11 ms·
Fake recruiter lured aerospace employee with trojanized coding challenge
- ChrisMarshallNY 3y agoWait, they got in through take-home leetcode tests? That’s damn clever. I program Apple software, and Xcode projects can dig deep. Apple gives you a warning about opening a downloaded project, but you’re almost certain to ignore that, if you think it’s a take-home. I assume that taking online ones would ask for hairy access, as well. Also, the people going for these would probably have pretty damn good access to the corporate Crown Jewels. Of course, no one would use corporate resources for job-hunting, right? I know that folks here, get all huffy, when I suggest that happens rather frequently.
- macintux 3y agoAt my first IT job, I spotted some bounce messages from a jobs address at a local big pharma firm. Admittedly, personal email addresses weren’t as common in 1996 as they are now, but still, rookie mistake. I’ve maintained a strict “don’t do anything personal on a corporate computer” policy for a long time, but I’ve not found that to be a common approach.
- ryandrake 3y agoSame here. Air gap your personal and professional life. Separate devices, separate networks (if you work from home), don’t even bring your personal device to work if you don’t really have to. There was a story a few years back making the rounds on HN where an Apple employee had to turn in her corporate device due to some lawsuit against the company. This happens all the time in big companies. She was outraged at this because she had personal nudes on her corporate device. WTF how could anyone think this was a good idea?
- WWLink 3y agoI don't work for Apple or (honestly) know anyone that does, but from at least one news article, I get the impression Apple openly encourages (and maybe even requires) it. https://www.theverge.com/22648265/apple-employee-privacy-icloud-id https://www.theverge.com/22648265/apple-employee-privacy-icl...
- steelframe 3y ago> I get the impression Apple openly encourages (and maybe even requires) it. When I worked at Apple I needed a personal iCloud account to set up my corp MacBook. I simply created a new dummy personal account just for that. Nobody's auditing your iCloud account to make sure it's your "real" personal account or anything.
- raverbashing 3y agoYeah about that. That's one of the biggest weirdness in related to Macbooks on a corp environment, why do I need an unrelated account to do basic stuff on an Apple machine
- WWLink 3y agoIt all depends on how they manage them. You can and should just make a youremail@company.com icloud account. I'm actually surprised that's not the norm so they can take over stuff like activation lock. I don't use a personal icloud account on my work computer... it's not even allowed lol.
- emodendroket 3y agoI have a “work personal” Google account for Chrome for similar reasons.
- xmodem 3y agoAt my last job I used a dummy iCloud account at the system level, but you can log into a separate account for the app store, which was necessary to avoid having to re-buy some apps I depend on. Just as I was leaving they were in the process of replacing everyone's computer with new ones that were much more locked down.
- MandieD 3y agoMy advice to young colleagues: never do anything on a work computer that you wouldn’t mind your boss (or her boss) seeing. Being greeted with a Department of Defense splash screen before login reminding me that everything I did on that computer was subject to monitoring formed that habit early, and I still can’t shake it, no matter how long I work in Germany, for a German firm with a rather assertive works council.
- Aqua_Geek 3y agoWhenever I grade take-home assignments, the first thing I do is open the Xcode project file in vim and look for shady stuff. Admittedly, I don’t think most of my colleagues do the same due diligence.
- deleted 3y ago[deleted]
- saagarjha 3y agoApple added sandboxed shell scripts recently, I assume as part of an effort to make builds a little more hermetic. While I’m sure it’s not a perfect solution I feel like it would be nice to open a project in a mode where all build steps run in a sandbox. Obviously when something fails you can take a look at what it was trying to do :)
- jetti 3y ago>Of course, no one would use corporate resources for job-hunting, right? I know that folks here, get all huffy, when I suggest that happens rather frequently. Where I work we have a take home exercise we have candidates do and then when we have the interview with that person we review their code with them and ask them to make incremental changes to see how they handle the asks with their communication skills and their technical ability. I interviewed one individual who couldn’t even get the REPL started for their project and as they were struggling trying to get it to work I heard them mumble to themself “I should have just use my work computer”. The fact they couldn’t get the most basic aspect of the project to work on their personal meant that they did their coding assignment on their work computer
- beebeepka 3y agoInteresting. What makes work provided computers better suited for coding? Me, I don't recall using company hardware for anything even remotely personal in many years. It's stupid because they are loaded with all kinds of spyware.
- jrumbut 3y agoJust that it's set up in a particular way, I suspect. A long running project/organization will accrete plenty of tools, scripts, configurations, etc that make their environment different than another using a similar stack.
