7 ms·
How to compromise your system with a job interview
- esafak 2mo agoI remember reading a similar article here not long ago, and the attack relied on auto-loading in VSCode. https://opensourcemalware.com/blog/latest-contagious-interview-malware-campaign-abuses-microsoft-vscode-tasks https://opensourcemalware.com/blog/latest-contagious-intervi...
- aliasxneo 2mo agoI get enough legit and illegitimate ones every week on LinkedIn that it's become really easy to tell the difference. Hard to pinpoint in a comment because it's mostly a gut feeling. But, in rough order: 1. Look at the person's LinkedIn profile contacting you and examine their post history. In one comical scenario the "recruiter" had a long 4 year gap where they were writing comments in English and all of the sudden they switched to Spanish. Mostly short, pointless comments as well. 2. Look at the company and make sure they have a legitimate website and are still actually in business. Even better, see if there's a public team page that lists this person. 3. Give the recruiter an email (I usually use something like SimpleLogin) and ask them to forward you the details. Of course, pay close attention to what address they send it from. 4. In addition, or alternatively, ask the recruiter for the public job listing (scammers almost always "paste" it into a DM or upload a clearly AI generated PDF doc). Once you learn the game it's not too hard to start picking up on them. I've made it a game to play along sometimes just for fun. Ultimately, at the end of the day, make sure you report them on LinkedIn. I've had the account disappear within a hour of doing so.
- stevekemp 2mo agoHonestly unless I'm planning on quitting my current job, or if I were unemployed, I just ignore the linkedin. Sure they spam you with "XX wants to connect", or "I'm awaiting your reply" emails. But real contacts and friends can call/email you, and everybody else can wait six months. Despite only connecting with actual people I've worked with, not recruiters, I still get "suggested" posts which are slop, and "that happened". The site is a cesspool.
- milkytron 2mo agoI haven't had LinkedIn since... 2014 I think. I deleted my account after I got my first job offer and have never used it since. If people dislike the site so much, I don't understand why they don't delete their account. Is there any value provided, or is it the fear of missing out on potential future value?
- wredcoll 2mo agoEvery single job app I filled out in the last two years asked for my linkedin url. I don't know if not having one was disqualifying, but it does worry me.
- floatrock 2mo agoIt's not disqualifying, but not having a linkedin is a signal that could drop you towards the bottom of the resume pile. Companies have problems with fake applicants, and ATS systems do create "how likely this person is a human" scores. Having an online identity is one signal, and for better or worse, that is often a LinkedIn history. Like a fico score, you can't escape the game if you want to play.
- DrewADesign 2mo agoBeing dropped to the bottom of a resume pile in this job market is effectively disqualifying.
- jjav 2mo agoAs a hiring manager, I can say that not having that linkedin profile is not disqualifying, but it sure hurts your chances, a lot. Your resume must be extremely exceptional to survive the first pass if there is no linkedin profile to correlate to it. How can I know if anything is true? I don't like it. I mean, I hate it. But when you receive 1000 resumes per day for a job posting, agressive filtering is the only way forward. My days don't have a 1000 hours. Combine this with so many people who fabricate a fake resume with AI to sound like a perfect match to the job description. I need to review it against a linkedin job history to see if the story is consistent. Hard to believe the number of people who have their linkedin job history say one thing and their resume is completely different. This means I must be very suspicious of people who don't have a linkedin history, because it means the resume may be completely fake. So it goes to the reject pile. It's not fair, but I have 999 resumes to review after this one. To summarize, if you are famous from conference talks, published papers or such, you don't need linkedin. If you are a regular non-famous person, you do need it.
- sandeepkd 2mo agoThese seem like a common pattern lately. I feel for it but again people are creative in making business out of others desperation.
- john_strinlai 2mo agoout of the list under "Before you start with the test, you might be suspicious about the following:" there is only one that is important: only interact with people using an official email address. the rest can be used as yellow/red flags, but simply asking for confirmation via an official email address will thwart the vast majority of scams (including other ones, like someone claiming to be from Intuit calling about your QuickBooks or whatever).
