Rendered at 21:00:49 GMT+0000 (Coordinated Universal Time) with Cloudflare Workers.
IvanGoncharov 21 hours ago [-]
Wow, after reading this article, I figured out I was hacked, but with a way more sophisticated attack.
A few weeks ago, I had an interview with a CTO of a totally legit company.
It was weird because he had disabled the camera, and the person had a strong accent.
But everything else sounded like a normal screening interview, and the person definitely knew what he was talking about.
At the end of the interview, he explained to me that during the technical interview I would need to make some modifications to their project (it's an OSS product), so he asked me to clone the repo and check the setup.
Later, the HR person said the CTO got sick, so the interview would be postponed.
But a few days later, the HR profile was deleted from LinkedIn.
It was super weird, but it didn't trigger my suspicion until I saw this post on HackNews.
I checked, and the repo I was cloning and running during the interview had a malware payload.
P.S. I think it was a targeted attack because in the past I maintained a very popular NPM package with 43+M weekly downloads. That's my only explanation for why someone would carry out such a sophisticated social-engineering attack against me.
P.P.S. It's great that I have 2FA everywhere, and I always publish NPM packages manually without using tokens. But I need to wipe my laptop and reinstall everything.
IvanGoncharov 20 hours ago [-]
I just checked my calendar, and it was a 45-minute interview scheduled on Calendly.
HR person sent me a link to Calendly so I could schedule an interview with the CTO.
I actually talked with someone pretending to be the CTO for 45 minutes.
I checked other similar threads on HN, but they don't mention an actual Google Meet call with a scammer.
throwatdem12311 20 hours ago [-]
Yeah, I refuse to just clone random projects. Luckily, I’m a rails developer - and scaffolding entire applications takes literally minutes.
Just give me the specification and I will build it end to end myself.
If you’re serious you would consider it. If you don’t - I dodged a bullet.
If you consider that people are using LLMs for code generation pretty much exclusively now this should be possible with any stack.
Groxx 17 hours ago [-]
Cloning should be fine on its own - git hooks aren't installable automatically, for reasons like this, and they treat anything that makes cloning unsafe as a pretty severe security issue so new discoveries get plugged quickly. This post's malware is possible because it's from a general archive, not a clone.
Though other stuff on your system might be less preventative, and that could run stuff in the repo folder. And I kinda wish git would force review of hooks and executable config everywhere before they're run - I would absolutely enable that, security is sometimes a bit annoying and that's inescapable.
lmz 14 hours ago [-]
It's not the cloning that gets you. It's the inevitable step of running whatever you cloned to "run the tests" or "see how it works".
lathiat 20 hours ago [-]
Yikes.
Going to need containerised vscode in this world.
manarth 8 hours ago [-]
Kind-of exists with VSCode Remote, although for stricter isolation you'd want VSCode Server via a web-browser.
bdavbdav 6 hours ago [-]
DevContainers works great
CITIZENDOT 19 hours ago [-]
wow
> I maintained a very popular NPM package with 43+M weekly downloads
makes sense why they targetted you, good that you have 2FA enabled.
anal_reactor 14 hours ago [-]
It's so weird to me that I'm on same social media as people worthy of targeted attacks. Like, I'm a total nobody, all I get is "Free Spins For You!" and "I am a dying German billionaire...". My favorite email had a subject "Sorry I broke your vagina".
BrokenCogs 9 hours ago [-]
What are you expecting with a name like anal_reactor?
electroglyph 7 hours ago [-]
If it makes you feel any better, my apology was genuine.
anal_reactor 6 hours ago [-]
It's okay, I can still repurpose it and make a handbag.
NetOpWibby 7 hours ago [-]
2FA FTW!
