I actually got contacted by North Koreans posing as Japanese VC looking to partner in the Nordics. I have an agent that scans my emails and does the inverse filtering, suggests when I should take a look. This is because I get insane amount of cold inbound. But it also flags suspicious emails and uses network tools to find out info about the sender. It flagged that one as a NK account (I later confirmed it was already flagged on the watch list in various reddit channels). Everyone should be arming themselves with email filtering agents now. What I’m worried about is grandmas and grandpas and general ppl that are behind the tech curve.
Pretty funny that tech makes candidates jump through all sorts of automated, inhumane loops to even advance to talking to a real human in the hiring process.
I remember in the mid-90s going to an interview in Manhattan - pre-Internet. Someone met me and led me to a table and said, "Here's where you're going to take your test." I said, "I don't take tests." She said "Everyone that comes in takes the test". I said, "Well, that's no longer true because I came in and I'm leaving without taking the test"
While I love the "edgy-ness" of this, I remember doing something like this around 2013 in Manhattan and kind of enjoyed it. They had me go into a room, and gave me a paper with an open ended question: it was something along the lines of, write as much detail as I could about what happens when a user visits a URL in a web browser. E.g. explain as much as I know about TCP, HTTP requests, web servers, etc. I think I touched on how Cookies worked as well.
No AI, no leet code, just old fashioned gauging someone's experience and communication skills.
Doing ANYTHING on a work issued laptop outside of your role is such a dumb idea for a litany of obvious reasons that I'm genuinely shocked people do it. Let alone participate in interviews for other companies on it.
In my last job we used Zoom for interviews. The link we sent would work in any web browser, but if the candidate was signed into a Zoom account on their computer we'd be able to see it. I'd say >70% of them were on their company account.
But if he'd done the interview on his personal laptop then he would have had his personal crypto wallet drained instead, seems like he came out ahead this way.
It is crazy that this Engineer A fell for this malware ad (how do people still fall for these & how does Google still get away with serving malware like that):
It is kind of weird that they mention it though, if they replaced the devices and rotated credentials? Just to later mention that an "internal AI tool" was used to steal that Engineer As credentials again?
And also, what are those "obfuscation techniques"? It looks very straight forward, replacing the pyenv, there's nothing much obfuscated in it? Except for putting it in a different folder.
People from big companies I talk to all the time are now pulling into h I secops teams to literally assed whether a candidate is safe. It's getting very expensive.
This is Binance/CZ's version of the story, but no one really knows the truth.
They have a massive incentive to invent a story to cover up the incident. I'm not saying it's a cover-up, but the motive is definitely there.
North Korea has denied responsibility, whereas they usually own up to their actions.
Disregarding that, it just doesn't make sense for their internal security to be so lax.
I've worked at big companies but with AUM lower than Binance, a lot of control and safeguards are in place to prevent one "rogue" employee from stealing everything. It's pretty much impossible for a company like Binance to not have implemented such things.
Zoom exploits could have done this without downloads. I don't interview on a computer with sensitive data, it's usually a throwaway. I sometimes get judged for doing the interview on a Chromebook or an old Mac and I hope that interviewers understand why I choose to do it this way.
Probably. I have seen many colleagues across the cubicle aisles spending their time on things completely unrelated to their work. I would be baffled to hear that you have not had similar experiences.
As a hiring manager, do you hold that behavior against candidates for positions where poor security practices could become a major liability for your company?
Not as easy as that, these can be real people with genuine businesses across the other side of the world, which sounds like what happened here. They only have to seem friendly and genuine before asking you to perform a coding test or whatever.
Unfortunately:
1) The dev downloaded it onto a work laptop which was really poor behaviour
2) It sounds like the developer environment was very open instead of segmented. Common but an easy control to use in a high-risk environment.
3) Sounds like a lack of any elevation process e.g. if a developer needed to access a wallet, it very much should sound an alarm/require explicit permission etc.
I actually got contacted by North Koreans posing as Japanese VC looking to partner in the Nordics. I have an agent that scans my emails and does the inverse filtering, suggests when I should take a look. This is because I get insane amount of cold inbound. But it also flags suspicious emails and uses network tools to find out info about the sender. It flagged that one as a NK account (I later confirmed it was already flagged on the watch list in various reddit channels). Everyone should be arming themselves with email filtering agents now. What I’m worried about is grandmas and grandpas and general ppl that are behind the tech curve.
Pretty funny that tech makes candidates jump through all sorts of automated, inhumane loops to even advance to talking to a real human in the hiring process.
And now you get results like this.
I remember in the mid-90s going to an interview in Manhattan - pre-Internet. Someone met me and led me to a table and said, "Here's where you're going to take your test." I said, "I don't take tests." She said "Everyone that comes in takes the test". I said, "Well, that's no longer true because I came in and I'm leaving without taking the test"
While I love the "edgy-ness" of this, I remember doing something like this around 2013 in Manhattan and kind of enjoyed it. They had me go into a room, and gave me a paper with an open ended question: it was something along the lines of, write as much detail as I could about what happens when a user visits a URL in a web browser. E.g. explain as much as I know about TCP, HTTP requests, web servers, etc. I think I touched on how Cookies worked as well.
No AI, no leet code, just old fashioned gauging someone's experience and communication skills.
I did this as a test in 2018! Compares to the leetcode screens now, it was a dream
And I bet you both came away from that interview feeling like you’d dodged a bullet. The interviewer just as much as yourself.