- sgbeal 2mo ago> only interact with people using an official email address. And then google whether the domain is associated with phishing attempts. i've been targeted several times recently by folks with "official" email addresses but whose domains are (per google) strongly associated with phishing.
- 0cf8612b2e1e 2mo agoI have seen official company recruiters operate exclusively through Gmail or whatever. Third party headhunters may not have anything tied to the sponsoring company. It is a decent rule, but one which is immediately thwarted by companies going out of their way to constantly look illegitimate.
- deleted 2mo ago[deleted]
- deleted 2mo ago[deleted]
- logicallee 2mo agohow do you know they were really official company recruiters?
- supriyo-biswas 2mo agonot OP, but because I've looked for a job previously and have experiences with recruiters like that which ended up at a legitimate offer at the companies they claimed to represent?
- zuzululu 2mo agowonder if codex can catch issues ? > A note on the AI part: Claude Code was not able to detect any strange things when just prompted to scan the code base for unusual patterns.
- NalNezumi 2mo ago.... Why would you do job interview when they expect you to run some code on your own system, on your own time? Maybe I work in a different field but last year when I was still looking for jobs, only one company asked for coding assignment and every other company did coding interview which is always browser based editor. I feel like the industry is mature enough that you can tell a company that sends you a zip file of code to f-off.
- msdz 2mo ago> .... Why would you do job interview when they expect you to run some code on your own system, on your own time? Because both the company and you know it’s the most effective job interview “filter” in SWE roles. > on your own time It may not be unpaid if you’re applying to a decent company. The issue here is their poor implementation (zip file), not the concept itself, IMO.
- deleted 2mo ago[deleted]
- dprkh 2mo agoThere is a YC company that makes a coding interview tool. They want you to run their CLI on your machine and trust that it won't do anything malicious, when in fact it installs a bunch of things onto your machine without consent, scans processes, and intercepts requests from AI tools. It's crazy that people think this is acceptable.
- delichon 2mo agoMaybe it's a pen test such that if the CLI can phone home you fail, to weed out candidates with weak security fu.
- bryanrasmussen 2mo agoif that was the purpose it should weed out candidates who agreed to install the app for a job interview.
- stronglikedan 2mo agoJust that fact that the company expects a candidate to even have their own machine is egregious.
- phendrenad2 2mo agoFor all its talk of 'meritoctacy', the bay area really runs on looking the part.
- shimman 2mo agoBecause meritocracy isn't a real thing. It's just another form of authoritarianism, despotism, and oligarchy. Who decides what work is worth rewarding? What about the type of work? It was always an antidemocratic idea sold to tech workers to stop the idea of questioning the system. The idea that simply "talented" workers should rule just seems to speed run towards fascist aims. How do you consider which workers are worth more than others? If you do to the wrong school are you suddenly worth less? Do you think society will have certain preferences? What about in our neoliberal society where money is the only purpose to life?
- sixtyj 2mo agoIt reads like a true crime story. Bad actor had prepared the set up so precisely that Claude Code could not detect it. Malware Bytes? Acronis? There must be some template…
- pronoiac 2mo agoIf you run across something like this: * perhaps archive your findings * report the abuse to their hosting I'm dropping emails to jsonbin.io and to ZapHosting (who run 147.189.174.138) about this.
- denysvitali 2mo agoA lot of hosting providers don't really care, sadly :(
- greyface- 2mo agoTheir upstream transit providers do, surely.
- forinti 2mo ago> “A relevant opportunity” with part-time remote work and a great hourly compensation That is so suspicious at the moment.
