J is for Jia Tan — The Long Game, or How to Become the Trusted Insider

The Alphabet of Actors — Letter J. A named-entity dossier: who they are in the record, what the LSN systems catch of their kind today, and a status verdict — ACTIVE, DEFUNCT, REBRANDED, PROSECUTED, ABSORBED, INDICTED, DISBANDED, EXPOSED, DISSOLVED, UNDETERRED, NORMALIZED, SANCTIONED, CAUGHT.

A thread has been running through this register, letter by letter, and it is worth naming before this one, because Jia Tan is where it ends. Blue Coat (Letter B) read encrypted traffic by holding a certificate the client had been made to trust. Chengdu 404 (Letter C) signed its malware with code-signing certificates stolen from real software companies. FinFisher (Letter F) delivered its implant disguised as a routine software update the user trusted. Each of them attacked the same thing — the trust that cryptography and software distribution are built to establish — and each did it by borrowing legitimacy: a certificate held, a certificate stolen, an update faked. In every case there was a forged or misappropriated artefact, and in every case the forgery was, in principle, detectable.

Jia Tan did something none of them did, and it is the reason this is the most quietly frightening letter in the alphabet. Jia Tan did not borrow legitimacy. It earned it. It did not steal the trusted maintainer's key or impersonate the trusted maintainer; it became the trusted maintainer — patiently, over years, through legitimate-looking work — and then, from that position of earned trust, planted a backdoor in a piece of software that sits, invisibly, inside a very large fraction of the internet's servers. There was no stolen key to revoke and no forged signature to catch, because the malicious code was committed and signed by the project's own real, trusted developer, who was the attacker all along.

This is the letter about the long game: about weaponising the trust and the goodwill that the entire open-source world runs on, about the near-catastrophe that a stranger's half-second of curiosity narrowly prevented, and about an actor who, when discovered, simply evaporated, having never once used a real name.

1. The Actor: a name that is not a name

Jia Tan is not a person, as far as anyone has been able to establish. It is an identity — a username, a set of email addresses, a contribution history — with no verified human behind it. And that is the first thing to understand about this actor, because it inverts the register's usual pattern. Most of the earlier letters had too much attribution: named executives, indicted officers, passport photographs. This one has almost none. Jia Tan is a persona built specifically to be a persona, and when the operation was blown, the persona was abandoned, leaving investigators with a rich record of what the actor did and essentially nothing about who the actor was.

What the actor did was join an open-source project. XZ Utils is a small, unglamorous data-compression library and command-line tool — the kind of dependency that almost no one thinks about and almost everything uses, bundled into Linux distributions and, crucially, pulled through a chain of dependencies into the process of the SSH daemon on many systemd-based systems. It was maintained, for years, by essentially one person: Lasse Collin, an unpaid volunteer. Around 2021, a new contributor calling itself Jia Tan began submitting patches. The patches were useful. The contributor was helpful, persistent, reliable — everything an exhausted solo maintainer dreams of in a volunteer. Over roughly two to three years, Jia Tan built exactly the reputation such a contributor earns: trusted, competent, deserving of more responsibility.

That is the whole tradecraft, and it is what makes the actor different from every other in this register. There was no exploit, no theft, no intrusion — not at first. There was a false identity, patience, and the slow accumulation of genuine-looking merit, aimed at a single human being's trust. The weapon was time. The target was a person's willingness to believe that a helpful stranger was what he appeared to be.

2. The Instrument: trust, earned and then detonated

The mechanism by which a helpful contributor became a co-maintainer with the authority to ship a backdoor is the part of the story that should trouble anyone who has ever maintained anything alone, because it did not rely on a technical failure. It relied on manufactured social pressure.

According to the reconstruction assembled from the project's own public mailing lists after the fact, Jia Tan's rise was assisted by other personas. Accounts with names like 'Jigar Kumar' and 'Dennis Ens' appeared in the project's discussions and publicly pressured Lasse Collin — complaining about slow progress, pushing him to add a co-maintainer, questioning whether he was still up to the job. Collin, by his own contemporaneous account, was burned out, dealing with unpaid work and personal strain, doing a thankless task that the entire computing world depended on and almost no one supported. Into that exhaustion came the pressure to hand off responsibility, and the ready, eager, trusted volunteer to hand it to. The social engineering did not target a firewall. It targeted a tired man's sense of obligation, and it worked.

Once Jia Tan held commit and release authority, the actual weapon went in — and it, too, was built to defeat trust rather than break security. The backdoor was not in the human-readable source code where a reviewer might see it. It was hidden in binary test files — blobs that look like meaningless test data — and assembled at build time by a modified build script, so that the malicious code appeared only in the released tarballs, not in the version a casual reviewer would read on the project's repository. The payload, when built into liblzma and loaded by the SSH daemon, was engineered to hijack authentication: to let the attacker who held the right secret key bypass the login and gain covert remote access. Catalogued as CVE-2024-3094, it was, had it shipped, a master key to a substantial share of the internet's Linux servers — placed there not by breaking in, but by being trusted to have the key to the door in the first place.

