4 ms·

> got hacked over the "free wifi" provided in the HQ elaborate?

keepamovin 3y ago
Look it is probably nothing…but anyway, this is not the time nor place to name and shame, but more specifics. So… Interviewer specifically asked me to bring my computer, after the initial intro they asked me to show some code I’d written. I said I’d just connect to my mobile hotspot. They looked shocked and said “I didn’t think you’d have a phone here” (it was an overseas fly out for the day), I said it’s fine, I always have a phone. And they insisted I instead connect to their office wifi. It was the only wifi i used the whole time i was there. Back in other country I saw my mail had another logged in session, and a private repo post install script had pulled a resource from my server, from an IP back in the country, and another random country. Only way to access to private repo was SSH key (or GitHub credentials) Only way to access to Mail was MITM cloning session or access to device (more likely - I thought i would have noticed any MITM cert issues). Incidentally, from the same country, this time another company, I had another fly out interview request a week later and this company also specifically asked me to bring my computer — when I asked if it would be ok if I wasn’t gonna bring my computer because I needed to get it fixed, they got back the next day and said oh, we have to cancel the interview because we it won’t be possible for us to proceed. To proceed… with hacking? Hahaha, who knows? I’m not expert enough to know what this all means. Maybe it’s nothing. It’s probably nothing.
- slekker 3y ago
  please name and shame, at least the country.
  - keepamovin 3y ago
    Not the time or the place. It would be misinterpreted. I don't want it to misrepresent the place.
    - AlexSW 3y ago
      Or at least which country?
      - keepamovin 3y ago
        Like i said man. No. Hope you can respect that. I don't want to be responsible for misrepresenting a country, and I think it's prudent to keep the protection of privacy there until it's definitively proven with evidence.
        ChrisMarshallNY 3y ago
        Good call. That's my M.O. I take it a bit further. I won't go into pissing matches. If folks wanna fight, I'm not the guy to do it. My general stance is, if it's complimentary/good, I don't worry too much about getting specific. If not, I keep it vague (which sometimes pisses people off, but life is not fair). I generally don't name my former employers, just to keep their name out of venues where someone else with a grudge could throw poo (see "Apple" -not a former employer of mine).
        keepamovin 3y ago
        Me too man. I don’t like saying negative stuff about people, especially unprovoked (is not a counter). Feels like a grave responsibility. Always been that way! I love complimenting people. I’m not sure if it’s connected but in the general sphere of things, maybe one downside I’ve noticed in my life is i can be a bit slow to notice when someone or something isn’t good for me. Even if it’s obvious, to others, i always wanna see the good, sometimes i think I’m in denial willingly! Haha… So I have learned to become aware of such people and their behavior, pattern recognition.
        ChrisMarshallNY 3y ago
        I've learned to keep some relationships at arm's length. It's a long story, but I have spent my entire adult life, dealing with some of the most dangerous, doesn't-play-well-with-others people on earth. I'm proud to call some of them friends, and have learned to politely avoid getting too entangled with the drama of others. I've learned that I'm responsible for enforcing my own boundaries, and that I don't need to use nukes. Often a simple "No, I'm not going to do that, but I will do this..." is sufficient.
- vladvasiliu 3y ago
  What exactly did you do over the wifi? How do you think they were able to access your private SSH key by simply having your laptop join their wifi? Did you leave the laptop unattended and unlocked?
  - keepamovin 3y ago
    They asked to view some private repo on GitHub, just whatever random file I chose to show them to see an example of some significant work. > How do you think they were able to access your private SSH key by simply having your laptop join their wifi? I don't know. I assume it's possible, I thought you could get hacked over open wifi? Anyway, but how would it be done do you think? If it's only MITM then perhaps SSH keys were not compromised. But I didn't take that chance. I just changed everything.
    - vladvasiliu 3y ago
      > but how would it be done do you think? That's what I'm trying to figure. Open wifi or not, your private ssh key shouldn't leave your pc when you're using it. Ditto for whatever sites you visit over HTTPS, the whole point of TLS is to avoid MITMing connections and extracting their contents.