- minitech 2mo agoSlop article. Good for scam awareness I guess, but the main value of the analysis and advice is comedy. > read process.env directly, which in this app means MONGO_URI, JWT_SECRET, SENDGRID_API_KEY, CLOUDINARY_API_SECRET, PAYTM_MERCHANT_KEY yeah it can run arbitrary malicious code, but let’s also highlight that it can read the fake app’s own dummy environment variables > When the victim connects out to […], the server sees the source address on the accepted socket, exactly as any web server sees a visitor’s IP. No discovery, no scanning, no registration of an address. This is precisely why outbound-only design is so convenient for the attacker: it works behind NAT, CGNAT, a corporate proxy, or a home router with zero configuration, and it doesn’t matter if the victim’s IP changes. huge > If there is no UI/Desktop environment the module for leaking browser data or screenshots is self-limiting. yeah this is why a VM is important, it’s because it doesn’t have a UI so screenshots don’t work > … and reinstall your OS - better safe than sorry. yeah just for thoroughness’s sake after having a RAT installed (hopefully you didn’t do this step last)
- vlod 2mo agoI've been meaning to learn/run QEMU on my linux box. I assume I don't need to do anything apart from rebuild the image each time I need to do this? Yes I most likely will tell them to get lost, but if I get an invite from Larry/Sergey I want to be ready.
- m3047 2mo agoYou'll probably need to enable some "secure memory mode" in BIOS, e.g. a boot error that you ignore which says something like "KVM disabled by BIOS" needs to be made to go away.
- inigyou 2mo agoRealistically you want virtualbox, which is closed source and proprietary. qemu will run Linux but I don't think it's accurate and performance enough to run windows, right?
- gavinsyancey 2mo agoYou can run a Windows VM with QEMU, but virt-manager is probably a simpler choice. Qemu is very accurate and performant, but also very flexible and not exactly straightforward to configure. But if your goal is to experiment with virtualization and learn, either one is probably a better choice than VirtualBox.
- vlod 2mo agoIf security/isolation of unknown not quarantined code, Windows would not be high in my list as a sandbox.
- zuuna 2mo agoBeing on the job hunt myself this is very helpful! I do however prepare public repos and showcases for such interviews/applications, I hope my luck streak doesnt run out
- Kuyawa 2mo agoI received so many of these requests to install malware that I removed linkedin from my life completely (besides the scam and spam flood) Do not install anything on your machine, ever. Tell them politely ~to fuck off~ that you are not interested and move on. I know the desperation to be jobless will obfuscate your mind but again, never ever install anything on your machine when job hunting. I've seen people lose their crypto savings in seconds to say the least. You've been warned.
- inigyou 2mo agoInstructions clear. Every time a company asked for a zoom call I told them to fuck off, I won't install that. Now I'm homeless. Now what should I do?
- akarshhegde18 2mo ago[flagged]
- nottorp 2mo ago> The code is available on Bitbucket, which IMHO is uncommon What? There is no world outside github? The rest of the article is legit, but they had to insert some monopoly worship...
- mapmeld 2mo agoSince no one mentioned it - this seems to be a major and real problem in the crypto job space. In their job market it's more believable that a 'stealth startup' is reaching out and doing a code challenge from an unfamiliar email or repo, and crypto devs are likely to have a wallet or passwords accessible on their system. They are willing to go above and beyond the regular spam or AI conversations to get access.
- fwip 2mo agoAlso, to be into cryptocurrency, you kind of have to be gullible to begin with.
- deleted 2mo ago[deleted]
- inigyou 2mo agoNo you don't, you just have to believe there are people more gullible than you. The creators of those monkeys or the people who hacked whatever wallet aren't gullible.
- psd1 2mo agoI'll add the category of people with the arrogance to believe that, after 900 previous ventures had all their coin stolen, they'll be the ones to write a secure exchange that can't be hacked.
- inigyou 2mo agoThere are also plenty of ventures that have not had all their coin stolen.
- fwip 2mo agoSure, you can get into the scam business expecting you'll be the scammer and not the scammed. Statistically, it's not gonna work out. Same as folks buying into MLM and other pyramid-scheme-adjacent things. Lots of them think they'll be the ones coming out on top.
- sorokod 2mo agoA recruiter recently sent me an "I'd like you to explore..." email. Every "further info" link in it pointed to znsrc.com/[unique_id] rather than to the displayed address. That felt dishonest and I ignored the email.
- joshribakoff 2mo agoThat’s standard click tracking usually. No different than clicking on a sponsored Google result.
