5 ms·

Inform what companies directly? If it's this pervasive, that's not going to be effective. I work at a small (~30 person) SaaS company. We interviewed what I to

Inform what companies directly? If it's this pervasive, that's not going to be effective. I work at a small (~30 person) SaaS company. We interviewed what I took to be a case of this the other day (all the classic signs). Nobody would be keeping an eye on our hires or letting us know about this. And in the process of confirming that this was fishy, I contacted one of the past employers he claimed after doing my best to confirm _they_ weren't in any way part of the scam. They confirmed he had never worked there. I sent them his LinkedIn and portfolio site in case they wanted to chase down getting their name removed. They told me that this was super concerning because the screenshots in his portfolio of the app he worked on for them were real screenshots... for an unreleased app that was only available internally and had never even been demoed for clients. They'd already been breached and had god knows what exfiltrated. They found out because we caught an attempt to get hired at _our_ company and let them know. Nobody outside of a couple of technical staff at our company had even _heard_ of this. Nobody at the other company had. The fix, to me, seems to be making people involved in hiring more aware of this. If anything, it seems we should be talking about this _more_ and _more publicly_.

alganet 1y ago
Is your company involved in infrastructural or emerging tech in any way? Forgive my frankness, but these worries about infiltrators have priority in important, large companies. I am very sure agencies responsible for this can contact these handful of important companies directly. So, you're right. In the current age we live in, no one cares about your small SaaS company, and you're being used to spread unecessary paranoia and fear.
- jjmarr 1y ago
  North Korea has a shortage of foreign currency. It's not just espionage. They need US dollars to pay for smugglers.
  - alganet 1y ago
    Greed meets greed. Companies hiring cheap labor, being exploited in several fronts. It was a decision for several companies to spread thin their offshore hiring. They practically invited infiltrators in. Keep focused. Small companies never mattered for nations, they are irrelevant. Spreading paranoia will not solve their over-reliance on this exploited offshore problem. It will likely lead them to bankrupcy. Ultimately, it doesn't invalidate what I said. It actually makes my comment more relevant.
    - cyberax 1y ago
      > It was a decision for several companies to spread thin their offshore hiring. They practically invited infiltrators in. It's not offshore. Infiltrators are pretending that they're in the US. I first saw this 2 years ago, and they were pretty clumsy back then: always blurred background (and refusing to unblur it) and/or doing calls from a windowless office. You could even see their eyes moving, like they're reading the script. This year they became much fancier. They use backgrounds with the real time-of-day and weather illumination. The eyes no longer move unnaturally, etc.
      - alganet 1y ago
        You miss the point. Remote working is in the same vein as offshoring. One enables the other, they're co-dependent. Both are based on greed. In the case of remote working, is avoiding having offices, avoiding paying certain kinds of insurance, etc. You are also re-inforcing my original conclusion that what enables these workers is the very same tech that companies are investing on. Again, greed meets greed. Now it's too late. IT companies will not survive a full return to office, and they won't survive remote working as well. The very idea that someone could be using technology to fake an identity was unthinkable. Now that it is not, there's really no place safe. If a crisis occours, and the US president goes to Air Force 1, transmits from there, how could you be sure he's not a north korean infiltrator? You can't. I think there are still ways out of this, but we're reaching an inflection point that will be hard to overcome. --- Your commentary seems to provide a valid point of view, and although you disagree, you reinforce my main point.
- nucleardog 1y ago
  Other company was, indeed, AI Startup #528532. We're in a niche, extremely boring industry. We have an extremely small client base. We do line-of-business/sales management applications for something akin to like... light switches and light fixtures. The most exclusive thing we have access to is wholesale pricing from manufacturers. We don't handle payments. The extent of PII we handle is "name and email" from when someone emails out a quote. We are the epitome of uninteresting to a foreign actor. Being "uninteresting" apparently does not disqualify you. We also do not hire overseas (the applicant claimed to be from California) and offer a good US wage. We weren't targeted or vulnerable because we were being "greedy".
  - arresin 1y ago
    30 people. Damn. I suppose they must be casting a massive net. Pretty concerning.
  - xarope 1y ago
    Isn't this the best way to start an infiltration, though? Like hiring a janitor or cleaner, who is able to access the office during off hours, and can start planting false information, which is then used by a more relevant company years later?
    - alganet 1y ago
      If you start thinking like this, then no one will ever feel safe. I think this kind of idea is stupid.
  - alganet 1y ago
    You do hire remote workers, don't you? If you had to hire workers in office, would you have space and infrastructure for all of them? From my perspective, this would solve the issue. Unless you're worried about in-person north korea spies. I don't know man, seems like you're living in some cold war mind trap or something.
    - nucleardog 1y ago
cyberax 1y ago
> I work at a small (~30 person) SaaS company. We interviewed what I took to be a case of this the other day (all the classic signs). Nobody would be keeping an eye on our hires or letting us know about this. I'm in a similar situation. The HR leads company is trying to filter out the fakes, but they can't catch everyone. Apparently, the infiltrators specifically target the companies in the 10-50 people range. In smaller companies everybody knows what everybody else is doing, so infiltrators will be swiftly uncovered. And larger companies typically have a well-established HR department that will catch obvious fakes without good cover. But these mid-range companies provide the best chance for the fakes to get at least a couple of paychecks before being uncovered. And they likely won't bother with going to the FBI to chase down the payments.
- alganet 1y ago
  Why shouldn't they go to the FBI? I strongly recommend going to official authorities if you believe you're being duped by a foreign nation spy or conspirator. If they ignore you, it's more likely that you're not that important, like I said previously.
  - cyberax 1y ago
    > Why shouldn't they go to the FBI? I'm not saying "shouldn't". It's more likely "don't bother". Interacting with the law enforcement takes time executives' time, it might bring in complications (legal liability for personal data leaks, etc.), and even in the best case the company is not going to get their money back.
    - alganet 1y ago
      So, it's a big problem that everyone should know about but do nothing except post shit on news? No, you should bother. You should bother a lot. Get in contact with the FBI, make a huge deal about it. You think one company can handle a spy agency? That's bad advice.
      - cyberax 1y ago

