Some timezone observations on the recently discovered backdoor hidden in an xz tarball.
  • bizdelnickEnglish
    10·
    3 months ago

    almost no one lives in Siberia

    LOL, seriously? There are ~1 mln people living in Irkutsk, Bratsk and Angarsk (all UTC+8). And there are much bigger cities in UTC+7 like Novosibirsk and Krasnoyarsk. Of course there are much fewer people than in China but that’s not “almost no one”.

    However I agree that the malicious actor is likely from Europe or Middle East. I also investigated their activitity time but instead of commit timestamps that are easy to fabricate I looked at their GitHub activity time. Unfortunately, the GitHub API only allows to get events for the latest 90 days, but that is enough make some guesses (but not to say if they live in a country with the daylight savings time switchover).

    Below are extracted timestamps for those who want to examine them.

    timestamps 
    "2024-03-28T14:59:59Z"
"2024-03-28T13:27:31Z"
"2024-03-26T12:11:30Z"
"2024-03-26T12:09:32Z"
"2024-03-25T17:14:47Z"
"2024-03-25T17:08:06Z"
"2024-03-25T16:47:59Z"
"2024-03-25T14:44:34Z"
"2024-03-22T14:56:41Z"
"2024-03-22T14:54:25Z"
"2024-03-22T14:51:38Z"
"2024-03-22T14:40:30Z"
"2024-03-22T14:40:08Z"
"2024-03-22T12:23:35Z"
"2024-03-22T12:23:23Z"
"2024-03-22T12:15:30Z"
"2024-03-22T11:48:30Z"
"2024-03-22T11:36:21Z"
"2024-03-19T11:47:53Z"
"2024-03-13T16:12:30Z"
"2024-03-13T15:50:19Z"
"2024-03-13T15:27:53Z"
"2024-03-13T14:44:50Z"
"2024-03-11T14:37:02Z"
"2024-03-11T14:37:03Z"
"2024-03-11T12:18:20Z"
"2024-03-09T12:00:46Z"
"2024-03-09T10:46:06Z"
"2024-03-09T10:44:38Z"
"2024-03-09T10:40:57Z"
"2024-03-09T10:40:12Z"
"2024-03-09T09:51:04Z"
"2024-03-09T09:36:25Z"
"2024-03-08T12:06:53Z"
"2024-03-07T17:44:35Z"
"2024-03-05T10:18:48Z"
"2024-03-04T17:55:15Z"
"2024-03-04T17:40:09Z"
"2024-03-04T17:14:39Z"
"2024-03-04T16:49:22Z"
"2024-03-04T15:01:19Z"
"2024-03-02T13:32:49Z"
"2024-03-02T13:32:48Z"
"2024-03-02T13:32:01Z"
"2024-03-02T13:32:02Z"
"2024-03-02T13:23:56Z"
"2024-03-02T13:23:57Z"
"2024-03-02T13:18:34Z"
"2024-02-29T17:35:39Z"
"2024-02-29T17:30:09Z"
"2024-02-29T17:30:10Z"
"2024-02-29T16:56:54Z"
"2024-02-29T16:56:55Z"
"2024-02-29T16:56:03Z"
"2024-02-29T16:56:02Z"
"2024-02-29T16:55:33Z"
"2024-02-29T16:55:34Z"
"2024-02-29T16:52:14Z"
"2024-02-29T16:52:15Z"
"2024-02-29T16:50:01Z"
"2024-02-29T16:50:00Z"
"2024-02-29T16:46:10Z"
"2024-02-29T16:46:11Z"
"2024-02-29T16:44:51Z"
"2024-02-29T16:44:52Z"
"2024-02-29T16:42:00Z"
"2024-02-29T16:41:59Z"
"2024-02-29T16:34:27Z"
"2024-02-29T16:34:28Z"
"2024-02-29T16:33:20Z"
"2024-02-28T16:19:35Z"
"2024-02-28T16:07:33Z"
"2024-02-28T13:33:25Z"
"2024-02-27T16:53:48Z"
"2024-02-27T15:48:22Z"
"2024-02-27T12:29:17Z"
"2024-02-27T12:24:36Z"
"2024-02-26T15:41:14Z"
"2024-02-26T15:36:07Z"
"2024-02-26T15:36:05Z"
"2024-02-26T15:32:33Z"
"2024-02-26T15:30:21Z"
"2024-02-26T15:28:19Z"
"2024-02-26T15:22:10Z"
"2024-02-26T15:11:55Z"
"2024-02-26T13:16:06Z"
"2024-02-26T12:20:09Z"
"2024-02-26T12:07:43Z"
"2024-02-26T12:02:10Z"
"2024-02-26T11:57:55Z"
"2024-02-26T11:49:04Z"
"2024-02-25T13:42:52Z"
"2024-02-25T13:41:06Z"
"2024-02-25T13:41:03Z"
"2024-02-25T03:28:00Z"
"2024-02-24T11:19:45Z"
"2024-02-24T10:09:03Z"
"2024-02-24T10:04:33Z"
"2024-02-24T10:04:07Z"
"2024-02-24T10:01:50Z"
"2024-02-24T09:06:52Z"
"2024-02-23T15:46:22Z"
"2024-02-23T15:43:57Z"
"2024-02-23T13:15:14Z"
"2024-02-23T13:14:15Z"
