15 ms·

The North Korean fake IT worker problem is ubiquitous

307 points by rntn 1y ago

anovikov 1y ago
You don't have to be an evil North Korean to do that. Outsources have been doing it since time immemorial because they can't achieve sales in any other way (or, through direct corruption - often offshore outsourcing shops are owned by managers of their clients, who effectively use them as tools for siphoning money away).
- gibbitz 1y ago
  Hopefully the fear of foreign actors will put an end to this too. I have to hand it to North Korea on the inventive revenue streams. This is a country under sanctions for decades that has developed some of the most clever IT scams for siphoning money from the west. Between this and the Lazarus group the country has brought in Fortune 500 company kinds of money to keep itself afloat.
abxyz 1y ago
The supposed problem is being peddled by a company called Socure, who, coincidentally, offer the solution to this problem. There are absolutely "fake" remote workers floating around but to suppose this is some grand security-focused North Korean government conspiracy rather than people from poorer nations trying to get paid is without evidence. "North Korean" job applicants has become a meme, any suspicious looking applicant is being labelled "North Korean" by people who've read articles planted by Socure. If this were a grand North Korean government orchestrated conspiracy we would not see hundreds of job applicants engaging in exactly the same strategy for the same job. https://www.socure.com/blog/hiring-the-enemy-employment-fraud https://www.socure.com/blog/hiring-the-enemy-employment-frau... https://www.paulgraham.com/submarine.html https://www.paulgraham.com/submarine.html
- le-mark 1y ago
  But when the FBI tells you, you might really have a problem, as happened at one company I was at several years ago.
  - xkcd-sucks 1y ago
    [flagged]
    - deleted 1y ago
      [deleted]
    - arresin 1y ago
      Ok but plan for a long sleep.
- NitpickLawyer 1y ago
  > but to suppose this is some grand security-focused North Korean government conspiracy rather than people from poorer nations trying to get paid is without evidence. Uhh... I have news for you: https://www.fbi.gov/wanted/cyber/dprk-it-workers https://www.fbi.gov/wanted/cyber/dprk-it-workers
  - hodgesrm 1y ago
    Not sure why this is downvoted. There’s now abundant evidence it’s happening.
    - ChrisMarshallNY 1y ago
      I have a feeling there may be a Nork "flash mob" going on, like when someone says bad stuff about Musk.
  - arresin 1y ago
    North Koreax folk
- spydum 1y ago
  Yeah I get your skepticism, but this is really a huge issue in many industries. We are seeing it with an alarmingly high rate. You don't need a technical solution though, as the article points out, some stuff is just process change: In person final interview, gov issued ID checks, initial hardware delivery in office, etc.
  - bri3d 1y ago
    I’ve also seen this pattern at a pervasive rate but I think it’s mostly shady overemployment / outsourcing agencies, with NK as a tag along. It doesn’t matter either way since the countermeasures are the same (besides the stupid meme KJU junk).
- fergie 1y ago
  Many users here don’t seem to understand that they are reading content marketing.
5350-uiop-1130 1y ago
company finally swipes right only to get catfished by a DPRK agent nice
CyberMacGyver 1y ago
I am building a free service to counter exactly this problem. This has been going on since 2018 at least and I have flagged thousands of such applicants.
- tomrod 1y ago
  Speak some more on this.
  - grej 1y ago
    Yes please, I'm also interested in hearing more about what you're building CyberMacGyver
- triceratops 1y ago
  I'm curious why free?
hnthrow90348765 1y ago
FWIW, it the "insult Kim Jong-Un" meme that's been going around doesn't work
- kyo_gisors 1y ago
  [flagged]
  - rcstank 1y ago
    How is it racist?
    - charcircuit 1y ago
      It is trying to avoid hiring an ethnicity by saying things that a specific ethnicity would find offensive, but not others so you can filter them out of the hiring process.
      - throwaway48476 1y ago
        I dont think KJU is held in high esteem by the defector community.
      - bigstrat2003 1y ago
        That is not what that's about. It is trying to avoid hiring people who work for a foreign government by asking them to say things that would be illegal in their country. It has nothing to do with ethnicity and everything to do with nationality.
      - ImJamal 1y ago
        Nobody is trying to avoid hiring an ethnicity. There are plenty of Koreans that would still be hired, those from South Korea and everywhere other than North Korea.
- jawiggins 1y ago
  Did you try it? What did the person say?
Maxious 1y ago
Jeff Geerling recently discussed being contacted by the FBI to learn more about minature KVMs, one of the devices North Korean fake IT workers use to appear to be coming from other countries https://www.youtube.com/watch?v=Lc2hB2AwHso https://www.youtube.com/watch?v=Lc2hB2AwHso
- geerlingguy 1y ago
  In this case, the KVMs are plugged into multiple laptops being run in people's basement/spare bedroom, it seems. Someone will earn a set amount per laptop per month, to accept a company-supplied laptop (from a us company) then plug in one of these little KVMs to give a remote worker access without as much ease in detection.
  - moffkalast 1y ago
    So the main difference over more typical remote desktop methods is that it pretends to be a physical display and keyboard to fool the PC it's remoting into in if it's overly locked down? Feels like there's otherwise a hundred different ways to already do remote control without any extra hardware.
    - nightfly 1y ago
      > Feels like there's otherwise a hundred different ways to already do remote control without any extra hardware This way the worker doesn't have to know 100 different ways to remote into the machine, just one
    - bjackman 1y ago
      All the alternatives have a risk of setting off D&R tripwires. Assuming these things can spoof their device IDs so they look like a Logitech keyboard etc, I think the cost of the hardware setup is gonna easily pay for itself in terms of harder detection.
      - InfiniteLoup 1y ago
giantg2 1y ago
The part that's really sad is that we have tons of out of work devs right now. This sort of thing only makes it harder for the legitimate people to get hired. An easy fix for this is for a place like Pearson to set up verified interview centers, which will allow for verified virtual interviews (on both sides of the table).
- ChrisMarshallNY 1y ago
  Not sure why that comment got downvoted. It doesn't seem to detract from the topic at hand. Not sure if it's feasible, but it's definitely something to consider.
- lend000 1y ago
  Interesting idea! This seems like a natural extension of the coworking space business concept.
  - giantg2 1y ago
    Yeah, I was thinking of the Pearson testing centers because they're already prpctored to prevent cheating and setup for identity verification. But co-working spacings could certainly work too. That might be even more viable in Europe.
- mjevans 1y ago
  Another solution might be UNIONS that would have __membership verification__ including things like citizenship (which country(ies) are they a citizen of?), skills tests and training, etc. Just like competition requires 5+ similarly sized entities for a healthy marketplace of companies, my informal opinion is that unions probably similarly shouldn't have overwhelming market share. However my feeling on contracts between unions and corporations is that the contract should be negotiated between multiple companies and multiple unions to produce the most level playing field possible.
  - jacob_a_dev 1y ago
    At least in the US, I like that software engineering doesnt require/encourage unions, contrary to other big industries. As unions mature they protect the employment of their members, not prospective members who are unemployed applying for jobs. One great thing about being a dev in the US, u dont need a degree, learn a lot, can apply and get a great job. Ive previpusly been in a union for a company and the experience did not encourage a competitive working environment. When layoffs came, Jr employees get sacked before more senior union members (not neccesarily the best technical staff just becuase they worked there long time). I have family/friends in unions (non software devs) that have had similar experiences to mine.
Barrin92 1y ago
I don't really understand the logistics of this to be honest. From the article it doesn't sound like these people have false IDs, they just make fake LinkedIn profiles? In a lot of countries certainly here in Germany your employer has to pay social security contributions and needs your insurance, healthcare information etc. In addition if you're a foreigner you need to know their legal status to see if they can even work. Like what do these scammed companies do, just wire money to some guy they interviewed on social media and ship company property to random addresses? Is that even legal in most places?
- trinix912 1y ago
  They presumably wire the money to a person operating in the US who sends a portion of that money to the NK employee. The US person is then the one in the company payroll files. At least that's my understanding.
  - ChrisMarshallNY 1y ago
    We should definitely go after those folks, but it's not pleasant, as many of them may be having their own issues that add to the problem. One of the big problems with the US, is that we worship money like a god. People will do almost anything, and compromise all their personal values, for money. We have entire industries that sell narratives, rationalizing these compromises. This is exacerbated by the current employment problems. They keep talking about how unemployment is down, but I think we all know folks that are un (or under-) employed, and the difficulties they are having, finding work. Someone in that state, is fertile ground for money- and job-laundering bad actors. It sucks to punish them, but that is what we need to do, to discourage the practice.
    - collingreen 1y ago