- jasonwatkinspdx 3y ago> Interesting. What makes work provided computers better suited for coding? Some people only know how to code within the environment managed by their corporation. This is increasingly the case with folks that have only worked at Kubernetes shops.
- otteromkram 3y ago[flagged]
- Grimburger 3y ago> no one would use corporate resources for job-hunting Morally grey(pale blue?) aside, I've been given entire days at work to look for new jobs as part of a redundancy agreement, it was widely supported by management.
- quickthrower2 3y agoDownload an .exe, but via an appeal to greed and flattery, and implied trust ofa FAANG. The solution might be to do real work in VMs while the laptop is a dumb terminal then lock it the fuck down (no downloads!)
- deleted 3y ago[deleted]
- emodendroket 3y agoSeems like a silly, unnecessary risk but it seems like more and more people don’t even have their own laptop.
- pjmlp 3y agoIn many companies using work laptops for private stuff is considered a security issue and a breach of work contract, not everyone actively checks it, it is however an easy way to fire someone when something like this happens.
- namdnay 3y agoPersonally I gave up having my own computer about 10 years ago. Probably not the “safest” strategy, but I always found it a bit wasteful to buy a second device.
- pjmlp 3y agoI have worked in companies where that would be a reason to cease contract.
- ahoka 3y agoWe had someone submit their current employers code as a solution to the assignment. It had the company’s name all over in namspaces, etc. It was also not what we asked for, but something only slightly related. Their employer was making medical devices.
- 3seashells 3y agoEverything cooperate devices touch the own, so if you hunt for a job on company property you become a consultant in your next job leased out by your current one. u/s@
- francisofascii 3y agoCoprporate laptap for personal use, No, but corporate monitors and dock, Yes.
- hddqsb 3y agoThe attackers didn't even use a trojan project/source. They just sent a malicious .exe (wrapped in an .iso file) and asked the victim to run it and write a C++ program that produces the same output.
- clnq 3y agoI’m always surprised people do take home tests, email headhunters, call and interview with other companies on their current company’s hardware. Plenty told me they do it, but I just can’t comprehend it. There are so many potential consequences. An eager beaver manager once talked a future employer out of employing me through a personal connection, and that was just because they found out. Even if it was unethical or illegal, these things happen, and even in large tech companies. Imagine willingly sharing all details of your job hunts with your employer… maybe it’s just me, but the thought feels wrong. Work and personal matters should be church and state, right?
- pjot 3y agoJust as a matter of CYA, use a phone/tablet for interviews if you must. Why add the unnecessary risk? Maybe people like the rush…
- emodendroket 3y agoDevelopment is one of the worst cases for a tablet though. Almost any other task works better.
- phyzome 3y agoI find it pretty disturbing how many of my coworkers don't even have a personal computer -- they just use their work laptop for everything. Mind-boggling. (These are software developers, they can damn well afford a laptop.) The most I mix it is using my smaller, lighter, Bluetooth-supporting work laptop for watching innocuous YouTube videos while doing dishes. And I used to use it to print stuff at the office, on occasion.
- bagels 3y agoYeah, it's a good way to get your personal things brought in to discovery, snooped on by corporate security, or erased when you suddenly get laid off.
- 3y ago
- phendrenad2 3y agoSo they sent .exe files to the victim, under the pretext that the victim was supposed to duplicate their functionality in C++? Receiving an .exe file from someone should be a dead giveaway that this is an attack, or at least, that the person sending it to you is incredibly technically incompetent. But then again, I lived through the Windows 95 era. I suppose some lessons have to be re-learned with every new generation.
- userbinator 3y agoKnowing what they were trying to do actually makes me wish I were the one they were trying to trick. I know these aren't regular lame script kiddies, but I wonder how they'd react to an attempted counter-offensive. Give me an .exe and ask me to run it, and I'll open it in a hex editor for inspection instead. If what you claim is a "hello world" or Fibonacci generator is much bigger than I'd expect (a few KBs) and contains encrypted-looking data or other attempts at obfuscation, I'm not running it.
- raverbashing 3y agoOr at least run it in a VM
- mlhpdx 3y agoAt first I thought this was more clever than it was. Taking people into running downloaded or attached exe files is simple and apparently still effective. But what would be even more wicked, and effective would be pointing them to a GitHub repo with the “challenge” project to complete, and referencing a compromised package that does their bidding as the victim tests their solution.