"2024-02-23T12:48:54Z"
"2024-02-22T17:24:19Z"
"2024-02-22T15:12:43Z"
"2024-02-22T15:07:49Z"
"2024-02-22T15:04:33Z"
"2024-02-22T14:27:52Z"
"2024-02-22T12:50:59Z"
"2024-02-22T12:29:53Z"
"2024-02-22T12:24:57Z"
"2024-02-22T11:52:48Z"
"2024-02-21T17:43:31Z"
"2024-02-21T16:58:49Z"
"2024-02-21T16:57:46Z"
"2024-02-21T16:37:07Z"
"2024-02-21T14:37:25Z"
"2024-02-20T16:33:10Z"
"2024-02-20T15:33:05Z"
"2024-02-20T13:14:52Z"
"2024-02-17T17:14:55Z"
"2024-02-17T14:31:24Z"
"2024-02-17T14:31:23Z"
"2024-02-17T13:13:54Z"
"2024-02-16T14:55:19Z"
"2024-02-15T14:28:08Z"
"2024-02-14T18:25:15Z"
"2024-02-14T18:19:36Z"
"2024-02-14T18:13:29Z"
"2024-02-14T18:05:56Z"
"2024-02-13T15:34:01Z"
"2024-02-12T17:57:06Z"
"2024-02-12T12:43:38Z"
"2024-02-12T12:43:14Z"
"2024-02-10T16:13:09Z"
"2024-02-10T16:12:29Z"
"2024-02-10T16:10:54Z"
"2024-02-10T16:08:51Z"
"2024-02-10T16:03:24Z"
"2024-02-10T16:01:08Z"
"2024-02-09T16:00:37Z"
"2024-02-09T12:09:44Z"
"2024-02-08T12:10:43Z"
"2024-02-07T14:04:54Z"
"2024-02-01T17:42:02Z"
"2024-02-01T12:57:09Z"
"2024-02-01T12:52:50Z"
"2024-02-01T12:52:49Z"
"2024-02-01T12:24:12Z"
"2024-01-31T17:45:59Z"
"2024-01-31T16:41:08Z"
"2024-01-31T16:24:51Z"
"2024-01-31T16:04:26Z"
"2024-01-31T15:30:34Z"
"2024-01-31T12:02:59Z"
"2024-01-31T11:54:46Z"
"2024-01-30T12:58:43Z"
"2024-01-30T12:51:15Z"
"2024-01-29T13:50:48Z"
"2024-01-29T12:08:42Z"
"2024-01-27T16:20:00Z"
"2024-01-27T16:12:13Z"
"2024-01-27T16:05:38Z"
"2024-01-26T13:01:14Z"
"2024-01-26T12:27:04Z"
"2024-01-26T12:22:12Z"
"2024-01-26T12:16:54Z"
"2024-01-26T12:13:18Z"
"2024-01-26T12:13:01Z"
"2024-01-26T12:11:38Z"
"2024-01-26T12:11:22Z"
"2024-01-25T16:39:48Z"
"2024-01-24T17:49:57Z"
"2024-01-24T17:49:27Z"
"2024-01-24T17:39:51Z"
"2024-01-24T17:32:01Z"
"2024-01-24T17:21:18Z"
"2024-01-24T17:07:57Z"
"2024-01-24T16:19:41Z"
"2024-01-24T16:16:53Z"
"2024-01-24T16:12:40Z"
"2024-01-24T15:47:44Z"
"2024-01-24T14:32:56Z"
"2024-01-24T12:12:58Z"
"2024-01-24T12:12:57Z"
"2024-01-24T12:10:59Z"
"2024-01-23T16:41:24Z"
"2024-01-23T15:57:07Z"
"2024-01-23T15:17:33Z"
"2024-01-23T14:18:44Z"
"2024-01-23T12:56:35Z"
"2024-01-22T15:34:19Z"
"2024-01-22T12:06:26Z"
"2024-01-19T15:58:20Z"
"2024-01-19T15:42:21Z"
"2024-01-19T15:40:17Z"
"2024-01-19T15:40:16Z"
"2024-01-19T15:39:19Z"
"2024-01-19T15:24:47Z"
"2024-01-19T15:17:02Z"
"2024-01-19T15:09:41Z"
"2024-01-19T15:08:47Z"
"2024-01-19T14:43:25Z"
"2024-01-19T14:32:29Z"
"2024-01-19T14:17:19Z"
"2024-01-19T12:18:41Z"
"2024-01-18T15:05:38Z"
"2024-01-18T13:16:09Z"
"2024-01-18T12:51:41Z"
"2024-01-17T12:41:17Z"
"2024-01-17T12:29:43Z"
"2024-01-17T12:10:43Z"
"2024-01-16T18:54:11Z"
"2024-01-16T14:08:14Z"
"2024-01-16T13:31:12Z"
"2024-01-16T13:20:44Z"
"2024-01-16T12:10:44Z"
"2024-01-16T12:08:46Z"
"2024-01-16T12:08:33Z"
"2024-01-15T17:41:09Z"
"2024-01-15T14:42:56Z"
"2024-01-15T13:41:37Z"
"2024-01-13T16:01:10Z"
"2024-01-13T15:45:05Z"
"2024-01-13T15:33:58Z"
"2024-01-13T13:19:25Z"
"2024-01-12T14:29:03Z"
"2024-01-11T17:16:22Z"
"2024-01-11T14:05:33Z"
"2024-01-10T13:06:10Z"
"2024-01-10T12:12:53Z"
"2024-01-09T12:46:06Z"
"2024-01-08T15:11:40Z"
"2024-01-08T13:44:08Z"
"2024-01-05T14:53:11Z"
"2024-01-05T13:17:52Z"
    • bizdelnick
      5·
      3 months ago

      If we assume that GitHub activity occurred during working hours 9:00 – 18:00, then the timezone is UTC+0, not UTC+2. There are only 6 events outside that interval, 5 of which occurred between 18:00 and 19:00 UTC.