      I agree but I don't actually feel bad about punishing people for committing fraud (as long as we punish all people fairly, etc). > People will do almost anything, and compromise all their personal values, for money I think this demonstrates what their ACTUAL values are or at get very least the priority of those values.
nobodyandproud 1y ago
Maybe this, with mandatory senior executive and board accountability, will be the wakeup call to stop the outsourcing problem of the last 50 years.
- deadbabe 1y ago
  [flagged]
  - almosthere 1y ago
    the funneling of money from the us to other countries for workers the companies located here should only hire here
    - deadbabe 1y ago
      [flagged]
      - nobodyandproud 1y ago
        That’s bad faith quip. The US is a competitive market with ground rules.
- rwmj 1y ago
  What does this have to do with outsourcing?
  - nobodyandproud 1y ago
    It’s about incentives. Direct impact: Outsourcing breeds a culture of unverified and verified-just-once remote work. Indirect impact: Outsourcing is a cost-driven effort where after a certain level of competence, the bottom-line is the only measurable metric that matters so it’s a race to the bottom with patchwork efforts to “fix” issues like OP. Making domestic options cost-equivalent with punitive outcomes for hiring NK workers.
alganet 1y ago
I think the paranoia and fear this kind of idea promotes is perhaps the point of all of it. Why this is being discussed publicly? It seems way more reasonable to inform IT companies directly, or investigate it outside media attention. Also, we need steps towards reducing the possible tools that fake workers could leverage. These steps would put a strain on some recent technological developments. A strange and wild paradox.
- markerz 1y ago
  Why try to hide it? It’s like public disclosures of security vulnerabilities. You directly contact the few people who have actionable data and means to address the problem, then you tell the world that they’re impacted and should be aware that such a problem exists so we don’t repeat it.
  - alganet 1y ago
    Private disclosures for more sensitive vulnerabilities are a recommended practice. In your analogy, that's why I aluded to. In such cases, you only share the sensitive vulnerability publicly once there is a fix. For this case, there seems to be no fix. One could think of it as a way to promote more scrutinized hiring processes, but it actually encourages widespread paranoia and fear. It seems your analogy is valid, but the conclusion is that it supports what I said.
- brookst 1y ago
  I’m not sure it’s good for anyone to keep SMB’s in the dark, as they have the most surface area and least expertise and budget to respond. It seems like a net benefit to publicize the issue and get every IT hiring manager thinking about it.
  - alganet 1y ago
    Can you elaborate more? It seems that you disagree but I'm missing the rationale behind it.
    - 1y ago
pxc 1y ago
It's been over 75 years. It could not be clearer that this attempt to punish the ordinary people who live in North Korea for having a government that the US finds disagreeable will not succeed in somehow fomenting revolution. What it has succeeded in doing, apparently, is sustaining a level of poverty and isolation that motivates even crazy schemes like this. Here's how to actually stop it: stop weaponizing poverty to beat a Cold War-era dead horse, and end the damn sanctions.
- dontTREATonme 1y ago
  Ah yes, bec that’s worked out so well with china. Anyone with internet access in NK is working at the behest of the government.
- trallnag 1y ago
  Russia was an important trading partner for many European countries. Especially important for Germany. Basically no sanctions. Freedom of movement with fairly good visa policies. No great internet firewall. How much did all this help to prevent another huge war between two European countries?
  - shermantanktop 1y ago
    Exactly. Trade ties only go so far. But this pov isn’t always rooted in pragmatism. Free market ideologues also think that free markets will bring world peace.
  - pxc 1y ago
    Different behaviors have different motivations, contexts, and causes. It's extremely clear that these, like other criminal moneymaking schemes in the DPRK, are directly and closely related to the high degree of isolation of the DPRK and the difficulty of getting capital into it. Of course lifting the sanctions won't also end all spycraft, or ensure an end to geopolitical conflict. Those aren't things I have claimed or would claim. And the primary reason to end such sanctions is not any benefit to imperialist nations but because of the fact that they inflict misery on ordinary people indefinitely and (not essential, but adding insult to injury) uselessly.
iw7tdb2kqo9 1y ago
[flagged]
ta1243 1y ago
Have your new hire turn up and meet with the team on day one. They'll soon twig if that's not the person who's getting called into a quick meeting in 5 minutes to discuss some new issue.
conradev 1y ago
I can’t find the tweet but apparently you can also filter these folks out by asking them to criticize Kim Jong Un
- deleted 1y ago
  [deleted]
- ghssds 1y ago
  If someone asked me to criticize KJU, that would be the end of the conversation. I criticize people on my own or not at all. I suppose I would become a false positive.
  - pmarreck 1y ago
    Sounds just like something a North Korean would say
    - JumpCrisscross 1y ago
      Honestly, sounds like a red flag if even a legitimate applicant is unwilling to voice an opinion on the Kim regime.
      - denkmoon 1y ago
        Without context it seems like a weird trick question, like phishing tests and most corporate training.
      - codedokode 1y ago
        Replace North Korean leader with Biden and Trump, how that sounds?
        jfengel 1y ago
        Pretty sure a huge number of Americans would happily curse both with the fire of a thousand suns.
austin-cheney 1y ago
So, again, the answering to this and most every other hiring ill in software over the past 15-20 years is… licensing. So, let’s think about this logically. There is no baseline of candidate identification or competence in software and the jobs pay very well in physically comfortable conditions. It makes sense that unqualified liars would apply for these positions. Why shouldn’t they? I am honestly curious how far the fraud and incompetence can go and devalue the industry before someone cares enough to tackle the problem l.
- hollerith 1y ago
  Irrelevant to the OP unless you explain why North Koreans would be prevented from obtaining these licenses: it's not like there aren't competent developers in North Korea. If your explanation is that the license grantor will verify that the applicant is a resident of a Western country, than the employer can just do the same verification of job applicants, dispensing with the need for the occupational license.
  - acdha 1y ago
    The way these people are being caught are things like dodgy LinkedIn profiles or refusing in person meetings so I would think a licensing process designed around things which would be expensive to fake: in person government ID checks, periodic exams, peer evaluations, etc. The trick would be actually doing that in person, which could be a useful thing for conferences - treat an afternoon at PyCon or re:Invent as the cost of renewing your professional credentials if you don’t live near a major city or university.
    - bigfatkitten 1y ago
      Even an in person ID check would suffice. For most of the West, this is an extremely difficult bar to clear for a North Korean national working out of China.
      - acdha 1y ago
        Yeah, I was thinking that if you were looking for an industry license it would probably be more useful if it also covered skills or work experience in some way since that helps multiple weak points of the common hiring processes but you’re quite right that it would raise the bad considerably if they had to basically run everyone like actual spies with robust fake identities.
dakiol 1y ago
If only governments could provide a very simple “check identity” service online. I think this should be a basic service nowadays.
- Swizec 1y ago
  > If only governments could provide a very simple “check identity” service online. I think this should be a basic service nowadays. Slovenia issues personal certificates so you can identify yourself online. Mostly used for banking and e-gov. The commercial space has decided it’s too cumbersome. Fantastic idea. Started rolling out when I was in college some 15 years ago. You go to the same place that issues your govt ID and you can also get the equivalent of an SSH cert issued by the government that guarantees you are you, your identity was verified at point of issuance, etc. Unfortunately it’s about as fiddly to use as SSH. Okay for nerds, way cumbersome for normal humans who just want to log into their bank and pay their taxes damn it. Last I remember (moved to USA ~10 years ago) getting their e-signing browser widgets/extensions to work reliably on non-windows machines was hell. Most Mac/Linux users ran a whole VMWare VM just to do taxes once a year.
  - immibis 1y ago
    Imagine if you had to provide your government ID to use any website. Even for employment I find the idea iffy, but seeing as it's in response to an actual non-imagined problem, I suppose it's the most reasonable solution to that...
    - dakiol 1y ago
      You lack some imagination. One could verify their identity against a government service once every let’s say 5 years. You get a public link/code that you can share with employers (or banks or real state agencies or…) so that they can use the link/code against a government service to verify that you are who you claim to be.
      - immibis 1y ago
belter 1y ago
Something is amiss here...Developers make hundreds of applications to even get a reply much less an interview...While apparently, barely English literate North Korean IT workers are getting all the jobs :-) Time to praise the Supreme Leader on LinkedIn ?
- sfryxell 1y ago
  I have gotten multiple emails from wonky email addresses offering to have me interview for jobs and they will take care of the work if I get hired. fake names tons of money for me. I just have to nail the interview. My resume is shiny enough and I've gotton hired enough times im a good candidate for this kind of scam. This feels like a very ham fisted approach for them though. 99% of engineers are going to ignore or not take seriously these kinds of out of the blue offers.