- deleted 3y ago[deleted]
- hahn-kev 3y agoYeah I was thinking about that. Even asking me to use a specific package for any reason, I probably wouldn't think much of that before today. However now I'd certainly question it.
- elzbardico 3y agoWhat kind of imbecile does personal stuff in a company device? We are not talking about poor people, we are talking about people who have money enough to have their own personal devices.
- rpmisms 3y agoI do personal things on company hardware, just nothing actually personal. No sign-ins, but I'll watch a movie on work laptop happily.
- beebeepka 3y agoHow do you watch the movie, though. If you do it legally, you need to use an account, that's personal, no? Unless you watch free movies on YT or torrent stuff, of course
- metaphor 3y agoIt blows my mind away that this remark is entirely oblivious to the consideration of physical media.
- VBprogrammer 3y agoPhysical media is a relic. Most laptops don't come with a drive and most company policies will try to block USB drives of any kind.
- metaphor 3y ago> ...most company policies will try to block USB drives of any kind. Grand assertion. Where's your supporting cite? To be clear before goalposts are moved, the context is external optical media drives---a peripheral commonly issued along side laptops without one---not USB mass storage devices.
- 3y ago
- keepamovin 3y agoHa! There's this kind of bad stuff that happens. Back in 2019 my laptop got hacked over the "free wifi" provided in the HQ, had to change all my SSH keys.
- Scoundreller 3y ago> got hacked over the "free wifi" provided in the HQ elaborate?
- keepamovin 3y agoLook it is probably nothing…but anyway, this is not the time nor place to name and shame, but more specifics. So… Interviewer specifically asked me to bring my computer, after the initial intro they asked me to show some code I’d written. I said I’d just connect to my mobile hotspot. They looked shocked and said “I didn’t think you’d have a phone here” (it was an overseas fly out for the day), I said it’s fine, I always have a phone. And they insisted I instead connect to their office wifi. It was the only wifi i used the whole time i was there. Back in other country I saw my mail had another logged in session, and a private repo post install script had pulled a resource from my server, from an IP back in the country, and another random country. Only way to access to private repo was SSH key (or GitHub credentials) Only way to access to Mail was MITM cloning session or access to device (more likely - I thought i would have noticed any MITM cert issues). Incidentally, from the same country, this time another company, I had another fly out interview request a week later and this company also specifically asked me to bring my computer — when I asked if it would be ok if I wasn’t gonna bring my computer because I needed to get it fixed, they got back the next day and said oh, we have to cancel the interview because we it won’t be possible for us to proceed. To proceed… with hacking? Hahaha, who knows? I’m not expert enough to know what this all means. Maybe it’s nothing. It’s probably nothing.
- slekker 3y agoplease name and shame, at least the country.
- yieldcrv 3y agoyou can just attribute everything to the Lazarus Group these days > hacks and leaks earnings report and insider trades but only right after it leaks < “North Korea did it wdym” > investigators find planted reference to an APAC timezone or font within the exploit < case closed
- Thorrez 3y ago>One of these RATs is already known to be part of the Lazarus toolkit, specifically a variant of the BlindingCan backdoor with limited functionality but identical command processing logic. The attackers were using already known Lazarus malware. The researchers aren't simply basing the Lazarus attribution solely on an insider trading strategy or time zones.
- yieldcrv 3y agoalready known means everyone that knows can also do it
- stonepresto 3y agoThreat intel and analysis is just like any other analysis, it is taking a heuristic approach to finding answers. Can it be bypassed? Yes. Are the researchers whose entire company hinges on the correctness of their analysis doing their absolute best to attribute the attack to a threat actor? Yes. So to your point, somebody could indeed reuse malware or attempt to replicate it. However, the researchers are likely analyzing the disassembly and bytecode, and replicating complex malware to perfectly imitate a known family of malware is exceptionally difficult and statistically very unlikely. This is how threat intel is able to make any sort of claim of attribution.
- Thorrez 3y agoIn this case it was a modified version. Meaning the attackers have access to the source code. Not everyone has access to the malware's source code.
- relativ575 3y ago
- wslh 3y agoSeems like next time you should ask for an access to a cloud server. But wait... if they are fake recruiting cybersecurity experts you could end hacking someone else site.
- Ballu 3y agoLinkedIn was a great platform, weaponized by Microsoft as the biggest security risk. There is no innovation for security, making it feature rich and more user friendly.