      - keepamovin 3y ago
        I'd assumed that somehow connecting to or using their wifi got local privileges? There's things like cellular modem exploits that bypass all the higher layers of the stack and get access to your cell phone at the base layer. I'm guessing similar stuff exists for wifi. Heck it could have even been a power cable I maybe mistakenly plugged in trusting it! I'm not an expert on any of this tho. With the MITM I think you're right, I would have expected to see some cert issues. But I know I have seen GitHub MITM'ing before with a state issued MITM certificate (won't say where right now), tho I did notice that because there were connection issues and then I paid attention to the address bar. It could have been that there were cert issues, I just wasn't paying attention to them, as it was an interview. That sounds plausible. I guess the issue is there's all kinds of exploits and zero days that most regular people don't really know. Of course they could have combined it with a PDF exploit from something they emailed me. I don't know! Did you find anything on this in the meantime, on theories on the different ways it could be possible? How would you rate your cybersecurity redteam/blueteam knowledge in this domain on a scale of 1 to 10 (10 being best)?
- cinntaile 3y ago
  > Maybe it’s nothing. It’s probably nothing. Yep, two different companies flying you out just to hack your shit. It's probably nothing. It makes me curious what you work with. Do you maintain commonly used open source software?
  - keepamovin 3y ago
    Well I mean, it's not like anyone told me they were hacking stuff. I'm probably just over reacting, or misreading it. Strictly speaking I think it's prudent to keep an open mind until it's definitively proven with evidence, but my current take is what I've said here. This was at the point in time where I was developing BrowserBox and doing demos but had not released the code publicly.
  - Kinrany 3y ago
    The same adversary trying to hack twice with the same method is entirely plausible though. On the other hand if they invited GP to their HQ, they'd have a lot to lose unless the companies were entirely fake.
- maccard 3y ago
  This sounds to me like you connected to a network on your laptop and cloned an "internal" repo that downloaded something (no different to. Pip or Npm do the same thing. And that your mail client saw a new IP and treated it as a new session? I think assuming you were hacked based on this is paranoid. > To proceed… with hacking? Or maybe, they didn't have a laptop for you to use (which is stupid, don't get me wrong) so they couldn't do the next stage unless you had a device. Given you had to use it for the first step, it doesn't seem unlikely. If they wanted to "hack" you, they didn't need to fly you out, they just needed you to clone the repo and run the script.
  - keepamovin 3y ago
    Haha, yeah, I understand how you could have misread it like that, I'm sorry the original was not very clear! Let me try again: then didn't ask me to clone any repos of theirs. They only asked me to show them my private repo on GitHub so they could see some significant work I had done. I just picked some random nothing file and they were satisfied. Then I saw that this private repo had been cloned after that trip. Normally you can't see clone IPs on GitHub but for my install process the npm "postinstall" script pulled something off my web server. Basically I had a line buried in one of the scripts referenced in the postinstall script: wget --header="Authorization: Bearer $MY_ACCESS_TOKEN" https://api.myserver.com/data The only thing that ever pulled off that URL was that private repo postinstall script. After seeing my mail session at a random IP in that country, I thought oh that's probably me, but then I was already back home and I wondered why there was still a session there, so I then checked the logs of my server saw another IP from that country pulling that URL, from the day after I was there, when I hadn't made any servers there or run that script when there. What you say about the laptop was what I originally thought: Why do they want me to bring a laptop? Do they seriously believe I don't have a computer? Hahaha > If they wanted to "hack" you, they didn't need to fly you out, they just needed you to clone the repo and run the script. I agree it sounds implausible, right? It's probs nothing. Likely I'm just misreading it. I don't want to jump the gun and I think it's prudent to keep an open mind, I certainly don't want to spread a bs rumour, nor misrepresent a country with something had not been definitively proven with facts. That would totally lack integrity, be irresponsible, and would be undermining due process and ethics. It would also just be disgusting awful betrayal of everything good, so I don't want to jump the gun or name and shame. I was invited and travelled to many countries for these types of interviews back in the day, all over the world: Europe, USA, Asia, even one in Africa. Definitely had some weird vibes at different places, but never had the same feeling of "hacked" as above. But just wanted to clarify the facts. Does what I said make sense? Sorry it's late here.