  - lazide 1y ago
    1% will be plenty in the current market, eh?
- sva_ 1y ago
  They probably use many identities
- asdf6969 1y ago
  [flagged]
  - heraldgeezer 1y ago
    [flagged]
- wisty 1y ago
  People are single but romance scams exist. Scammers are good at the scam. They are good at telling the right lies, they often work in teams (lead finders, closers, and everything in between), use automation where appropriate, etc. A single dev might have trouble cracking the lead finding code, the resume code, the interview code, etc while and avoiding telling any lies that will get then fired 3 weeks into the job. But a team who all treat the application process as a full time job? It's a lot easier. Also when a dev gets good at finding a job, they stop looking. Scammers get good at it and then keep getting better.
mkl95 1y ago
> As US-based companies become more aware of the fake IT worker problem, the job seekers are increasingly targeting European employers, too. All the US companies I've worked for made sure I was legit before I could log into anything, so I assume background checks to be ubiquitous there, save for the cheapest companies. European employers on the other hand...
- aleph_minus_one 1y ago
  > European employers on the other hand... Many European employers - don't or rarely offer remote jobs, so they often don't have this problem. - even if they do some video or phone interview for pre-screening, they nearly always expect the prospective employee to come to a live interview if they are not weeded out by this pre-screening. It is thus expected that you at least live in a country from where you can easily travel to the place where the employer is located. - often expect their employees to be able to speak the national language, or at least learn it fast. This also makes times hard for North Korean fake IT workers.
  - rcruzeiro 1y ago
    I’ve never had this experience. Never once was I flew in for an interview and, in two of the previous companies I’ve worked for, I did not speak the language.
    - aleph_minus_one 1y ago
      This is at least the experience that I (and many people who I know) had. > I did not speak the language As I implied: if you are really talented, you don't have to speak the native language yet, but it is expected that you learn it fast.
      - rcruzeiro 1y ago
        Maybe I was lucky there (or unlucky depending on the point of view). I’ve even worked for years for a French company without learning French.
Havoc 1y ago
Can’t they just make week 1 in person compulsory? You can easily dress that up as an onboarding thing and would solve this, no?
- someotherperson 1y ago
  Not really. You need a visa (or equivalent) to enter most countries. This can take months to apply for and receive. And you can stretch that period out even longer by claiming that you don't have a passport and need to apply for one first.
  - aleph_minus_one 1y ago
    In Germany, if a company want to hire some talent from a foreign country, this problem is solved by the general rule "The employment starts as soon as the visa problems have been resolved, and you are in Germany." Big companies often have a department that helps with visa problems. So, if you stretch the period, the employment simply starts later.
- bravesoul2 1y ago
  You can. Just like everyone can use a good password. Yet many dont. Also there is a good reason not to make week 1 in person. You reduce your access to talent. I know we are in the everyone RTO and do 100hrs a week part of the BSiness cycle. But still.
  - ryandrake 1y ago
    Workers are currently in a bear market. No company has problems “accessing” talent, at least today. They aren’t going to lose a candidate by simply insisting on an in-person step, whether it be an in-person interview or a week of in-person work.
    - sarchertech 1y ago
      It’s not a bear market for the best candidates. I know plenty of people who have found new jobs in the last 6 months. Many of them would have said no to in-person interviews.
jongjong 1y ago
I suspect it could be worse than that. It feels like certain countries' tech sectors are being partly taken over by IT workers from foreign intelligence agencies or from foreign entities with ulterior motives. Especially when you consider countries with small populations and few natives in the tech sector. For example, in Australia, it seems like at least 8/10 software engineers are foreign-born. Most of those are probably genuine (not from intelligence agencies) but Australia has such a tiny native population of engineers compared to that of most foreign countries in its vicinity that it wouldn't be difficult for a country like China or India to overwhelm our tech industry with a few highly-placed workers in order to gain political leverage. I was thinking that there might be more software engineers working for Indian and Chinese intelligence agencies in the world than there are native-born software engineers in Australia (of all kinds). It's a numbers' game. North Korea seems like the tip of the iceberg there though it is an easy example to talk about because everyone understands how the North Korean government operates and everyone agrees about the threat they pose compared to more subtle threats from other countries which aren't seen as opponents (at least not to the same extent). But also, consider a company like Facebook which hires maybe 20K or so software devs. A country like India which has a large number of software developers, if it wanted, could easily put together a task force to infiltrate and take over Facebook in a focused decade-long effort if that was its intent. They almost certainly do have some people inside every major tech company right now. If a group can have a few highly placed people inside a target company, they could then recruit more of their group into the company and start promoting their own until they have full control over the critical systems. It's a weakness of our current highly centralized tech sector. Something else that could happen is a foreign intelligence agency could wait for people to get promoted naturally and then reach out to dual-nationals which they have leverage over (e.g. because of family members or assets owned in the foreign country) and then use that to demand favors. Then they could help coordinate the engineers to recruit more of their own to achieve even more control. Different groups would form factions within the target company and every normal employee would be unwittingly pushed out because anyone trying to 'improve or simplify things' would be seen as a threat to various nefarious agendas which rely on complexity to hide backdoors or algorithm exploits. Imagine how valuable it would be if you could hijack's Google's search algorithm or Facebook's recommendation engines to prioritize your group's businesses and/or agendas.
nimbius 1y ago
This is a problem the USA caused, and could easily solve, by dissolving the armistice and declaring an end to the Korean war. only seven countries are currently participating in the embargo and sanction of North Korea, (at the behest of the united states.)
- casenmgreen 1y ago
  North Korea would never, in a million billion years, either accept peace, or actually honour it. NK is a hideously oppressive, violent, dictatorship, which would invade SK in a microsecond if it thought it could get away with it. I think it astounding - staggering - to point the finger here at USA. If you were not a long term, serious poster, I would think you were a fake account.
- WhyNotHugo 1y ago
  They convinced Ukraine to give up their nukes, promising that they'd be safe. I don't think there's any chance of convincing North Korea to follow the same path.
- daedrdev 1y ago
  No, one side declaring the end to a war does not end that war, this is one of the worst foreign policy takes I've ever heard. The NK regime is secure because of the war, they will poison pill any negotiation by demanding South Korea become part of the north.
croemer 1y ago
They cite LinkedIn profiles with 25 connections as easy tell tale signs. Well, I've got news for you: hacked LinkedIn profiles. Happened to a colleague of mine. Profile with more than a thousand genuine, reputable connections got hacked. Picture and name got changed to something East Asian sounding/looking. CV got changed to US defense contracting. Luckily this tripped some automatic account lockdown otherwise it might have well gone undiscovered for a while. Few people will remember every single LinkedIn connection, there's no notification of name change in messages etc. Quite likely this profile was sold to North Korean fake IT workers.
- 9cb14c1ec0 1y ago
  Also, many people like me don't even have LinkedIn profiles. The "pick up your work computer in person" idea sounds like a much more reliable method to me.
  - smohare 1y ago
    [dead]
  - abrookewood 1y ago
    But it is so late in the process to catch them - hours wasted by so many people.
    - miffy900 1y ago
      True, but at that point it's still not too late to prevent paying money that will ultimately end up in the NK government hands.
    - asteroidburger 1y ago
      If it was the norm, the fake worker problem would go away, and the hours would not be wasted.
  - Roark66 1y ago
    Yeah, pick up your computer in person will not work if you live 2d travel away. If my remote job told me to pick up the computer in person after 8h of interviews and tests I'd be seriously pissed off. If they advertised it in the beginning I'd not have applied. In my country (Poland) courier companies offer this service of "id checking and contract signing". You can have a courier deliver a contract, check the recipient's photo ID and confirm their identity, have the person sign the contract, return it and the courier takes it back. If there is no such service available there is only one way to prevent this from happening, proper screening of candidates. In my 20+ years of working for Fortune 500 companies in positions not far from the top only 1 - a Japanese one actually screened my educational background and called my references and past employers to verify. If employees worry they will loose some really good candidates that have no documentable background ask them to do some other security check. Do a video call from the main street of their home town. Or some other thing randomly selected from a set of 5. If the role is really important hire someone to visit the remote worker in their home and deliver that laptop in person. But don't expect them to travel to pick it up.
