11 ms·
Tell HN: Be aware of people trying to scam contractors
In short, I just received a nice proposal to work on a new contract, the potential customer sent me a "document" with the project specs which turned out to be a password-protected compressed file with some pictures and a ".exe" file inside.
I submitted the executable to virustotal which reports this as a trojan (https://www.virustotal.com/gui/file/088e2dabf218024d30e6899152b6a031dc30ae6f7d516492cb797292d6255d27/detection), seems like this takes screenshots and steals browser data which can be used for other purposes later.
Anyway, be cautious with proposals you receive.
- alexfromapex 3y agoWhile we’re sending warnings, watch out for jobs which have “on-call” responsibilities as they’re essentially SRE jobs and can make you work on nights and weekends.
- WirelessGigabit 3y agoWell, it's part of the contract right? 1 weekend per month on call. I do find it sad that there is no general requirement to pay employees to be on call. So as a contractor you need to make sure that there is an extra provisioning in there AND that the rules which govern on call are extremely clear. Like what about you going on vacation? Sick? Grandma dying?
- throwaway019254 3y agoIt’s strange to see something like this here. I worked for multiple big US tech companies (both FAANG and non-FAANG) and all of them had oncall as a part of software engineering job. Supporting the services you are developing feels like natural part of the job. And when I had a lot of tickets at night I was able to fix the issues and make oncall shifts better.
- gggsre 3y ago> Supporting the services you are developing feels like natural part of the job. Paying fairly your employees for providing the support outside business hours also feels like natural part of the job. Unfortunately, surprisingly few companies do this.
- zdragnar 3y agoIf you want to charge different rates based on hour of the day, you should consider contract work rather than salaried. The whole point of taking a salary is to have a predictable income, which cuts both ways.
- gggsre 3y ago> If you want to charge different rates based on hour of the day, you should consider contract work rather than salaried. What I'm saying is I don't want to do unpaid overtime and heroically sacrifice my weekends for oncall. > The whole point of taking a salary is to have a predictable income, which cuts both ways. Unsure what point about "cuts both ways" are you trying to make here. I think the company can pretty easily calculate how many non-business-hours are there within a month and allocate some money to compensate people doing oncall.
- zdragnar 3y ago> unpaid overtime There's no such thing for salaried positions. I previously worked for a company that handed out "production bonuses" to people who worked >40 hours a week, calculated based off of your annual salary and hours worked. They were very clear to never call it overtime, because that has a very different meaning (legally). > Unsure what point about "cuts both ways" are you trying to make here Unlike a contractor, you don't have to look for another job after a defined period. You have a regular, fixed income (and benefits) so long as both you and your employer are happy. "40 hours per week" is a convention, not a requirement, though. Most companies are pretty good at picking 40 hours as a reasonable work-life balance mark. Some (notably startups and people mills like Amazon) push for more. That said, if you want a guarantee, stick to contracting paid hourly.
- mullingitover 3y agoThe only caveat I would add to this is: if you begin the position without the expectation of on-call being made up front, and then it's pushed on you without any extra comp, that's not exactly fair. However, as long as that's made clear from the outset, yes, your salary covers you performing your expected duties whenever they need to be performed. It's not like salaried engineers aren't compensated well.
- mangamadaiyan 3y ago> Supporting the services you are developing feels like natural part of the job. It wasn't always seen as a "natural part of the job". Time was when most companies had a dedicated team of support engineers, who worked in 8-hour shifts, and provided support round the clock. Developers also got to spend the occasional week or month in support. Eventually, a CEO (who I will not name) figured that they could save costs if they got rid of support, and got the dev engineers to do it instead - and sold it as a "natural part of the job" - which kool-aid almost everybody has drunk by now. Which is how devs now burn their weekends, nights, and health being on-call without a choice. I've seen on-call responsibilities pretty much involve being available 24x7 for a week, once every two months. It's not right, it's not natural, and it's a result of CEO penny-pinching. That's just it.
- noisy_boy 3y agoWhat you are describing is how most financial firms still work today. Sure Devs are the escalation in case the first line of support can't solve it. But the advantage of having a first line is that they are specialists in supporting, get better over a period of time, are mentally prepared because that is literally the job they signed up for and it lets Devs focus on core development. To those who say that this allows Devs to get away with murder because someone else is handling it - support escalations are very visible and if your stuff is breaking all the time, you come out looking very bad in the eyes of your management. Not to mention that any self respecting developer would/should apply a basic standard of care to their code. If anyone has developers that don't, it is an individual or cultural issue, not an issue with the model of separate support team.
