I actually got contacted by North Koreans posing as Japanese VC looking to partner in the Nordics. I have an agent that scans my emails and does the inverse filtering, suggests when I should take a look. This is because I get insane amount of cold inbound. But it also flags suspicious emails and uses network tools to find out info about the sender. It flagged that one as a NK account (I later confirmed it was already flagged on the watch list in various reddit channels). Everyone should be arming themselves with email filtering agents now. What I’m worried about is grandmas and grandpas and general ppl that are behind the tech curve.
steveBK123 57 minutes ago [-]
Pretty funny that tech makes candidates jump through all sorts of automated, inhumane loops to even advance to talking to a real human in the hiring process.
And now you get results like this.
intrasight 41 minutes ago [-]
I remember in the mid-90s going to an interview in Manhattan - pre-Internet. Someone met me and led me to a table and said, "Here's where you're going to take your test." I said, "I don't take tests." She said "Everyone that comes in takes the test". I said, "Well, that's no longer true because I came in and I'm leaving without taking the test"
progforlyfe 23 minutes ago [-]
While I love the "edgy-ness" of this, I remember doing something like this around 2013 in Manhattan and kind of enjoyed it. They had me go into a room, and gave me a paper with an open ended question: it was something along the lines of, write as much detail as I could about what happens when a user visits a URL in a web browser. E.g. explain as much as I know about TCP, HTTP requests, web servers, etc. I think I touched on how Cookies worked as well.
No AI, no leet code, just old fashioned gauging someone's experience and communication skills.
nzjrs 10 minutes ago [-]
I did this as a test in 2018! Compares to the leetcode screens now, it was a dream
hnlmorg 3 minutes ago [-]
And I bet you both came away from that interview feeling like you’d dodged a bullet. The interviewer just as much as yourself.
gilrain 20 minutes ago [-]
Excellent choice! No amount of money feels as good as claiming the respect you deserve.
Horffupolde 37 minutes ago [-]
Wow how tough.
xyzsparetimexyz 33 minutes ago [-]
Haha owned
bilekas 37 minutes ago [-]
Doing ANYTHING on a work issued laptop outside of your role is such a dumb idea for a litany of obvious reasons that I'm genuinely shocked people do it. Let alone participate in interviews for other companies on it.
paxy 31 minutes ago [-]
In my last job we used Zoom for interviews. The link we sent would work in any web browser, but if the candidate was signed into a Zoom account on their computer we'd be able to see it. I'd say >70% of them were on their company account.
fusslo 21 minutes ago [-]
as a candidate it's pretty tough scheduling interviews past 5pm or on the weekends
Agingcoder 20 minutes ago [-]
What’s preventing you from using a personal laptop ?
dkdbejwi383 7 minutes ago [-]
Their current job, presumably
jstanley 24 minutes ago [-]
But if he'd done the interview on his personal laptop then he would have had his personal crypto wallet drained instead, seems like he came out ahead this way.
999900000999 5 minutes ago [-]
A lot of people just think laptop == laptop.
At several companies I’ve seen folks run torrents to watch movies at work.
Once I was on a Zoom call, and I noticed music production software on my colleagues computer.
When I pointed it out, they responded with something like “ Ohh, my kids make music.”
Neat, I guess.
HeavenFox 27 minutes ago [-]
I do know people who no longer have a personal computer, and use exclusively their work-issued computer. I wonder how common that is.
podocarp 26 minutes ago [-]
It's convenient. I'm not lugging two laptops around!
xyzsparetimexyz 34 minutes ago [-]
Well so-rry but if you give me a macbook powerful enough to play cyberpunk 2077 on it, that's what I'm gonna do.
ranger_danger 19 minutes ago [-]
At least dual-boot a second OS that they have no control over.
LunaSea 1 minutes ago [-]
I highly doubt that a company will like that you dual boot their machines.
jimmydoe 35 minutes ago [-]
lol maybe the employees wanted the company to see it.
xutopia 53 minutes ago [-]
I was #opentowork on LinkedIn and got approached multiple times with fake companies and interviews. LinkedIn is not doing enough to combat this.
I even create a 1 man company for my consulting services and I receive ads about how people at my company saved me a spot on an online game.
LinkedIn is partially responsible for their neglect here.
sva_ 21 minutes ago [-]
It is crazy that this Engineer A fell for this malware ad (how do people still fall for these & how does Google still get away with serving malware like that):
It is kind of weird that they mention it though, if they replaced the devices and rotated credentials? Just to later mention that an "internal AI tool" was used to steal that Engineer As credentials again?
And also, what are those "obfuscation techniques"? It looks very straight forward, replacing the pyenv, there's nothing much obfuscated in it? Except for putting it in a different folder.
Pretty lame of The Register not to reference the original source.
HelloUsername 5 minutes ago [-]
> Pretty lame of The Register not to reference the original source.
They did, in their sentence "the incident report said".
mynegation 49 minutes ago [-]
Running interview assignment on a work computer… tsk tsk
parthdesai 32 minutes ago [-]
at the very least, run it inside a docker container (making sure of network and volumes i would say)
podocarp 27 minutes ago [-]
Hindsight is 20/20. Although why aren't assignments just a pdf
alostpuppy 47 minutes ago [-]
This is what I was trying to figure out. Did they think it was for an internal role or something?
cwnyth 43 minutes ago [-]
Some people just make really dumb decisions.
lesuorac 38 minutes ago [-]
Like giving people direct access to $6.3 billion?
jstanley 23 minutes ago [-]
It was rather indirect access.
paxy 35 minutes ago [-]
Why did the employee have direct access to $6.3 billion in customer funds?