stuaxo 1y ago
Feel like at least one coworker might be better if they were this.
tehjoker 1y ago
The LinkedIn thing is very weird, what about all the guys that worked for another company for a long time and didn't bother with LinkedIn? I don't buy that, but the trend of these guys not showing up in-person at all is very suspicious, though not impossible. There are all kinds of reasons people want to do remote work, and some of those reasons might preclude an in-person meeting (like you might find out about a disability). Still, I agree that's pretty suspicious. However, they didn't offer any proof whatsoever these guys are from North Korea or any motivation for why they would be doing this from North Korea. So, that sounds like potential U.S. propaganda. They said they worked with the FBI, which honestly is a red flag for that kind of thing. Rather, if a company states without proof they're from NK, it's very likely BS. If the feds say it's North Korea without proof, it's definitely BS (they have resources to prove it!). If the Feds say it and provide proof, then we can talk about the proof.
peterdemin 1y ago
I hate how this is acceptable to make such claims about another country without providing any evidence. Same goes for Chinese or Russian hackers. It’s just whoever the US government is unhappy about.
- some_random 1y ago
  What evidence is lacking here?
- energy123 1y ago
  > It’s just whoever the US government is unhappy about. Likewise, you don't have evidence for this.
- esafak 1y ago
  I've interviewed these people. They really exist! I did not know they were North Korean, but it would not surprise me.
- defrost 1y ago
  There's evidence, large investigations, and arrests aplenty already. Justice Department Announces Coordinated, Nationwide Actions to Combat North Korean Remote Information Technology Workers’ Illicit Revenue Generation Schemes (justice.gov) https://www.justice.gov/opa/pr/justice-department-announces-coordinated-nationwide-actions-combat-north-korean-remote https://www.justice.gov/opa/pr/justice-department-announces-... (12 days ago) https://news.ycombinator.com/item?id=44431853 https://news.ycombinator.com/item?id=44431853 Law Enforcement Actions Across 16 States Result in Charges, Arrest, and Seizures of 29 Financial Accounts, 21 Fraudulent Websites, and Approximately 200 Computers .. Today, the United States Attorney’s Office for the District of Massachusetts and the National Security Division announced the arrest of U.S. national Zhenxing “Danny” Wang of New Jersey pursuant to a five-count indictment. The indictment describes a multi-year fraud scheme by Wang and his co-conspirators to obtain remote IT work with U.S. companies that generated more than $5 million in revenue.
- miffy900 1y ago
  The article itself is evidence. There are many more links in it to other stories that report on basically the same or similar incidents. There are also several names in the article itself that you can research or probe on your own to tell if it's coming from a trustworthy source. Consider also the author: it's written by an actual journalist/editor with a large body of pre-existing work in the field, and many of the claims written are backed up by quotes from a named source. It's not like they're writing all this and hiding it behind the weasel phrase 'according to a source close to the matter'. The register too is actually UK founded, so it's not even American. Your reaction is just so typical of people nowadays - just assume it's all 'made up' without any effort in debunking or picking apart any specific claims.
deathanatos 1y ago
Maybe this is a real problem, IDK. But this article is so scant on actual details, and is mostly just weasel-wording it's way to "it's a problem, trust us." > Chief among these disconnects were "shallow" LinkedIn profiles paired with "beefy resumes," she explained, citing job-seeker claims of working at Meta, attending Ivy League schools, developing major tech companies' flagship products … but then only having 25 LinkedIn connections. LinkedIn is not the end-all be-all of résumés, and my coworkers have wildly varying numbers of connections. > "We've certainly seen applicants that fit into this category with various IOCs [indicators of compromise] that we've shared with partners and peers," Snowflake CISO Brad Jones told The Register. This is an abuse of the technical term IoC to try and dress up what amounts to "my gut hunch". > Once the recruitment team began meeting via video conferences with some of the applicants, they noted extremely Western-sounding names, like James Anderson, paired with East Asian appearances and accented English, in much higher numbers than they expected. That's just discriminatory. > "You can't profile people, […] *But* sigh > The fraudster's answers weren't word-for-word ChatGPT, Little noted. "These people are smart, they're not unskilled, they're sophisticated," she said. … no, that's because that's not how LLMs work. > routing everything through a VPN I'm not even sure how you would know this about a candidate. > These IOCs, or indicators of compromise, include email addresses, physical addresses, and phone numbers that have been flagged as associated with non-legitimate candidates. This is begging the question: the candidate is suss because they're suss. What makes the email address et al. "flagged"? > The final step is always an in-person interview. I mean … if you're not doing that, then … okay, I see how the scammers got to you. > "We require people to come to the office to pick up their computer," Robinson said as an example. I mean, if you pay for the plane tickets, the hotels, the taxis, the meals, and the time, sure, I guess. If this is truly a problem — and maybe it is — the Register's reporting is so unspecific that it leaves us with no details of how we might tell, what to look out for (in ways that doesn't run afoul of racial discrimination, or seen elsewhere in the comments, political discrimination). It leaves me thinking this is an ad designed to leave me going "I'd have to hire a company that specializes in this to know if I'm being affected by it."
resheku 1y ago
I keep hearing about this and honestly I don’t get it how does this continue to happen? Here I am, a real human, decent person and a nice guy lol yet I can’t find a good job. What are these companies doing, how is this possible?
- Aurornis 1y ago
  They aren’t telling the truth when they apply. They’ll use stolen identities, fabricated backgrounds, fake reference checks, hacked LinkedIn profiles. They are professionals at lying and interviewing. When it’s your job to get jobs and you’re doing it with organized support, you will find something. They also don’t really care if the job is good or bad. They’re just farming any and all jobs they can get and hanging on to them until they’re pushed out. At many companies, that can take years.
- edm0nd 1y ago
  The Norks basically just steal a very qualified persons identity and info and then use that info to apply for jobs. So on paper, the job applicant looks pretty good but its just all larping from the threat actors. For being such a hermit kingdom, they are very good at infiltrating large companies and stealing cryptocurrencies.
danielhep 1y ago
What’s the end game for these scammers once they get the job? I understand there’s a question of espionage if they’re collecting intel from these companies, but do they also do their jobs? Or do they disappear as soon as they’re hired and collect as much data and money until they get fired? Do they actually know how to do IT work?
- Aurornis 1y ago
  The article mentions ransoming company data or source code as one outcome. For many scammers (not North Korean specifically) it’s just one big game of collecting as many paychecks from as many companies as you can until they fire you. For some multi-job people, the game is to continuously apply to companies and then let any company that is paying attention fire them after 1-3 months. Repeat long enough and you might find your way into a couple companies where your demands are so low that you can do all the jobs in a couple hours per day because your managers are so checked out that they don’t care. Ride this until the company lays off the whole underperforming team, then find the next jobs.
gkanai 1y ago
An required in-person verification due diligence step would stop this, no?
OfficeChad 1y ago
[dead]
ErigmolCt 1y ago
What's clear is that this isn't just a security problem
mathverse 1y ago
This is entirely US's companies fault for not favorizing people from 1st world countries. At this point it's not a question of $ but not really giving a shit. If you have 2 candidates and one is from lets say Czech Republic and the other one from 3rd world then it's fully on you for getting screwed over.
- akazantsev 1y ago
  Could have read the article. All involved companies hired US-based workers who received company-provided laptops and set up remote access on them for North Koreans.
pllbnk 1y ago
I would really like to see one of these deepfake videos that managed to trick any competent interviewer into thinking it was real. I couldn't find anything like that on Youtube. Even in highly controlled environments the deepfake videos can be immediately recognized.
- frontfor 1y ago
  Here’s one example, although I don’t know if this is a North Korean. https://www.linkedin.com/feed/update/urn:li:activity:7292604406464671744?updateEntityUrn=urn%3Ali%3Afs_updateV2%3A%28urn%3Ali%3Aactivity%3A7292604406464671744%2CFEED_DETAIL%2CEMPTY%2CDEFAULT%2Cfalse%29 https://www.linkedin.com/feed/update/urn:li:activity:7292604...
anarticle 1y ago
I've definitely gotten something similar to this in dev slacks offering to use my upwork/linkedin to get a job and then I hand it off to someone else. They claim they'll pay 30-50k/y. Sounds like my IRL value just keeps going up.
marve087 1y ago
[flagged]
Hellenmfinal 1y ago
[dead]
mateoowen44 1y ago
[dead]
peju112 1y ago
[dead]