alganet 1y ago

Is your company involved in infrastructural or emerging tech in any way? Forgive my frankness, but these worries about infiltrators have priority in important, large companies. I am very sure agencies responsible for this can contact these handful of important companies directly. So, you're right. In the current age we live in, no one cares about your small SaaS company, and you're being used to spread unecessary paranoia and fear.

jjmarr 1y ago
North Korea has a shortage of foreign currency. It's not just espionage. They need US dollars to pay for smugglers.
- alganet 1y ago
  Greed meets greed. Companies hiring cheap labor, being exploited in several fronts. It was a decision for several companies to spread thin their offshore hiring. They practically invited infiltrators in. Keep focused. Small companies never mattered for nations, they are irrelevant. Spreading paranoia will not solve their over-reliance on this exploited offshore problem. It will likely lead them to bankrupcy. Ultimately, it doesn't invalidate what I said. It actually makes my comment more relevant.
  - cyberax 1y ago
    > It was a decision for several companies to spread thin their offshore hiring. They practically invited infiltrators in. It's not offshore. Infiltrators are pretending that they're in the US. I first saw this 2 years ago, and they were pretty clumsy back then: always blurred background (and refusing to unblur it) and/or doing calls from a windowless office. You could even see their eyes moving, like they're reading the script. This year they became much fancier. They use backgrounds with the real time-of-day and weather illumination. The eyes no longer move unnaturally, etc.
    - alganet 1y ago
      You miss the point. Remote working is in the same vein as offshoring. One enables the other, they're co-dependent. Both are based on greed. In the case of remote working, is avoiding having offices, avoiding paying certain kinds of insurance, etc. You are also re-inforcing my original conclusion that what enables these workers is the very same tech that companies are investing on. Again, greed meets greed. Now it's too late. IT companies will not survive a full return to office, and they won't survive remote working as well. The very idea that someone could be using technology to fake an identity was unthinkable. Now that it is not, there's really no place safe. If a crisis occours, and the US president goes to Air Force 1, transmits from there, how could you be sure he's not a north korean infiltrator? You can't. I think there are still ways out of this, but we're reaching an inflection point that will be hard to overcome. --- Your commentary seems to provide a valid point of view, and although you disagree, you reinforce my main point.
nucleardog 1y ago
Other company was, indeed, AI Startup #528532. We're in a niche, extremely boring industry. We have an extremely small client base. We do line-of-business/sales management applications for something akin to like... light switches and light fixtures. The most exclusive thing we have access to is wholesale pricing from manufacturers. We don't handle payments. The extent of PII we handle is "name and email" from when someone emails out a quote. We are the epitome of uninteresting to a foreign actor. Being "uninteresting" apparently does not disqualify you. We also do not hire overseas (the applicant claimed to be from California) and offer a good US wage. We weren't targeted or vulnerable because we were being "greedy".
- arresin 1y ago
  30 people. Damn. I suppose they must be casting a massive net. Pretty concerning.
- xarope 1y ago
  Isn't this the best way to start an infiltration, though? Like hiring a janitor or cleaner, who is able to access the office during off hours, and can start planting false information, which is then used by a more relevant company years later?
  - alganet 1y ago
    If you start thinking like this, then no one will ever feel safe. I think this kind of idea is stupid.
- alganet 1y ago
  You do hire remote workers, don't you? If you had to hire workers in office, would you have space and infrastructure for all of them? From my perspective, this would solve the issue. Unless you're worried about in-person north korea spies. I don't know man, seems like you're living in some cold war mind trap or something.
  - nucleardog 1y ago

cyberax 1y ago

> I work at a small (~30 person) SaaS company. We interviewed what I took to be a case of this the other day (all the classic signs). Nobody would be keeping an eye on our hires or letting us know about this. I'm in a similar situation. The HR leads company is trying to filter out the fakes, but they can't catch everyone. Apparently, the infiltrators specifically target the companies in the 10-50 people range. In smaller companies everybody knows what everybody else is doing, so infiltrators will be swiftly uncovered. And larger companies typically have a well-established HR department that will catch obvious fakes without good cover. But these mid-range companies provide the best chance for the fakes to get at least a couple of paychecks before being uncovered. And they likely won't bother with going to the FBI to chase down the payments.

alganet 1y ago
Why shouldn't they go to the FBI? I strongly recommend going to official authorities if you believe you're being duped by a foreign nation spy or conspirator. If they ignore you, it's more likely that you're not that important, like I said previously.
- cyberax 1y ago
  > Why shouldn't they go to the FBI? I'm not saying "shouldn't". It's more likely "don't bother". Interacting with the law enforcement takes time executives' time, it might bring in complications (legal liability for personal data leaks, etc.), and even in the best case the company is not going to get their money back.
  - alganet 1y ago
    So, it's a big problem that everyone should know about but do nothing except post shit on news? No, you should bother. You should bother a lot. Get in contact with the FBI, make a huge deal about it. You think one company can handle a spy agency? That's bad advice.
    - cyberax 1y ago