3. The Near-Miss: half a second, and a curious stranger

The XZ backdoor is usually told as a triumph, and in outcome it was one: it was caught before the compromised versions reached the stable releases that most of the world runs. But the manner of the catch is the most important fact in the letter, and it is not triumphant. It is luck.

The compromised versions of XZ Utils had begun to filter into the testing and unstable branches of major Linux distributions — Debian, others — on their way to the stable releases that flow onto servers everywhere. They were days from that final step. And they were found because Andres Freund, a Microsoft engineer, was benchmarking something entirely unrelated to security, noticed that the SSH daemon was using more CPU than expected and logins were running about half a second slower than they should, and — for no reason other than ordinary engineering curiosity — decided to find out why. He pulled the thread, and at the end of it was the backdoor. He disclosed it on the open-source security mailing list on 29 March 2024, and the world's distributions scrambled to pull the poisoned versions before they shipped.

Sit with how thin that was. No scanner caught it; the payload was designed to be invisible to scanners. No code review caught it; the malicious part was not in the reviewed code. No process built to detect supply-chain backdoors caught it, because the defences against exactly this were, and largely remain, inadequate. What caught it was a performance regression of roughly five hundred milliseconds and one person who happened to care why. Had the attacker been slightly more careful about the overhead — and every attacker who studied this case now knows to be — or had Freund been slightly less curious, the backdoor would have shipped, and a very large number of the internet's servers would have had a hidden door with someone else's key in the lock. The system did not save us. An accident did.

4. The Structure: the nobody problem

Underneath the tradecraft is a structural condition without which the attack could not have happened, and it is the part of this story with the widest implications, because it is true of thousands of other libraries right now.

There is an old joke in the security world, drawn as a cartoon: the entire edifice of modern digital infrastructure depicted as a precarious tower of blocks, with the whole thing resting on one tiny piece labelled as a project 'some random person in Nebraska has been thanklessly maintaining since 2003.' XZ Utils was that piece. A library the whole internet leans on, maintained by one unpaid volunteer with no team, no funding, no backup and no relief. That is not an anomaly; it is the normal condition of enormous parts of the open-source commons, and it is the vulnerability Jia Tan read and exploited with precision — because the volunteer most likely to be worn down into accepting 'help' is the one who is exhausted and alone.

The finding that must be stated plainly, because the reflex to blame is strong and wrong, is this: the maintainer is the victim, not the culprit. Lasse Collin did nothing improper. He was a volunteer doing unpaid, essential work under manufactured pressure, and he was deceived by an adversary who invested years in deceiving him. Blaming him for accepting a malicious co-maintainer is like blaming a tired, understaffed nurse for a fraud committed by a colleague who spent two years building a false résumé. The culpable party is the attacker. The contributing cause is a civilisation that runs its most critical infrastructure on the goodwill of people it never pays, never thanks, and never protects — and then acts surprised when that under-defended commons is attacked at its weakest, loneliest point. The technical fix is code provenance and better review. The real fix is to stop expecting volunteers to hold up the sky for free.

And the scope of the exposure is the part that should end any complacency, because XZ Utils was not special. It was ordinary. Study the dependency graph of almost any modern system and it terminates, over and over, in small libraries maintained by one or two people with no institutional backing: a compression routine, a date parser, a certificate handler, a font renderer, each pulled transitively into software that banks and hospitals and power grids run on, each a single burned-out volunteer away from the same story. The attacker did not find a rare weakness; it found the median condition of the commons and simply chose one instance of it. Which means the correct reaction to the XZ near-miss is not relief that this library was saved but vertigo at how many others sit in exactly the same position right now, unwatched, unfunded, and one patient stranger away from a co-maintainer who is not what he seems.

5. The Bridge: this time, the platform is a target

Every letter carries the actor to what the LSN systems see, and every earlier one let the platform stand safely outside as the observer. This letter does not, and the discomfort of that is the point.

The LSN homelab runs Debian-family Linux, the SSH daemon, and the liblzma the backdoor rode. It runs, in other words, the exact software the attack targeted. Had the timeline slipped by a handful of days — had Andres Freund been benchmarking the week before, or not at all — the poisoned XZ could have reached the stable repositories and been pulled, in a routine update, onto this platform's own servers. The honeypot that watches the world's attackers, the entity graph that names them, the classifier that tags their web shells — all of it runs on the stack that Jia Tan spent years preparing to backdoor. For once, the platform is not the Geiger counter held up to someone else's radiation. It is a thing standing in the blast radius.

The platform does hold the detection signature — the LSN archive carries the XZ-backdoor YARA rule, and can name the artefacts if they appear. But the more honest bridge is the one that offers no comfort: LSN is itself the nobody problem. It is a fifty-one-namespace infrastructure maintained by one person, dependent on exactly the same volunteer-maintained libraries, exposed to exactly the same manufactured trust that felled XZ. The register's recurring reflexive move has been that the platform runs a version of the primitive it describes; here that move collapses into something starker. The platform does not run a version of this attack. It is a target of this attack — a solo-maintained system built on an under-funded commons, one carefully-earned bad commit away from being the victim it is writing about. The witness and the target, this once, are the same.