307 points by rntn 1y ago

You don't have to be an evil North Korean to do that. Outsources have been doing it since time immemorial because they can't achieve sales in any other way (or, through direct corruption - often offshore outsourcing shops are owned by managers of their clients, who effectively use them as tools for siphoning money away).

gibbitz 1y ago
Hopefully the fear of foreign actors will put an end to this too. I have to hand it to North Korea on the inventive revenue streams. This is a country under sanctions for decades that has developed some of the most clever IT scams for siphoning money from the west. Between this and the Lazarus group the country has brought in Fortune 500 company kinds of money to keep itself afloat.

abxyz 1y ago

The supposed problem is being peddled by a company called Socure, who, coincidentally, offer the solution to this problem. There are absolutely "fake" remote workers floating around but to suppose this is some grand security-focused North Korean government conspiracy rather than people from poorer nations trying to get paid is without evidence. "North Korean" job applicants has become a meme, any suspicious looking applicant is being labelled "North Korean" by people who've read articles planted by Socure. If this were a grand North Korean government orchestrated conspiracy we would not see hundreds of job applicants engaging in exactly the same strategy for the same job. https://www.socure.com/blog/hiring-the-enemy-employment-fraud https://www.socure.com/blog/hiring-the-enemy-employment-frau... https://www.paulgraham.com/submarine.html https://www.paulgraham.com/submarine.html

le-mark 1y ago
But when the FBI tells you, you might really have a problem, as happened at one company I was at several years ago.
- xkcd-sucks 1y ago
  [flagged]
  - deleted 1y ago
    [deleted]
  - arresin 1y ago
    Ok but plan for a long sleep.
NitpickLawyer 1y ago
> but to suppose this is some grand security-focused North Korean government conspiracy rather than people from poorer nations trying to get paid is without evidence. Uhh... I have news for you: https://www.fbi.gov/wanted/cyber/dprk-it-workers https://www.fbi.gov/wanted/cyber/dprk-it-workers
- hodgesrm 1y ago
  Not sure why this is downvoted. There’s now abundant evidence it’s happening.
  - ChrisMarshallNY 1y ago
    I have a feeling there may be a Nork "flash mob" going on, like when someone says bad stuff about Musk.
- arresin 1y ago
  North Koreax folk
spydum 1y ago
Yeah I get your skepticism, but this is really a huge issue in many industries. We are seeing it with an alarmingly high rate. You don't need a technical solution though, as the article points out, some stuff is just process change: In person final interview, gov issued ID checks, initial hardware delivery in office, etc.
- bri3d 1y ago
  I’ve also seen this pattern at a pervasive rate but I think it’s mostly shady overemployment / outsourcing agencies, with NK as a tag along. It doesn’t matter either way since the countermeasures are the same (besides the stupid meme KJU junk).
fergie 1y ago
Many users here don’t seem to understand that they are reading content marketing.

5350-uiop-1130 1y ago

company finally swipes right only to get catfished by a DPRK agent nice

CyberMacGyver 1y ago

I am building a free service to counter exactly this problem. This has been going on since 2018 at least and I have flagged thousands of such applicants.

tomrod 1y ago
Speak some more on this.
- grej 1y ago
  Yes please, I'm also interested in hearing more about what you're building CyberMacGyver
triceratops 1y ago
I'm curious why free?

hnthrow90348765 1y ago

FWIW, it the "insult Kim Jong-Un" meme that's been going around doesn't work

kyo_gisors 1y ago
[flagged]
- rcstank 1y ago
  How is it racist?
  - charcircuit 1y ago
    It is trying to avoid hiring an ethnicity by saying things that a specific ethnicity would find offensive, but not others so you can filter them out of the hiring process.
    - throwaway48476 1y ago
      I dont think KJU is held in high esteem by the defector community.
    - bigstrat2003 1y ago
      That is not what that's about. It is trying to avoid hiring people who work for a foreign government by asking them to say things that would be illegal in their country. It has nothing to do with ethnicity and everything to do with nationality.
    - ImJamal 1y ago
      Nobody is trying to avoid hiring an ethnicity. There are plenty of Koreans that would still be hired, those from South Korea and everywhere other than North Korea.
jawiggins 1y ago
Did you try it? What did the person say?

Maxious 1y ago

Jeff Geerling recently discussed being contacted by the FBI to learn more about minature KVMs, one of the devices North Korean fake IT workers use to appear to be coming from other countries https://www.youtube.com/watch?v=Lc2hB2AwHso https://www.youtube.com/watch?v=Lc2hB2AwHso

geerlingguy 1y ago
In this case, the KVMs are plugged into multiple laptops being run in people's basement/spare bedroom, it seems. Someone will earn a set amount per laptop per month, to accept a company-supplied laptop (from a us company) then plug in one of these little KVMs to give a remote worker access without as much ease in detection.
- moffkalast 1y ago
  So the main difference over more typical remote desktop methods is that it pretends to be a physical display and keyboard to fool the PC it's remoting into in if it's overly locked down? Feels like there's otherwise a hundred different ways to already do remote control without any extra hardware.
  - nightfly 1y ago
    > Feels like there's otherwise a hundred different ways to already do remote control without any extra hardware This way the worker doesn't have to know 100 different ways to remote into the machine, just one
  - bjackman 1y ago
    All the alternatives have a risk of setting off D&R tripwires. Assuming these things can spoof their device IDs so they look like a Logitech keyboard etc, I think the cost of the hardware setup is gonna easily pay for itself in terms of harder detection.
    - InfiniteLoup 1y ago

giantg2 1y ago

The part that's really sad is that we have tons of out of work devs right now. This sort of thing only makes it harder for the legitimate people to get hired. An easy fix for this is for a place like Pearson to set up verified interview centers, which will allow for verified virtual interviews (on both sides of the table).

ChrisMarshallNY 1y ago
Not sure why that comment got downvoted. It doesn't seem to detract from the topic at hand. Not sure if it's feasible, but it's definitely something to consider.
lend000 1y ago
Interesting idea! This seems like a natural extension of the coworking space business concept.
- giantg2 1y ago
  Yeah, I was thinking of the Pearson testing centers because they're already prpctored to prevent cheating and setup for identity verification. But co-working spacings could certainly work too. That might be even more viable in Europe.
mjevans 1y ago
Another solution might be UNIONS that would have __membership verification__ including things like citizenship (which country(ies) are they a citizen of?), skills tests and training, etc. Just like competition requires 5+ similarly sized entities for a healthy marketplace of companies, my informal opinion is that unions probably similarly shouldn't have overwhelming market share. However my feeling on contracts between unions and corporations is that the contract should be negotiated between multiple companies and multiple unions to produce the most level playing field possible.
- jacob_a_dev 1y ago
  At least in the US, I like that software engineering doesnt require/encourage unions, contrary to other big industries. As unions mature they protect the employment of their members, not prospective members who are unemployed applying for jobs. One great thing about being a dev in the US, u dont need a degree, learn a lot, can apply and get a great job. Ive previpusly been in a union for a company and the experience did not encourage a competitive working environment. When layoffs came, Jr employees get sacked before more senior union members (not neccesarily the best technical staff just becuase they worked there long time). I have family/friends in unions (non software devs) that have had similar experiences to mine.