- throwaway675309 3y agoSounds awful, in all of the companies I've worked for the R&D department was firewalled from this type of tech support work. If there were site related issues, that was usually the role of dev ops team to handle. That could then get triaged to a quality assurance team, eventually bug tickets could get created. Then during our normal office hours we could assign a normal software engineer to look at them. Even the concept of being on-call physically makes me nauseous.
- gggsre 3y agoOncall responsiblities itself are not terrible... assuming the oncall is setup in sane way. But more often than not it isn't. Right now I'm SRE in FAANG and the deal is quite sweet: we get paid for non-business hours, we are oncall only during daytime, I can exchange my oncall compensation for extra holiday. We also have enough time to fix recurring issues, remove noise, etc. But: I would never do unpaid oncall again. I would also think twice (or thrice) before agreeing for night shifts. As it turns out putting out fires at 3 AM can burn out entire team pretty fast.
- dilyevsky 3y agoCould’ve just said you work at google bc that’s the only place where it works like this afaik
- justinclift 3y ago> As it turns out putting out fires at 3 AM can burn out entire team pretty fast. AWS has a terrible reputation for exactly this.
- Greg433 3y agoI wanna say a big big thanks to Chris Harvey from the depth of my heart, I have been through hell and storm all in the hands of brokers and fake recovery agents spreading themselves all over the internet, I got rescued by Chris , immediately I contacted him he responds and asks me to reach him via email:( chrisharvey553 @ gmail . com ) which I did and my funds got recovered within 72 hours, all thanks to him, have never seen an honest and understanding being such like him all my life. all thanks and appreciation goes to him, I pray he keeps on with the good jobs.
- dzek69 3y agowell, this is how Linus Tech Tips Youtube account was taken over.
- jamal-kumar 3y agoWas there ever something like a breakdown on exactly how that went down?
- tristanperry 3y agoTheir own summary is here: https://youtu.be/yGXaAWbzl5A https://youtu.be/yGXaAWbzl5A Paul Hibbert (a UK tech YouTuber) was also hacked in a similar way, and he dived into info on that here: https://youtu.be/0NdZrrzp7UE https://youtu.be/0NdZrrzp7UE
- hayksaakian 3y agoI've seen this first hand on Upwork as well.
- HumanOstrich 3y agoFor some reason Upwork always reminds me of Updawg.
- Agree2468 3y ago[flagged]
- beckingz 3y agowhat's updawg?
- HumanOstrich 3y agoNot much, you?
- lakomen 3y agoWazaaaaaaaaaaaa
- zerr 3y agoDo tech people execute such exe files? Doesn't seem like a novelty method, does it?
- nubinetwork 3y agoSee Linus Tech Tips getting his YouTube accounts "hacked".
- Dylan16807 3y agoScare quotes make sense for social engineering, but if there's a trojan installed and used to increase access I would say that's enough to qualify as hacking.
- nubinetwork 3y agoRunning an exe that steals your session cookies isn't really hacking, hence the air quotes.
- Dylan16807 3y agoSo do you not think trojans count at all?
- nubinetwork 3y agoTricking someone into running a program isn't hacking... it's malware and social engineering.
- seanhunter 3y agoThat’s a distinction without a difference.
- Dylan16807 3y agoSetting aside the trick itself, using malware to gain additional privileges is usually considered hacking.
- simonbarker87 3y agoThis happens in the content creator world as well, an agency contacts you and says to sign a contract by executing an exe file they send you. Very clearly a scam.
- nickfromseattle 3y agoA variation of this - a fake job offer, allowed scammers to steal $540 million dollars in crypto tokens. [0] I guess the scammer assumed as a contractor, you may have access to other customer systems they could exploit. The internet be crazy, ya'll. [0] https://www.theblock.co/post/156038/how-a-fake-job-offer-took-down-the-worlds-most-popular-crypto-game https://www.theblock.co/post/156038/how-a-fake-job-offer-too...
- kikokikokiko 3y agoAxie Infinity was a pyramid scheme. The fact that in the end it was "hacked" and the funds "disappeared" is highly suspicious. Occam's razor says that they just exit scammed it.
- status200 3y agoA bit of (neutral) clarification, Axie is still active and is in the top ~60 projects by market cap[0], and the heist was actually linked to North Korean state actors[1] [0] https://www.coingecko.com/en/coins/axie-infinity https://www.coingecko.com/en/coins/axie-infinity [1]https://www.washingtonpost.com/technology/2022/04/14/us-links-axie-crypto-heist-north-korea/ https://www.washingtonpost.com/technology/2022/04/14/us-link...
- southernplaces7 3y agoIf you're going to throw shit at crypto, at least get your most basic facts straight before doing so. As the other comment points out, Axie Infinity is still around, well used and far from having been exit scammed, much less disappeared.