- neilv 3y agoWhen I was consulting on some government programs, I consciously kept my resume off the Internet. I didn't have access to anything useful to spies, but some of the keywords might look to someone like I did. Like how some recruiters seem to spam all keyword search hits on LinkedIn. I knew I'd have to report any kind of security incident, and I thought that might interrupt my contracts and income, while a cautious bureaucracy processes the incident. So, no resume online. Also, measures to try to prevent a random burglar from inadvertently stealing the work laptop. (Now that I'm away from that work, I get to enjoy LinkedIn recruiter spams for Junior Python Leetcode Hazing Engineer roles, like everyone else.)
- jgilias 3y agoDon’t know why you’re getting downvoted. I’d imagine that not publicising your employment status is a run of the mill security measure for specific roles and industries that are subjects of targeted attacks. As a meatspace equivalent I’m sure there are not many CIA operatives walking around foreign countries and giving out CIA-stamped business cards.
- guytv 3y agoOff-topic: Given that state cyber entities maintain networks isolated from the internet, how do they adapt to the rise of tools like Co-Pilot and ChatGPT in the software engineering landscape? This kind of security setup inherently restricts access to such tools, potentially slowing their pace. Thoughts?
- Kinrany 3y agoDon't use them, duh. Pay enough money to get a copy on premises if it ever gets useful enough for that. In the time they'll get around to changing their procedures, models will get small enough that it will be a non-issue. Disclaimer: layman's opinion, I only know what internet knows.
- bb611 3y agoI work at a large SF based SaaS, there's so much money in that space the company spun up a team to build an air gapped version of our product for restricted networks. It's definitely much slower than the private sector, but if the agencies decide they have a use case, they'll throw money at it until it works in house.
- wly_cdgr 3y agoUltimately, what made this attack possible and effective is the low morals of the people who applied to other jobs behind their employer's back, on their employer's computers
- goykasi 3y ago> low morals ... behind their employer's back Employees don't belong to their employer. There is nothing wrong with trying to acquire a potentially better job. The only real problem is they were using company resources to do so. Also, they were completely incompetent by running random executables.
- Liquix 3y agoSlight tangent: How can Lazarus/HIDDEN COBRA be such a sophisticated nation state actor when North Koreans can barely access the internet until becoming government employees? One would think that being unable to access modern security research, open source projects, programming resources, or "wild" malware would not exactly raise a nation of brilliant hackers. Perhaps some who subvert the great firewall are vanned and offered a job in the unit?
- Almondsetat 3y ago>being unable to access modern security research, open source projects, programming resources, or "wild" malware how do you know they are unable to obtain such things? also, how do you think hackers are trained? by teaching them how to create a ToDo app with the nightly build of React? they probably know by heart the ethernet and TCP/IP stack better than the guys who created them and could recite it backwards, and that's already enough to hack plenty of things
- michaelt 3y ago> also, how do you think hackers are trained? I don't know, but I thought they started as "script kiddies" at about age 12 before growing into full size hackers. Which requires that tech be available widely enough that 12 year old kids can get unsupervised access to it.
- rcxdude 3y agoThat isn't mandatory. It's all stuff you can be taught later.
- carbotaniuman 3y agoI think (based on my limited research) it's either a loose affiliation (mainly based in China or Russia), or the children of party elites who likely have more privileges and access than thr average North Korean.
- slim 3y agothey arguably operate from china
- A7med 3y agoClever and probably they had a high percentage success rate
- Joel_Mckay 3y agoUnsurprising, of the 300 staffing agencies in our area only 23 are actually licensed to legally operate as a service. Trying to authenticate which are "fake" or "real" is a thread most companies/applicants rather not pull. There is also the fake-hire scam: where staff are lured away with lucrative compensation packages, data-mined by the competitor, and finally jettisoned before the evaluation period expires (typically 6 to 10 months). A few infected PDFs from various bad actors are also floating around out there with exaggerated promises. Keep safe, and note 86box supports read-only backing images and sessions Like Bochs/kvm: https://github.com/86Box/86Box/releases https://github.com/86Box/86Box/releases (works on Apple M1 laptops, but is slow)
- lakomen 3y agoOld news. Wasn't that posted like 2 weeks ago?
- svaha1728 3y ago> Two malicious executables... The first one is a Hello World project... The second prints a Fibonacci sequence up to the largest element smaller than the number entered as input. That should have been the first tip off something was wrong, Meta would start with a LeetCode medium or hard.
- creyes12345 3y agoThe security on this website is fantastic. They have disabled the use of the arrow keys to scroll the content of their pages. This must obviously be due to a previously unknown attack vector via the use of the keyboard. Bravo!
- vlod 3y agoAnother reminder I should seriously look into qubes-os.