Excellent choice! No amount of money feels as good as claiming the respect you deserve.
Wow how tough.
Haha owned
Doing ANYTHING on a work issued laptop outside of your role is such a dumb idea for a litany of obvious reasons that I'm genuinely shocked people do it. Let alone participate in interviews for other companies on it.
A lot of people just think laptop == laptop.
At several companies I’ve seen folks run torrents to watch movies at work.
Once I was on a Zoom call, and I noticed music production software on my colleagues computer.
When I pointed it out, they responded with something like “ Ohh, my kids make music.”
Neat, I guess.
In my last job we used Zoom for interviews. The link we sent would work in any web browser, but if the candidate was signed into a Zoom account on their computer we'd be able to see it. I'd say >70% of them were on their company account.
as a candidate it's pretty tough scheduling interviews past 5pm or on the weekends
What’s preventing you from using a personal laptop ?
Their current job, presumably
But if he'd done the interview on his personal laptop then he would have had his personal crypto wallet drained instead, seems like he came out ahead this way.
I do know people who no longer have a personal computer, and use exclusively their work-issued computer. I wonder how common that is.
It's convenient. I'm not lugging two laptops around!
Well so-rry but if you give me a macbook powerful enough to play cyberpunk 2077 on it, that's what I'm gonna do.
At least dual-boot a second OS that they have no control over.
lol maybe the employees wanted the company to see it.
I was #opentowork on LinkedIn and got approached multiple times with fake companies and interviews. LinkedIn is not doing enough to combat this.
I even create a 1 man company for my consulting services and I receive ads about how people at my company saved me a spot on an online game.
LinkedIn is partially responsible for their neglect here.
It is crazy that this Engineer A fell for this malware ad (how do people still fall for these & how does Google still get away with serving malware like that):
https://isc.sans.edu/diary/32942
It is kind of weird that they mention it though, if they replaced the devices and rotated credentials? Just to later mention that an "internal AI tool" was used to steal that Engineer As credentials again?
And also, what are those "obfuscation techniques"? It looks very straight forward, replacing the pyenv, there's nothing much obfuscated in it? Except for putting it in a different folder.
Source posted earlier: "29 October Binance Security Incident: Initial Findings and Response Update" https://news.ycombinator.com/item?id=50359377
Pretty lame of The Register not to reference the original source.
> Pretty lame of The Register not to reference the original source.
They did, in their sentence "the incident report said".
Running interview assignment on a work computer… tsk tsk
at the very least, run it inside a docker container (making sure of network and volumes i would say)
Hindsight is 20/20. Although why aren't assignments just a pdf
This is what I was trying to figure out. Did they think it was for an internal role or something?
Some people just make really dumb decisions.
Like giving people direct access to $6.3 billion?
It was rather indirect access.
Why did the employee have direct access to $6.3 billion in customer funds?
No directly, but he could deploy code that had access to customers' wallets. Which is even worse.
Good thing they didn't get anything important.
People from big companies I talk to all the time are now pulling into h I secops teams to literally assed whether a candidate is safe. It's getting very expensive.
It's one of the reason ojcp exists.
Further evidence that 1) recruiting is broken and 2) developers make great targets, and we need to respond accordingly.
This is Binance/CZ's version of the story, but no one really knows the truth.
They have a massive incentive to invent a story to cover up the incident. I'm not saying it's a cover-up, but the motive is definitely there.
North Korea has denied responsibility, whereas they usually own up to their actions.
Disregarding that, it just doesn't make sense for their internal security to be so lax.
I've worked at big companies but with AUM lower than Binance, a lot of control and safeguards are in place to prevent one "rogue" employee from stealing everything. It's pretty much impossible for a company like Binance to not have implemented such things.
I do not buy it.
I love these guys!
[dupe] https://news.ycombinator.com/item?id=50353818
Zoom exploits could have done this without downloads. I don't interview on a computer with sensitive data, it's usually a throwaway. I sometimes get judged for doing the interview on a Chromebook or an old Mac and I hope that interviewers understand why I choose to do it this way.
Am I the only one baffled by the fact that the engineer uses a work PC for a personal job interview assignment?
Probably. I have seen many colleagues across the cubicle aisles spending their time on things completely unrelated to their work. I would be baffled to hear that you have not had similar experiences.
Well I've done the same too. But I would not use my work PC.
Absolutely. Yet as a hiring manager, I see it all the time.
As a hiring manager, do you hold that behavior against candidates for positions where poor security practices could become a major liability for your company?
It's strange companies haven't cracked something as basic as remote hiring checks yet.
There are tools available to stop AI screen recording tools, fake candidate tools yet many companies keep getting hit..
Not as easy as that, these can be real people with genuine businesses across the other side of the world, which sounds like what happened here. They only have to seem friendly and genuine before asking you to perform a coding test or whatever.
Unfortunately:
1) The dev downloaded it onto a work laptop which was really poor behaviour
2) It sounds like the developer environment was very open instead of segmented. Common but an easy control to use in a high-risk environment.
3) Sounds like a lack of any elevation process e.g. if a developer needed to access a wallet, it very much should sound an alarm/require explicit permission etc.
But it is easy to be wise in hindsight.
It seems in this case really poor behaviour and practices, I can imagine some security engineer shouting I told you so pretty loudly.
On the other end, when doing interviews I suspect 40-50% of candidates use AI assistant tools (might be skewed in tech).
I do miss seeing someone's camera feed break or AI tool break down mid interview.