Barrin92 1y ago

I don't really understand the logistics of this to be honest. From the article it doesn't sound like these people have false IDs, they just make fake LinkedIn profiles? In a lot of countries certainly here in Germany your employer has to pay social security contributions and needs your insurance, healthcare information etc. In addition if you're a foreigner you need to know their legal status to see if they can even work. Like what do these scammed companies do, just wire money to some guy they interviewed on social media and ship company property to random addresses? Is that even legal in most places?

trinix912 1y ago
They presumably wire the money to a person operating in the US who sends a portion of that money to the NK employee. The US person is then the one in the company payroll files. At least that's my understanding.
- ChrisMarshallNY 1y ago
  We should definitely go after those folks, but it's not pleasant, as many of them may be having their own issues that add to the problem. One of the big problems with the US, is that we worship money like a god. People will do almost anything, and compromise all their personal values, for money. We have entire industries that sell narratives, rationalizing these compromises. This is exacerbated by the current employment problems. They keep talking about how unemployment is down, but I think we all know folks that are un (or under-) employed, and the difficulties they are having, finding work. Someone in that state, is fertile ground for money- and job-laundering bad actors. It sucks to punish them, but that is what we need to do, to discourage the practice.
  - collingreen 1y ago
    I agree but I don't actually feel bad about punishing people for committing fraud (as long as we punish all people fairly, etc). > People will do almost anything, and compromise all their personal values, for money I think this demonstrates what their ACTUAL values are or at get very least the priority of those values.

nobodyandproud 1y ago

Maybe this, with mandatory senior executive and board accountability, will be the wakeup call to stop the outsourcing problem of the last 50 years.

deadbabe 1y ago
[flagged]
- almosthere 1y ago
  the funneling of money from the us to other countries for workers the companies located here should only hire here
  - deadbabe 1y ago
    [flagged]
    - nobodyandproud 1y ago
      That’s bad faith quip. The US is a competitive market with ground rules.
rwmj 1y ago
What does this have to do with outsourcing?
- nobodyandproud 1y ago
  It’s about incentives. Direct impact: Outsourcing breeds a culture of unverified and verified-just-once remote work. Indirect impact: Outsourcing is a cost-driven effort where after a certain level of competence, the bottom-line is the only measurable metric that matters so it’s a race to the bottom with patchwork efforts to “fix” issues like OP. Making domestic options cost-equivalent with punitive outcomes for hiring NK workers.

alganet 1y ago

I think the paranoia and fear this kind of idea promotes is perhaps the point of all of it. Why this is being discussed publicly? It seems way more reasonable to inform IT companies directly, or investigate it outside media attention. Also, we need steps towards reducing the possible tools that fake workers could leverage. These steps would put a strain on some recent technological developments. A strange and wild paradox.

markerz 1y ago
Why try to hide it? It’s like public disclosures of security vulnerabilities. You directly contact the few people who have actionable data and means to address the problem, then you tell the world that they’re impacted and should be aware that such a problem exists so we don’t repeat it.
- alganet 1y ago
  Private disclosures for more sensitive vulnerabilities are a recommended practice. In your analogy, that's why I aluded to. In such cases, you only share the sensitive vulnerability publicly once there is a fix. For this case, there seems to be no fix. One could think of it as a way to promote more scrutinized hiring processes, but it actually encourages widespread paranoia and fear. It seems your analogy is valid, but the conclusion is that it supports what I said.
brookst 1y ago
I’m not sure it’s good for anyone to keep SMB’s in the dark, as they have the most surface area and least expertise and budget to respond. It seems like a net benefit to publicize the issue and get every IT hiring manager thinking about it.
- alganet 1y ago
  Can you elaborate more? It seems that you disagree but I'm missing the rationale behind it.
  - 1y ago

pxc 1y ago

It's been over 75 years. It could not be clearer that this attempt to punish the ordinary people who live in North Korea for having a government that the US finds disagreeable will not succeed in somehow fomenting revolution. What it has succeeded in doing, apparently, is sustaining a level of poverty and isolation that motivates even crazy schemes like this. Here's how to actually stop it: stop weaponizing poverty to beat a Cold War-era dead horse, and end the damn sanctions.

dontTREATonme 1y ago
Ah yes, bec that’s worked out so well with china. Anyone with internet access in NK is working at the behest of the government.
trallnag 1y ago
Russia was an important trading partner for many European countries. Especially important for Germany. Basically no sanctions. Freedom of movement with fairly good visa policies. No great internet firewall. How much did all this help to prevent another huge war between two European countries?
- shermantanktop 1y ago
  Exactly. Trade ties only go so far. But this pov isn’t always rooted in pragmatism. Free market ideologues also think that free markets will bring world peace.
- pxc 1y ago
  Different behaviors have different motivations, contexts, and causes. It's extremely clear that these, like other criminal moneymaking schemes in the DPRK, are directly and closely related to the high degree of isolation of the DPRK and the difficulty of getting capital into it. Of course lifting the sanctions won't also end all spycraft, or ensure an end to geopolitical conflict. Those aren't things I have claimed or would claim. And the primary reason to end such sanctions is not any benefit to imperialist nations but because of the fact that they inflict misery on ordinary people indefinitely and (not essential, but adding insult to injury) uselessly.

iw7tdb2kqo9 1y ago

[flagged]

ta1243 1y ago

Have your new hire turn up and meet with the team on day one. They'll soon twig if that's not the person who's getting called into a quick meeting in 5 minutes to discuss some new issue.

conradev 1y ago

I can’t find the tweet but apparently you can also filter these folks out by asking them to criticize Kim Jong Un

deleted 1y ago
[deleted]
ghssds 1y ago
If someone asked me to criticize KJU, that would be the end of the conversation. I criticize people on my own or not at all. I suppose I would become a false positive.
- pmarreck 1y ago
  Sounds just like something a North Korean would say
  - JumpCrisscross 1y ago
    Honestly, sounds like a red flag if even a legitimate applicant is unwilling to voice an opinion on the Kim regime.
    - denkmoon 1y ago
      Without context it seems like a weird trick question, like phishing tests and most corporate training.
    - codedokode 1y ago
      Replace North Korean leader with Biden and Trump, how that sounds?
      - jfengel 1y ago
        Pretty sure a huge number of Americans would happily curse both with the fire of a thousand suns.

austin-cheney 1y ago

So, again, the answering to this and most every other hiring ill in software over the past 15-20 years is… licensing. So, let’s think about this logically. There is no baseline of candidate identification or competence in software and the jobs pay very well in physically comfortable conditions. It makes sense that unqualified liars would apply for these positions. Why shouldn’t they? I am honestly curious how far the fraud and incompetence can go and devalue the industry before someone cares enough to tackle the problem l.

hollerith 1y ago
Irrelevant to the OP unless you explain why North Koreans would be prevented from obtaining these licenses: it's not like there aren't competent developers in North Korea. If your explanation is that the license grantor will verify that the applicant is a resident of a Western country, than the employer can just do the same verification of job applicants, dispensing with the need for the occupational license.
- acdha 1y ago
  The way these people are being caught are things like dodgy LinkedIn profiles or refusing in person meetings so I would think a licensing process designed around things which would be expensive to fake: in person government ID checks, periodic exams, peer evaluations, etc. The trick would be actually doing that in person, which could be a useful thing for conferences - treat an afternoon at PyCon or re:Invent as the cost of renewing your professional credentials if you don’t live near a major city or university.
  - bigfatkitten 1y ago
    Even an in person ID check would suffice. For most of the West, this is an extremely difficult bar to clear for a North Korean national working out of China.
    - acdha 1y ago
      Yeah, I was thinking that if you were looking for an industry license it would probably be more useful if it also covered skills or work experience in some way since that helps multiple weak points of the common hiring processes but you’re quite right that it would raise the bad considerably if they had to basically run everyone like actual spies with robust fake identities.

dakiol 1y ago

If only governments could provide a very simple “check identity” service online. I think this should be a basic service nowadays.

Swizec 1y ago
> If only governments could provide a very simple “check identity” service online. I think this should be a basic service nowadays. Slovenia issues personal certificates so you can identify yourself online. Mostly used for banking and e-gov. The commercial space has decided it’s too cumbersome. Fantastic idea. Started rolling out when I was in college some 15 years ago. You go to the same place that issues your govt ID and you can also get the equivalent of an SSH cert issued by the government that guarantees you are you, your identity was verified at point of issuance, etc. Unfortunately it’s about as fiddly to use as SSH. Okay for nerds, way cumbersome for normal humans who just want to log into their bank and pay their taxes damn it. Last I remember (moved to USA ~10 years ago) getting their e-signing browser widgets/extensions to work reliably on non-windows machines was hell. Most Mac/Linux users ran a whole VMWare VM just to do taxes once a year.
- immibis 1y ago
  Imagine if you had to provide your government ID to use any website. Even for employment I find the idea iffy, but seeing as it's in response to an actual non-imagined problem, I suppose it's the most reasonable solution to that...
  - dakiol 1y ago
    You lack some imagination. One could verify their identity against a government service once every let’s say 5 years. You get a public link/code that you can share with employers (or banks or real state agencies or…) so that they can use the link/code against a government service to verify that you are who you claim to be.
    - immibis 1y ago

belter 1y ago

Something is amiss here...Developers make hundreds of applications to even get a reply much less an interview...While apparently, barely English literate North Korean IT workers are getting all the jobs :-) Time to praise the Supreme Leader on LinkedIn ?