Look it is probably nothing…but anyway, this is not the time nor place to name and shame, but more specifics. So… Interviewer specifically asked me to bring my computer, after the initial intro they asked me to show some code I’d written. I said I’d just connect to my mobile hotspot. They looked shocked and said “I didn’t think you’d have a phone here” (it was an overseas fly out for the day), I said it’s fine, I always have a phone. And they insisted I instead connect to their office wifi. It was the only wifi i used the whole time i was there. Back in other country I saw my mail had another logged in session, and a private repo post install script had pulled a resource from my server, from an IP back in the country, and another random country. Only way to access to private repo was SSH key (or GitHub credentials) Only way to access to Mail was MITM cloning session or access to device (more likely - I thought i would have noticed any MITM cert issues). Incidentally, from the same country, this time another company, I had another fly out interview request a week later and this company also specifically asked me to bring my computer — when I asked if it would be ok if I wasn’t gonna bring my computer because I needed to get it fixed, they got back the next day and said oh, we have to cancel the interview because we it won’t be possible for us to proceed. To proceed… with hacking? Hahaha, who knows? I’m not expert enough to know what this all means. Maybe it’s nothing. It’s probably nothing.

slekker 3y ago
please name and shame, at least the country.
- keepamovin 3y ago
  Not the time or the place. It would be misinterpreted. I don't want it to misrepresent the place.
  - AlexSW 3y ago
    Or at least which country?
    - keepamovin 3y ago
      Like i said man. No. Hope you can respect that. I don't want to be responsible for misrepresenting a country, and I think it's prudent to keep the protection of privacy there until it's definitively proven with evidence.
      - ChrisMarshallNY 3y ago
        Good call. That's my M.O. I take it a bit further. I won't go into pissing matches. If folks wanna fight, I'm not the guy to do it. My general stance is, if it's complimentary/good, I don't worry too much about getting specific. If not, I keep it vague (which sometimes pisses people off, but life is not fair). I generally don't name my former employers, just to keep their name out of venues where someone else with a grudge could throw poo (see "Apple" -not a former employer of mine).
        keepamovin 3y ago
        Me too man. I don’t like saying negative stuff about people, especially unprovoked (is not a counter). Feels like a grave responsibility. Always been that way! I love complimenting people. I’m not sure if it’s connected but in the general sphere of things, maybe one downside I’ve noticed in my life is i can be a bit slow to notice when someone or something isn’t good for me. Even if it’s obvious, to others, i always wanna see the good, sometimes i think I’m in denial willingly! Haha… So I have learned to become aware of such people and their behavior, pattern recognition.
        ChrisMarshallNY 3y ago
        I've learned to keep some relationships at arm's length. It's a long story, but I have spent my entire adult life, dealing with some of the most dangerous, doesn't-play-well-with-others people on earth. I'm proud to call some of them friends, and have learned to politely avoid getting too entangled with the drama of others. I've learned that I'm responsible for enforcing my own boundaries, and that I don't need to use nukes. Often a simple "No, I'm not going to do that, but I will do this..." is sufficient.
vladvasiliu 3y ago
What exactly did you do over the wifi? How do you think they were able to access your private SSH key by simply having your laptop join their wifi? Did you leave the laptop unattended and unlocked?
- keepamovin 3y ago
  They asked to view some private repo on GitHub, just whatever random file I chose to show them to see an example of some significant work. > How do you think they were able to access your private SSH key by simply having your laptop join their wifi? I don't know. I assume it's possible, I thought you could get hacked over open wifi? Anyway, but how would it be done do you think? If it's only MITM then perhaps SSH keys were not compromised. But I didn't take that chance. I just changed everything.
  - vladvasiliu 3y ago
    > but how would it be done do you think? That's what I'm trying to figure. Open wifi or not, your private ssh key shouldn't leave your pc when you're using it. Ditto for whatever sites you visit over HTTPS, the whole point of TLS is to avoid MITMing connections and extracting their contents.