- JCharante 3y agoSo an employee was using his work laptop to open job offers? Or maybe didn’t even have a work laptop? Disappointing but I didn’t have high expectations anyways
- sureglymop 3y ago
- Nextgrid 3y agoIt’s clearly suspicious and I wouldn’t advise opening these files (there’s no reason it should be a self-extracting executable instead of a standard ZIP file), but the VirusTotal report could also very well be a false-positive if malware makers used the same archiver program to create a self-extracting archive with their malware and AV engines ended up associating the self-extracting archive entrypoint (benign by itself) as associated with malware.
- psychphysic 3y agoAll else ignored the exe reaching out to a telegram server is reason enough to baulk.
- ImPostingOnHN 3y agoHas that happened with VirusTotal recently? It seems like a false false positive otherwise, encouraging folks to discount a true positive as a false positive
- deleted 3y ago[deleted]
- SoftTalker 3y agoIn general, beware of unexpected ".exe" files especially if they are a gateway to something you want (a contract, a payment, etc.) No normal business operates like this, and if they do, you don't want to work for them.
- thih9 3y agoWhat about expected executables? E.g.: “we use a niche video conferencing tool / document signing tool / dev tool , please folow this link to install it”? And with tech challenges being so common, perhaps all it takes is a typo in some manifest to download a malicious package in a sneaky way.
- orangepurple 3y agoWindows Sandbox
- crazygringo 3y agoYou can usually google the thing and find an official link to the download and get a sense of whether it's a generally legitimate software company. If it's an internal tool they've built, either make up a story about how you're temporarily on a machine where you can't install new software, or do it in a sandbox. I'm not going to just blindly follow an executable download link in any circumstances. It's the same as if my bank calls me out of the blue and wants to confirm who I am with personal details, I'll look up their number online and call them back that way before proceeding. (Hasn't happened in a long time, but I do remember having to do that with a legitimate bank call ~15 years ago, when they called me and asked for my mother's maiden name before proceeding.)
- JohnFen 3y ago> “we use a niche video conferencing tool / document signing tool / dev tool , please folow this link to install it”? Nope. That's a nonstarter.
- rozab 3y agoThe reason it's in a zip is so you never see that it's an .exe. Otherwise the email client would show the file extension and warn the user. Microsoft in their wisdom have decided Windows users never need to see file extensions by default, so after unzipping the user would just double click an innocuous file with an MS Word icon. And maybe press OK on a prompt they've been trained to press OK on.
- jusob 3y agoI got something similar: a compressed file with an ISO in it: it was a CD with autorun. I guess some OS will mount it automatically and run the autorun.inf if you double click on it.
- NegativeK 3y agoNew job/contract work fits very neatly into the time sensitive and stressful setup that phishers and scammers lean on.
- gfarah 3y agoTalking about scams in job proposals. Lately I've been getting a lot of recruiters contacting me with sweet fake jobs opportunities, only to really try and sell me their recruitment services.
- seanhunter 3y agoBack when I was a contractor this was a common scam to bootstrap a new recruitment agency. 1. Post some fake job adverts 2. Collect the cvs of people who apply 3. Send those cvs in response to actual real job ads 4. If the company shows interest call the candidate and sign them up. If needed, paper over differences between from the job thought they applied for and the one you sent their cv in for. It’s a super scummy tactic (but these are recruitment agents we’re talking about - the industry is stuffed with sharks and chancers). If you’re a hiring manager you can help to combat this unethical behaviour. Never accept CVs sent on spec (ie you didn’t ask for) by a recruiter unles you know for sure the candidate actually approved it. Whenever an agent send a cv to me like this I always send them A mail saying I didn’t request the CV and won’t be paying them a fee if we do hire the candidate. Otherwise you can find yourself in the position where the same CV arrives from a different agent and the first agent tries to claim the placement fee as well.
- lakomen 3y agoSame here. Many Michael Page job offers with actually valid signatures and links to valid LinkedIn profiles, but fake link targets. What made me suspicious was the frequency of those mails. Then I checked the link targets and history was written;)
- brailsafe 3y agoOnce you know about PDF capabilities, you can't unsee
- marcosdumay 3y agoIt's up to your reader to allow them.
- HaZeust 3y agoEven Adobe Acrobat has been caught sleeping on the job before - what better reader to rely on?
- marcosdumay 3y agoAdobe Acrobat is the one that enables every attack vector. Almost everything else won't let your PDF launch local scripts.
- lcordier 3y agoCheck out https://lab6.com/ https://lab6.com/ for all the cool stuff. ;)
- gexla 3y agoHow do people not smell these from like a mile away? Must be proposals to people very new to this sort of work. To get me interested enough to even open a document, there's a lot you would have to get right before I hit that step.