sfryxell 1y ago
I have gotten multiple emails from wonky email addresses offering to have me interview for jobs and they will take care of the work if I get hired. fake names tons of money for me. I just have to nail the interview. My resume is shiny enough and I've gotton hired enough times im a good candidate for this kind of scam. This feels like a very ham fisted approach for them though. 99% of engineers are going to ignore or not take seriously these kinds of out of the blue offers.
- lazide 1y ago
  1% will be plenty in the current market, eh?
sva_ 1y ago
They probably use many identities
asdf6969 1y ago
[flagged]
- heraldgeezer 1y ago
  [flagged]
wisty 1y ago
People are single but romance scams exist. Scammers are good at the scam. They are good at telling the right lies, they often work in teams (lead finders, closers, and everything in between), use automation where appropriate, etc. A single dev might have trouble cracking the lead finding code, the resume code, the interview code, etc while and avoiding telling any lies that will get then fired 3 weeks into the job. But a team who all treat the application process as a full time job? It's a lot easier. Also when a dev gets good at finding a job, they stop looking. Scammers get good at it and then keep getting better.

mkl95 1y ago

> As US-based companies become more aware of the fake IT worker problem, the job seekers are increasingly targeting European employers, too. All the US companies I've worked for made sure I was legit before I could log into anything, so I assume background checks to be ubiquitous there, save for the cheapest companies. European employers on the other hand...

aleph_minus_one 1y ago
> European employers on the other hand... Many European employers - don't or rarely offer remote jobs, so they often don't have this problem. - even if they do some video or phone interview for pre-screening, they nearly always expect the prospective employee to come to a live interview if they are not weeded out by this pre-screening. It is thus expected that you at least live in a country from where you can easily travel to the place where the employer is located. - often expect their employees to be able to speak the national language, or at least learn it fast. This also makes times hard for North Korean fake IT workers.
- rcruzeiro 1y ago
  I’ve never had this experience. Never once was I flew in for an interview and, in two of the previous companies I’ve worked for, I did not speak the language.
  - aleph_minus_one 1y ago
    This is at least the experience that I (and many people who I know) had. > I did not speak the language As I implied: if you are really talented, you don't have to speak the native language yet, but it is expected that you learn it fast.
    - rcruzeiro 1y ago
      Maybe I was lucky there (or unlucky depending on the point of view). I’ve even worked for years for a French company without learning French.

Havoc 1y ago

Can’t they just make week 1 in person compulsory? You can easily dress that up as an onboarding thing and would solve this, no?

someotherperson 1y ago
Not really. You need a visa (or equivalent) to enter most countries. This can take months to apply for and receive. And you can stretch that period out even longer by claiming that you don't have a passport and need to apply for one first.
- aleph_minus_one 1y ago
  In Germany, if a company want to hire some talent from a foreign country, this problem is solved by the general rule "The employment starts as soon as the visa problems have been resolved, and you are in Germany." Big companies often have a department that helps with visa problems. So, if you stretch the period, the employment simply starts later.
bravesoul2 1y ago
You can. Just like everyone can use a good password. Yet many dont. Also there is a good reason not to make week 1 in person. You reduce your access to talent. I know we are in the everyone RTO and do 100hrs a week part of the BSiness cycle. But still.
- ryandrake 1y ago
  Workers are currently in a bear market. No company has problems “accessing” talent, at least today. They aren’t going to lose a candidate by simply insisting on an in-person step, whether it be an in-person interview or a week of in-person work.
  - sarchertech 1y ago
    It’s not a bear market for the best candidates. I know plenty of people who have found new jobs in the last 6 months. Many of them would have said no to in-person interviews.

jongjong 1y ago

I suspect it could be worse than that. It feels like certain countries' tech sectors are being partly taken over by IT workers from foreign intelligence agencies or from foreign entities with ulterior motives. Especially when you consider countries with small populations and few natives in the tech sector. For example, in Australia, it seems like at least 8/10 software engineers are foreign-born. Most of those are probably genuine (not from intelligence agencies) but Australia has such a tiny native population of engineers compared to that of most foreign countries in its vicinity that it wouldn't be difficult for a country like China or India to overwhelm our tech industry with a few highly-placed workers in order to gain political leverage. I was thinking that there might be more software engineers working for Indian and Chinese intelligence agencies in the world than there are native-born software engineers in Australia (of all kinds). It's a numbers' game. North Korea seems like the tip of the iceberg there though it is an easy example to talk about because everyone understands how the North Korean government operates and everyone agrees about the threat they pose compared to more subtle threats from other countries which aren't seen as opponents (at least not to the same extent). But also, consider a company like Facebook which hires maybe 20K or so software devs. A country like India which has a large number of software developers, if it wanted, could easily put together a task force to infiltrate and take over Facebook in a focused decade-long effort if that was its intent. They almost certainly do have some people inside every major tech company right now. If a group can have a few highly placed people inside a target company, they could then recruit more of their group into the company and start promoting their own until they have full control over the critical systems. It's a weakness of our current highly centralized tech sector. Something else that could happen is a foreign intelligence agency could wait for people to get promoted naturally and then reach out to dual-nationals which they have leverage over (e.g. because of family members or assets owned in the foreign country) and then use that to demand favors. Then they could help coordinate the engineers to recruit more of their own to achieve even more control. Different groups would form factions within the target company and every normal employee would be unwittingly pushed out because anyone trying to 'improve or simplify things' would be seen as a threat to various nefarious agendas which rely on complexity to hide backdoors or algorithm exploits. Imagine how valuable it would be if you could hijack's Google's search algorithm or Facebook's recommendation engines to prioritize your group's businesses and/or agendas.

nimbius 1y ago

This is a problem the USA caused, and could easily solve, by dissolving the armistice and declaring an end to the Korean war. only seven countries are currently participating in the embargo and sanction of North Korea, (at the behest of the united states.)

casenmgreen 1y ago
North Korea would never, in a million billion years, either accept peace, or actually honour it. NK is a hideously oppressive, violent, dictatorship, which would invade SK in a microsecond if it thought it could get away with it. I think it astounding - staggering - to point the finger here at USA. If you were not a long term, serious poster, I would think you were a fake account.
WhyNotHugo 1y ago
They convinced Ukraine to give up their nukes, promising that they'd be safe. I don't think there's any chance of convincing North Korea to follow the same path.
daedrdev 1y ago
No, one side declaring the end to a war does not end that war, this is one of the worst foreign policy takes I've ever heard. The NK regime is secure because of the war, they will poison pill any negotiation by demanding South Korea become part of the north.

croemer 1y ago

They cite LinkedIn profiles with 25 connections as easy tell tale signs. Well, I've got news for you: hacked LinkedIn profiles. Happened to a colleague of mine. Profile with more than a thousand genuine, reputable connections got hacked. Picture and name got changed to something East Asian sounding/looking. CV got changed to US defense contracting. Luckily this tripped some automatic account lockdown otherwise it might have well gone undiscovered for a while. Few people will remember every single LinkedIn connection, there's no notification of name change in messages etc. Quite likely this profile was sold to North Korean fake IT workers.

9cb14c1ec0 1y ago
Also, many people like me don't even have LinkedIn profiles. The "pick up your work computer in person" idea sounds like a much more reliable method to me.
- smohare 1y ago
  [dead]
- abrookewood 1y ago
  But it is so late in the process to catch them - hours wasted by so many people.
  - miffy900 1y ago
    True, but at that point it's still not too late to prevent paying money that will ultimately end up in the NK government hands.
  - asteroidburger 1y ago
    If it was the norm, the fake worker problem would go away, and the hours would not be wasted.
- Roark66 1y ago
  Yeah, pick up your computer in person will not work if you live 2d travel away. If my remote job told me to pick up the computer in person after 8h of interviews and tests I'd be seriously pissed off. If they advertised it in the beginning I'd not have applied. In my country (Poland) courier companies offer this service of "id checking and contract signing". You can have a courier deliver a contract, check the recipient's photo ID and confirm their identity, have the person sign the contract, return it and the courier takes it back. If there is no such service available there is only one way to prevent this from happening, proper screening of candidates. In my 20+ years of working for Fortune 500 companies in positions not far from the top only 1 - a Japanese one actually screened my educational background and called my references and past employers to verify. If employees worry they will loose some really good candidates that have no documentable background ask them to do some other security check. Do a video call from the main street of their home town. Or some other thing randomly selected from a set of 5. If the role is really important hire someone to visit the remote worker in their home and deliver that laptop in person. But don't expect them to travel to pick it up.