Maken 31 minutes ago [-]
No directly, but he could deploy code that had access to customers' wallets. Which is even worse.
BigTTYGothGF 17 minutes ago [-]
Good thing they didn't get anything important.
fraywing 10 minutes ago [-]
People from big companies I talk to all the time are now pulling into h I secops teams to literally assed whether a candidate is safe. It's getting very expensive.
It's one of the reason ojcp exists.
james_marks 48 minutes ago [-]
Further evidence that 1) recruiting is broken and 2) developers make great targets, and we need to respond accordingly.
moralestapia 10 minutes ago [-]
This is Binance/CZ's version of the story, but no one really knows the truth.
They have a massive incentive to invent a story to cover up the incident. I'm not saying it's a cover-up, but the motive is definitely there.
North Korea has denied responsibility, whereas they usually own up to their actions.
Disregarding that, it just doesn't make sense for their internal security to be so lax.
I've worked at big companies but with AUM lower than Binance, a lot of control and safeguards are in place to prevent one "rogue" employee from stealing everything. It's pretty much impossible for a company like Binance to not have implemented such things.
Zoom exploits could have done this without downloads. I don't interview on a computer with sensitive data, it's usually a throwaway. I sometimes get judged for doing the interview on a Chromebook or an old Mac and I hope that interviewers understand why I choose to do it this way.
Jianghong94 49 minutes ago [-]
Am I the only one baffled by the fact that the engineer uses a work PC for a personal job interview assignment?
voakbasda 46 minutes ago [-]
Probably. I have seen many colleagues across the cubicle aisles spending their time on things completely unrelated to their work. I would be baffled to hear that you have not had similar experiences.
Jianghong94 40 minutes ago [-]
Well I've done the same too. But I would not use my work PC.
sidewndr46 43 minutes ago [-]
Absolutely. Yet as a hiring manager, I see it all the time.
bell-cot 38 minutes ago [-]
As a hiring manager, do you hold that behavior against candidates for positions where poor security practices could become a major liability for your company?
agentriskdesk 8 minutes ago [-]
[flagged]
AlexRinconTradi 8 minutes ago [-]
[flagged]
CommanderData 46 minutes ago [-]
It's strange companies haven't cracked something as basic as remote hiring checks yet.
There are tools available to stop AI screen recording tools, fake candidate tools yet many companies keep getting hit..
lbriner 41 minutes ago [-]
Not as easy as that, these can be real people with genuine businesses across the other side of the world, which sounds like what happened here. They only have to seem friendly and genuine before asking you to perform a coding test or whatever.
Unfortunately:
1) The dev downloaded it onto a work laptop which was really poor behaviour
2) It sounds like the developer environment was very open instead of segmented. Common but an easy control to use in a high-risk environment.
3) Sounds like a lack of any elevation process e.g. if a developer needed to access a wallet, it very much should sound an alarm/require explicit permission etc.
But it is easy to be wise in hindsight.
CommanderData 31 minutes ago [-]
It seems in this case really poor behaviour and practices, I can imagine some security engineer shouting I told you so pretty loudly.
On the other end, when doing interviews I suspect 40-50% of candidates use AI assistant tools (might be skewed in tech).
I do miss seeing someone's camera feed break or AI tool break down mid interview.
Rendered at 15:18:40 GMT+0000 (Coordinated Universal Time) with Vercel.
And now you get results like this.
No AI, no leet code, just old fashioned gauging someone's experience and communication skills.
At several companies I’ve seen folks run torrents to watch movies at work.
Once I was on a Zoom call, and I noticed music production software on my colleagues computer.
When I pointed it out, they responded with something like “ Ohh, my kids make music.”
Neat, I guess.
I even create a 1 man company for my consulting services and I receive ads about how people at my company saved me a spot on an online game.
LinkedIn is partially responsible for their neglect here.
https://isc.sans.edu/diary/32942
It is kind of weird that they mention it though, if they replaced the devices and rotated credentials? Just to later mention that an "internal AI tool" was used to steal that Engineer As credentials again?
And also, what are those "obfuscation techniques"? It looks very straight forward, replacing the pyenv, there's nothing much obfuscated in it? Except for putting it in a different folder.
They did, in their sentence "the incident report said".
It's one of the reason ojcp exists.
They have a massive incentive to invent a story to cover up the incident. I'm not saying it's a cover-up, but the motive is definitely there.
North Korea has denied responsibility, whereas they usually own up to their actions.
Disregarding that, it just doesn't make sense for their internal security to be so lax.
I've worked at big companies but with AUM lower than Binance, a lot of control and safeguards are in place to prevent one "rogue" employee from stealing everything. It's pretty much impossible for a company like Binance to not have implemented such things.
I do not buy it.
There are tools available to stop AI screen recording tools, fake candidate tools yet many companies keep getting hit..
Unfortunately:
1) The dev downloaded it onto a work laptop which was really poor behaviour
2) It sounds like the developer environment was very open instead of segmented. Common but an easy control to use in a high-risk environment.
3) Sounds like a lack of any elevation process e.g. if a developer needed to access a wallet, it very much should sound an alarm/require explicit permission etc.
But it is easy to be wise in hindsight.
On the other end, when doing interviews I suspect 40-50% of candidates use AI assistant tools (might be skewed in tech).
I do miss seeing someone's camera feed break or AI tool break down mid interview.