6. The counter-narrative, steelmanned

The optimistic reading of the XZ affair is widely held and not foolish, and it deserves its strongest form.

Open source worked, the argument runs. The attack was caught before it shipped; the response was fast; the poisoned versions were pulled; the transparency of open development — the public mailing lists, the readable history — is exactly what allowed the whole operation to be reconstructed and understood afterward, in a way no closed-source backdoor ever could be. A proprietary vendor could have shipped an identical backdoor and no outside researcher would ever have had the access to find it or the record to trace it. And the very fact that it took a years-long, resource-intensive, state-level operation to nearly compromise one library suggests the ecosystem is more robust than the panic implies: if this is what it takes to almost win, the defences are not as weak as they look. The lesson, on this account, is that the model is sound and simply needs more of what already saved it — eyes, transparency, and support for maintainers.

There is real truth in this, and the dossier grants it: transparency did enable the reconstruction, a closed backdoor might never have surfaced, and open development's readability is a genuine defensive asset the proprietary world lacks. But the reading overstates its case at the decisive point, which is the word 'worked.' The system did not catch the backdoor; a coincidence did, and a system whose last line of defence is whether an unrelated engineer happens to notice half a second of latency has not demonstrated robustness — it has demonstrated that it was one incurious afternoon away from catastrophe. 'It took a state-level operation' is not reassuring either, because state-level operations are precisely the threat that matters, and this one nearly succeeded for a rounding-error of luck. And the deepest problem the optimistic reading skips is that the exploited weakness — trust in volunteer maintainers, resting on the unfunded labour of exhausted individuals — was not fixed by the catch. It is still there, under thousands of other libraries, exactly as under-defended as before. The model did not pass the test. It failed the test and was rescued by accident, and the condition that made it failable remains. Celebrating the rescue while ignoring the standing vulnerability is how the next Jia Tan gets its years of patience rewarded.

7. Verdict — CAUGHT, and UNIDENTIFIED

Jia Tan spent years becoming trusted in order to betray trust — joining a project no one guarded, maintained by a volunteer no one supported, and turning the open-source model's founding assumptions into the delivery mechanism for a master key to the internet's servers. It attacked not a system but the human trust the system is built on, and it very nearly won, stopped by nothing more robust than a stranger's curiosity about a performance regression.

The verdict's first word is, for once in this register, a genuine defensive success, and it should be said as one: CAUGHT. The backdoor did not ship to the stable releases. It was found, disclosed, and pulled in time. In an alphabet full of actors who succeeded and walked away, this is the rare letter where the attack failed. That matters, and the people who caught it — one curious engineer and a community that responded within hours — earned the word.

But the second word is why the success is so unnerving, and it is the one that makes Jia Tan unlike every other actor here: UNIDENTIFIED. There is no defendant, no indictment, no passport photo, no sanction, because there is no known person and no confidently attributed state — only a persona that did years of patient work and then vanished the instant it was seen. The sophistication, the patience, the resources and the long-game discipline are widely assessed to point at a state actor, but that is an assessment, not an attribution, and this dossier will not pretend otherwise. Whoever ran Jia Tan is still out there, unnamed, with a proven method, a lesson learned about performance overhead, and thousands of other under-defended libraries to choose from. The operation was caught. The actor was not.

Twelve letters in, this is the one that turns the register's usual comfort inside out. The platform cannot stand outside it, because the platform runs the targeted software and is itself the lonely, under-supported maintainer the attack was designed to exploit. The vectors do not lie: the backdoor was real, the near-miss was real, the nobody problem is real and unfixed. And the hardest truth of the letter is not about the attacker at all. It is that the thing that saved us was luck, the thing that was attacked is still exposed, and the thing that holds up the internet is a global commons of exhausted volunteers whom we have never once thought to defend. Judge the actor who exploited that. Then judge the arrangement that left it exploitable, because that one has your name on it too.

The Alphabet of Actors continues. Verdict: CAUGHT, and UNIDENTIFIED. Confidence: HIGH on the backdoor, the mechanism, the discovery and the modality — drawn from the CVE-2024-3094 record and the XZ-backdoor detection signature in the LSN archive, the openwall disclosure, and the OWASP supply-chain literature. MEDIUM, and explicitly bounded, on the social-engineering timeline (reconstructed from public project records) and on attribution: Jia Tan is a persona, never identified; state-level involvement is a widely-shared assessment, not an established fact, and no state or person is named here. Lasse Collin is identified as a victim of the attack, not a wrongdoer. Classification: TLP:WHITE. Include everything — the vectors do not lie, and they do not judge. The reader judges the actor, and the arrangement that fed it.