stuaxo 1y ago

Feel like at least one coworker might be better if they were this.

tehjoker 1y ago

The LinkedIn thing is very weird, what about all the guys that worked for another company for a long time and didn't bother with LinkedIn? I don't buy that, but the trend of these guys not showing up in-person at all is very suspicious, though not impossible. There are all kinds of reasons people want to do remote work, and some of those reasons might preclude an in-person meeting (like you might find out about a disability). Still, I agree that's pretty suspicious. However, they didn't offer any proof whatsoever these guys are from North Korea or any motivation for why they would be doing this from North Korea. So, that sounds like potential U.S. propaganda. They said they worked with the FBI, which honestly is a red flag for that kind of thing. Rather, if a company states without proof they're from NK, it's very likely BS. If the feds say it's North Korea without proof, it's definitely BS (they have resources to prove it!). If the Feds say it and provide proof, then we can talk about the proof.

peterdemin 1y ago

I hate how this is acceptable to make such claims about another country without providing any evidence. Same goes for Chinese or Russian hackers. It’s just whoever the US government is unhappy about.

some_random 1y ago
What evidence is lacking here?
energy123 1y ago
> It’s just whoever the US government is unhappy about. Likewise, you don't have evidence for this.
esafak 1y ago
I've interviewed these people. They really exist! I did not know they were North Korean, but it would not surprise me.
defrost 1y ago
There's evidence, large investigations, and arrests aplenty already. Justice Department Announces Coordinated, Nationwide Actions to Combat North Korean Remote Information Technology Workers’ Illicit Revenue Generation Schemes (justice.gov) https://www.justice.gov/opa/pr/justice-department-announces-coordinated-nationwide-actions-combat-north-korean-remote https://www.justice.gov/opa/pr/justice-department-announces-... (12 days ago) https://news.ycombinator.com/item?id=44431853 https://news.ycombinator.com/item?id=44431853 Law Enforcement Actions Across 16 States Result in Charges, Arrest, and Seizures of 29 Financial Accounts, 21 Fraudulent Websites, and Approximately 200 Computers .. Today, the United States Attorney’s Office for the District of Massachusetts and the National Security Division announced the arrest of U.S. national Zhenxing “Danny” Wang of New Jersey pursuant to a five-count indictment. The indictment describes a multi-year fraud scheme by Wang and his co-conspirators to obtain remote IT work with U.S. companies that generated more than $5 million in revenue.
miffy900 1y ago
The article itself is evidence. There are many more links in it to other stories that report on basically the same or similar incidents. There are also several names in the article itself that you can research or probe on your own to tell if it's coming from a trustworthy source. Consider also the author: it's written by an actual journalist/editor with a large body of pre-existing work in the field, and many of the claims written are backed up by quotes from a named source. It's not like they're writing all this and hiding it behind the weasel phrase 'according to a source close to the matter'. The register too is actually UK founded, so it's not even American. Your reaction is just so typical of people nowadays - just assume it's all 'made up' without any effort in debunking or picking apart any specific claims.

deathanatos 1y ago

Maybe this is a real problem, IDK. But this article is so scant on actual details, and is mostly just weasel-wording it's way to "it's a problem, trust us." > Chief among these disconnects were "shallow" LinkedIn profiles paired with "beefy resumes," she explained, citing job-seeker claims of working at Meta, attending Ivy League schools, developing major tech companies' flagship products … but then only having 25 LinkedIn connections. LinkedIn is not the end-all be-all of résumés, and my coworkers have wildly varying numbers of connections. > "We've certainly seen applicants that fit into this category with various IOCs [indicators of compromise] that we've shared with partners and peers," Snowflake CISO Brad Jones told The Register. This is an abuse of the technical term IoC to try and dress up what amounts to "my gut hunch". > Once the recruitment team began meeting via video conferences with some of the applicants, they noted extremely Western-sounding names, like James Anderson, paired with East Asian appearances and accented English, in much higher numbers than they expected. That's just discriminatory. > "You can't profile people, […] *But* sigh > The fraudster's answers weren't word-for-word ChatGPT, Little noted. "These people are smart, they're not unskilled, they're sophisticated," she said. … no, that's because that's not how LLMs work. > routing everything through a VPN I'm not even sure how you would know this about a candidate. > These IOCs, or indicators of compromise, include email addresses, physical addresses, and phone numbers that have been flagged as associated with non-legitimate candidates. This is begging the question: the candidate is suss because they're suss. What makes the email address et al. "flagged"? > The final step is always an in-person interview. I mean … if you're not doing that, then … okay, I see how the scammers got to you. > "We require people to come to the office to pick up their computer," Robinson said as an example. I mean, if you pay for the plane tickets, the hotels, the taxis, the meals, and the time, sure, I guess. If this is truly a problem — and maybe it is — the Register's reporting is so unspecific that it leaves us with no details of how we might tell, what to look out for (in ways that doesn't run afoul of racial discrimination, or seen elsewhere in the comments, political discrimination). It leaves me thinking this is an ad designed to leave me going "I'd have to hire a company that specializes in this to know if I'm being affected by it."

resheku 1y ago

I keep hearing about this and honestly I don’t get it how does this continue to happen? Here I am, a real human, decent person and a nice guy lol yet I can’t find a good job. What are these companies doing, how is this possible?

Aurornis 1y ago
They aren’t telling the truth when they apply. They’ll use stolen identities, fabricated backgrounds, fake reference checks, hacked LinkedIn profiles. They are professionals at lying and interviewing. When it’s your job to get jobs and you’re doing it with organized support, you will find something. They also don’t really care if the job is good or bad. They’re just farming any and all jobs they can get and hanging on to them until they’re pushed out. At many companies, that can take years.
edm0nd 1y ago
The Norks basically just steal a very qualified persons identity and info and then use that info to apply for jobs. So on paper, the job applicant looks pretty good but its just all larping from the threat actors. For being such a hermit kingdom, they are very good at infiltrating large companies and stealing cryptocurrencies.

danielhep 1y ago

What’s the end game for these scammers once they get the job? I understand there’s a question of espionage if they’re collecting intel from these companies, but do they also do their jobs? Or do they disappear as soon as they’re hired and collect as much data and money until they get fired? Do they actually know how to do IT work?

Aurornis 1y ago
The article mentions ransoming company data or source code as one outcome. For many scammers (not North Korean specifically) it’s just one big game of collecting as many paychecks from as many companies as you can until they fire you. For some multi-job people, the game is to continuously apply to companies and then let any company that is paying attention fire them after 1-3 months. Repeat long enough and you might find your way into a couple companies where your demands are so low that you can do all the jobs in a couple hours per day because your managers are so checked out that they don’t care. Ride this until the company lays off the whole underperforming team, then find the next jobs.

gkanai 1y ago

An required in-person verification due diligence step would stop this, no?

OfficeChad 1y ago

[dead]

ErigmolCt 1y ago

What's clear is that this isn't just a security problem

mathverse 1y ago

This is entirely US's companies fault for not favorizing people from 1st world countries. At this point it's not a question of $ but not really giving a shit. If you have 2 candidates and one is from lets say Czech Republic and the other one from 3rd world then it's fully on you for getting screwed over.

akazantsev 1y ago
Could have read the article. All involved companies hired US-based workers who received company-provided laptops and set up remote access on them for North Koreans.

pllbnk 1y ago

I would really like to see one of these deepfake videos that managed to trick any competent interviewer into thinking it was real. I couldn't find anything like that on Youtube. Even in highly controlled environments the deepfake videos can be immediately recognized.

frontfor 1y ago
Here’s one example, although I don’t know if this is a North Korean. https://www.linkedin.com/feed/update/urn:li:activity:7292604406464671744?updateEntityUrn=urn%3Ali%3Afs_updateV2%3A%28urn%3Ali%3Aactivity%3A7292604406464671744%2CFEED_DETAIL%2CEMPTY%2CDEFAULT%2Cfalse%29 https://www.linkedin.com/feed/update/urn:li:activity:7292604...

anarticle 1y ago

I've definitely gotten something similar to this in dev slacks offering to use my upwork/linkedin to get a job and then I hand it off to someone else. They claim they'll pay 30-50k/y. Sounds like my IRL value just keeps going up.

marve087 1y ago

[flagged]

Hellenmfinal 1y ago

[dead]

mateoowen44 1y ago

[dead]

peju112 1y ago

[dead]