed to only target rpm/deb packaging?
The payload only works on systems that connect their sshd to systemd-notify -- which is not true for many Linux distributions beyond Debian-based and RH-based anyway (e.g. Arch Linux doesn't do this).
Hi all! One of the authors of the original piece here. Thanks for all your comments – we picked up a lot of cool ideas for future analyses. Just to address four common objections:
- We agree it's unclear whether this was one person, or several ones. But even if it was a team, the timezone idea would still tell us where the team is located (the timings seem too much like regular office hours for a globally distributed team).
- It's also absolutely possible that commit times were changed, or commits were made/uploaded using timed scripts. Still seems like it would be hard in practice to use this to cover up a massive difference in timezone, though, because it would require adding a massive latency -- and xz wasn't developed in a vacuum, but in reaction to other online events like the filing of issues or mailing list posts.
- yes, we did get the two examples mixed up (the two times we say are 10-ish hours apart are actually only minutes apart, and the times we say are minutes apart, are 10-ish hours apart). Update is on the way.
- and finally, yes, UTC+2/3 goes beyond just Eastern Europe and includes part of the Middle East. We also clarified this in an update to the article.
The payload only works on systems that connect their sshd to systemd-notify -- which is not true for many Linux distributions beyond Debian-based and RH-based anyway (e.g. Arch Linux doesn't do this).