    - keepamovin 3y ago
      I'd assumed that somehow connecting to or using their wifi got local privileges? There's things like cellular modem exploits that bypass all the higher layers of the stack and get access to your cell phone at the base layer. I'm guessing similar stuff exists for wifi. Heck it could have even been a power cable I maybe mistakenly plugged in trusting it! I'm not an expert on any of this tho. With the MITM I think you're right, I would have expected to see some cert issues. But I know I have seen GitHub MITM'ing before with a state issued MITM certificate (won't say where right now), tho I did notice that because there were connection issues and then I paid attention to the address bar. It could have been that there were cert issues, I just wasn't paying attention to them, as it was an interview. That sounds plausible. I guess the issue is there's all kinds of exploits and zero days that most regular people don't really know. Of course they could have combined it with a PDF exploit from something they emailed me. I don't know! Did you find anything on this in the meantime, on theories on the different ways it could be possible? How would you rate your cybersecurity redteam/blueteam knowledge in this domain on a scale of 1 to 10 (10 being best)?
cinntaile 3y ago
> Maybe it’s nothing. It’s probably nothing. Yep, two different companies flying you out just to hack your shit. It's probably nothing. It makes me curious what you work with. Do you maintain commonly used open source software?
- keepamovin 3y ago
  Well I mean, it's not like anyone told me they were hacking stuff. I'm probably just over reacting, or misreading it. Strictly speaking I think it's prudent to keep an open mind until it's definitively proven with evidence, but my current take is what I've said here. This was at the point in time where I was developing BrowserBox and doing demos but had not released the code publicly.
- Kinrany 3y ago
  The same adversary trying to hack twice with the same method is entirely plausible though. On the other hand if they invited GP to their HQ, they'd have a lot to lose unless the companies were entirely fake.
maccard 3y ago
This sounds to me like you connected to a network on your laptop and cloned an "internal" repo that downloaded something (no different to. Pip or Npm do the same thing. And that your mail client saw a new IP and treated it as a new session? I think assuming you were hacked based on this is paranoid. > To proceed… with hacking? Or maybe, they didn't have a laptop for you to use (which is stupid, don't get me wrong) so they couldn't do the next stage unless you had a device. Given you had to use it for the first step, it doesn't seem unlikely. If they wanted to "hack" you, they didn't need to fly you out, they just needed you to clone the repo and run the script.
- keepamovin 3y ago
  Haha, yeah, I understand how you could have misread it like that, I'm sorry the original was not very clear! Let me try again: then didn't ask me to clone any repos of theirs. They only asked me to show them my private repo on GitHub so they could see some significant work I had done. I just picked some random nothing file and they were satisfied. Then I saw that this private repo had been cloned after that trip. Normally you can't see clone IPs on GitHub but for my install process the npm "postinstall" script pulled something off my web server. Basically I had a line buried in one of the scripts referenced in the postinstall script: wget --header="Authorization: Bearer $MY_ACCESS_TOKEN" https://api.myserver.com/data The only thing that ever pulled off that URL was that private repo postinstall script. After seeing my mail session at a random IP in that country, I thought oh that's probably me, but then I was already back home and I wondered why there was still a session there, so I then checked the logs of my server saw another IP from that country pulling that URL, from the day after I was there, when I hadn't made any servers there or run that script when there. What you say about the laptop was what I originally thought: Why do they want me to bring a laptop? Do they seriously believe I don't have a computer? Hahaha > If they wanted to "hack" you, they didn't need to fly you out, they just needed you to clone the repo and run the script. I agree it sounds implausible, right? It's probs nothing. Likely I'm just misreading it. I don't want to jump the gun and I think it's prudent to keep an open mind, I certainly don't want to spread a bs rumour, nor misrepresent a country with something had not been definitively proven with facts. That would totally lack integrity, be irresponsible, and would be undermining due process and ethics. It would also just be disgusting awful betrayal of everything good, so I don't want to jump the gun or name and shame. I was invited and travelled to many countries for these types of interviews back in the day, all over the world: Europe, USA, Asia, even one in Africa. Definitely had some weird vibes at different places, but never had the same feeling of "hacked" as above. But just wanted to clarify the facts. Does what I said make sense? Sorry it's late here.