- crazydoggers 3y agoMaybe this is a generation that has grown up with virus and spam protection good enough this almost never gets by, so they are unaware? For us old timers this was pretty much an e-mail every other day sort of thing. I remember putting up a website for contact work and getting spam virus crap within weeks from just automated bots. On top of that, I wouldn’t even open a compressed file from someone unless I had a previous relationship with them, and even then I still would scan it since their computer could be compromised. I don’t care if it’s a contract offer, from my attorney or the president of the United States.
- crazydoggers 3y agoJust to be clear, a password protected zip file should be an enormous blinking red light. 99% of the time, password protected zips are used to prevent virus scanners from scanning the content of the zip. Typically email providers like google will provide you with a warning that they have been unable to scan the file. As for emails about contract jobs, even 15+ years ago these could be very targeted, specifying your company/resume etc. Now it will be getting even worse with chatGPT to write these emails in far less time and far more convincingly from non-native speakers. Also note, unzipping files to look into them isn't automatically safe either... there are plenty of older CVEs where zip software had vulnerabilities allowing code execution, and a zero day is always possible. That's on top of the fact that zips can conceal file types of other software that might also have current CVEs. Short story, and this should be followed by everyone in the tech community, never ever open attachments from anyone you don't know, and treat all attachments from people you do know as requiring scanning first. Not doing so puts your coworkers and your customers at risk. If you're accepting proposals for contract work, your process should always require one-on-one communication prior to accepting any attachments.
- 3y ago
- kepler1 3y agoI don't know whether it's the general awareness of it that has been increasing or what, but it seems like job scams, bank scams, rental scams, these are all exploding in frequency lately. Sometimes, it feels like we're in the middle disillusionment era of the internet and tech, where all the hope and positive potential of the new medium has now given way to just previous crappy life problems taking it over, only magnified.
- AlexITC 3y agoThis, I have seen a tendency in increased scam schemas since the pandemic started.
- jstarfish 3y agoFraud has certainly increased as people find new ways to exploit the internet across borders with no accountability. It's not just online either, even kids are playing at misappropriation in doing things like soliciting donations from family to their college tuition funds and then just...not going to college (or taking one class at a time to look like they're actively attending, and pocketing the tuition). Influencers celebrate and encourage this stuff, because everyone older than you is just selfish and deserves to be scammed. Great role models. Being in my stepdaughter's life has been like watching the development of the human incarnation of the Fraud Examiners' Manual. She used to be listed as a beneficiary of my life insurance policy. At this point the only (and I mean only) chapters she hasn't attempted are the ones requiring abuse of one's own assets or credentials (kickbacks, arson, etc.), which are impossible schemes to execute when you've earned neither. The mental health awareness stuff has scaled with it too. It used to be you moved to the big city for work, and when it got to be too much to handle you'd migrate out to the suburbs or country. But the internet made it so big-city, in-your-face hustle culture follows us literally everywhere. Everyone is out to fuck you. There's no peace or escape from the madness anymore. No wonder everyone has anxiety.
- spacebacon 3y agoI got a similar package on Upwork last Friday.
- jacknews 3y agoThere are far more actual jobs that seem like just scams, like this on Upwork I just saw: RoR developer need Urgently Hourly: $8-$10 - Expert - Est. Time: 1 to 3 months, Less than 30 hrs/week - Hello, I am in urgent need of RoR developer who has 5+ years of expertise for existing(ongoing) project. To test Developer's ability we need 1 week free trail. I mean scam 1) $8/hr, and then they want a week free? lol.
- hankchinaski 3y agodeveloper rates are dropping fast across the globe as more people come online and compete at low rates, especially when applying for fully remote roles. people based in high cost of living countries can't compete with developing markets where CoL is 10x lower
- urbandw311er 3y agoHmm, the situation is far more nuanced than you suggest. There are also downsides of outsourcing labour to developing markets, such as language barriers, time zones, cultural differences and more. I personally know several CTOs who have reverted to in-house teams after realising that the actual costs extend beyond just salaries.
- toss1 3y agoYup, just got a variant this morning: Subject: "Company_Name Expired: Set for dissolution" Body: "Hello My_Name, Your business registration DEADLINE has EXPIRED as of 04/01/2023. Your business, Company_Name, has an Annual... It's OK, we're here to help. Registrar agency is a business advocate..." It is absolute BS as I know that I recently updated everything. Not sure if it is a click-thru-to-install-malware scam or phishing to sell me services I do not need, but I'm not finding out. I also get a LOT of official-looking emails from service providers that want to "help" keep my US Govt SAM (Services Award Management) database registration up to date, when I just need to wade through some govt forms and tick a few boxes... I'm used to ignoring this carp, but if you are new to business ownership, it might seem right on a day you are rushed and tired. So beware out there...