- sorokod 2mo agoSure, would have preferred an honest "we use standard click tracking service, it will totally redirect you to our website" or some such thing
- Terr_ 2mo ago> It never asks for elevation. It doesn’t need root, UAC, or sudo, because nothing it wants is root-owned. SSH keys, AWS credentials, browser profiles, wallet data, .env files - all of it is user-owned by design, because you need to read it routinely. Tangentially, what have people found that works well in term of hardening [0] desktop linux? For example, at least keeping "banking" separate from code-development? I figure the only good way to keep separate user accounts and whenever I have to do something as root, I switch to the most-secure and least-used of the accounts. [0] https://xkcd.com/1200/ https://xkcd.com/1200/
- shahbaby 2mo agoIf a company is not even willing to have a real person speak to you at the start of the recruitment process, what does that say about them? Or about the legitimacy of that job posting? Or about the people you would be working with if you did get hired? Regardless if you get an offer or not, you will invest a significant amount of finite time in each interview cycle and if you do get an offer, you'll be investing even more time into that company. So no matter who you are, protect your time and remember that interviewing is always a 2-way street.
- charcircuit 2mo agoAre you familiar with the concept of a recruitment funnel? It is not financially worth it to personally talk with every single person that applies to a company.
- gmerc 2mo agoWell then it’s not financially worth it for capable people to work for that company. And of story
- charcircuit 2mo agoNot all capable people are willing to reject a company because they upload their resume to an automated system than giving it to a human to talk with.
- inigyou 2mo agoIt's every company. If you reject companies for this, you are living under a bridge right now.
- disgruntledphd2 2mo ago> It's every company. If you reject companies for this, you are living under a bridge right now. I just finished a successful job search, and only had 1 company (of maybe 50 applications) try this.
- paulpauper 2mo agoDo not ever run anything, download anything.
- gfalcao 2mo agoMy first thought after reading the article: develoepers NEED to learn to use firewalls such as LuLu(https://objective-see.org/products/lulu.html https://objective-see.org/products/lulu.html) to get interactive dialogs asking whether any given binary can access any given internet address whether it is a domain address or IP address (which can seem even shadier). I am an Emacs user but every time I have tried a new editor, including VS Code or VSCodium I blocked access to remote addressed which were prompted to me even though I did not neither authorize extension download nor extension download. I think it would have been even funny for devs trying out for code challenges while using "interactive" firewalls such as LuLu, then catching the shadiness and blocking access right up.
- Numerlor 2mo agoThis really is the simplest path to somewhat decent security, and alongside it you may catch some programs doing requests that are fine for security but you'd rather it not do because of privacy.
- john01dav 2mo agoThe line between privacy and security is very blurry. Consider this: if Microsoft exfiltrates your keystrokes, it's a privacy violation, but if a random person does the same thing then it's a security violation. You might say that the random person is more likely to use it against you, but then the car insurance companies mining your driving data absolutely do use it against some customers, but that's generally considered to be a privacy violation rather than a security violation.
- _carbyau_ 2mo agoThe internet world really does run on trust-chaining reputation. A person who takes random things from a near stranger on the internet and runs it on their computer with no real safeguards is not a person I should hire. Which also means that your hiring practice should not involve a person you met on zoom/Teams/whatever 10 minutes ago being required to run your random crap without safeguards. Which means if you want them to download and run stuff, you should list the requirements so the applicant can decide if they are going to do that for you. But we don't live in such an ideal world....
- inigyou 2mo agoYeah but the actual employers are asking them to run random things on your computer. Often actual malware like Slack, Zoom, Teams, Google Meet. What do you expect the candidate to do? (Possible answer: use a VM)
- ShinyLeftPad 2mo ago> Putting things into Docker and only executing the code inside isolates your host system and does not reveal any stored secret - as long as you do not mount host data into the container. Doesn't mention why... Gives no similar warning about VM. You usually have to mount at least some data in a container or VM for it to be useful. Of course, being an idiot and sensitive mounting secrets in untrusted environment is the problem, container or VM doesn't matter. Maybe it means there's some 0day where mounting any volume allows container escape or something? But that's not what it says.
- iampyus 2mo ago[dead]