Glad the scumbags didn’t get anything but your time.
skeptic_ai 16 hours ago [-]
Sorry but not using a devpod or a vm for that in this age is just irresponsible. A random npm package can already do a lot of damage.
pwillia7 20 hours ago [-]
whoa
petterroea 19 hours ago [-]
Recently there seems to be an uptick in North-Korean attacks against developers. In addition to this type of attack, which has been going on for years, I recently get ~1 email a week from North Korean hackers. It's always a "Hello, I found your profile, want to collaborate?" e-mail.
Discord communities I am in for programming are similar. People show up and within a few days either ask for a job or suggest cooperation. Sure, you could argue these Discord people may actually be out of a job (in this economy, very likely), but the volume and similarity of the messages say otherwise. You can also tell people show up in... _weird places_ to ask for jobs. An example being the Discord community for a not-really-used Python library with ~0 actual activity - either this person is very bad at finding good places to jobhunt or some attacker is just crawling a list of Discord communities and attacking them all.
It's a shame but there are a _lot_ of attacks that abuse our trust in each other nowadays. A good reminder to, like mom and dad said, never trust strangers on the internet
GitPushOrigin 1 hours ago [-]
And they're using LLMs, which are convincing enough from a basic conversational standpoint to prevent being immediately filtered as a bot as easily as in the past.
wxw 23 hours ago [-]
> They embedded a script that checks the victim’s host operating system and silently executes a remote payload.
Seems like this is becoming a recurring theme, similar story was on the front page last month.
The OP says as much, and links to a Google Search results that says the same.
ivanjermakov 23 hours ago [-]
> Why use a raw IP address? If anything, this screams “malware.”
If the victim is deep enough to check hook's content, it's unlikely they will just stop here losing suspicion. I'm sure most devs wouldn't think that doing `git commit` can be malicious (git security oversight?).
zeratax 12 hours ago [-]
if you just clone a repo no githooks are every automatically enabled. but since this was downloaded not cloned it's a different story
zombot 14 hours ago [-]
> git security oversight?
Executing downloaded code without prior review always is these days, regardless of the tool that does it.
vardalab 22 hours ago [-]
My takeaway from this was that Claude was being completely useless as a helper Thanks to all the safety safeguards and that nonsense.
lantry 23 hours ago [-]
> Side note: Why use a raw IP address? If anything, this screams “malware.” At least register a decoy domain like lint-checker.com or jenkins-ci-runner.net. If the threat actors who wrote this are reading: take notes people!
Maybe they don't want to give any identifying info to the domain registrar? Or just minimizing their online presence?
HPsquared 23 hours ago [-]
That's probably the reason bare IP addresses are associated with sketchy stuff.
cromka 22 hours ago [-]
Or possibly these hosts fell victims of their malware, too, and see now used as proxies.
valleyer 18 hours ago [-]
That doesn't mean you can't set up DNS names to point at them.
CITIZENDOT 23 hours ago [-]
fair point
CM30 20 hours ago [-]
Hmm, did anyone else have issues loading the screenshots here? I had to open most of them in a new tab to see them.
Regardless, that's a pretty sneaky scam, and definitely something that caught out a ton of would be candidates in the past. What's more, the Visual Studio Code project mentioned in the article sounds even more horrifying. Like, the tool seriously lets you run custom code whenever someone opens your project? That feels like a really blatant malware vector that should probably have at least some sort of security mitigation...
It's also rather worrying how little these job sites are doing about scams like this too. I get it, it's perhaps a bit difficult to catch out all kinds of wrongdoing here. But you'd think it'd be simple enough to restrict accounts from claiming to be associated with a company or organisation if there's no proof they work there. At the moment, you can basically claim to work for any company you like, or that you have any type degree from any institution under the sun. If this was verified in any real way, and messages had a large warning at the top if the original claiming to be from an organisation wasn't confirmed to work there, a lot of scams would far more difficult to pull off.
SoftTalker 17 hours ago [-]
It's like Microsoft forgot about all the malware that was promulgated by Word and Excel macros that would run automatically when you opened a document.
CITIZENDOT 19 hours ago [-]
everything is hosted on github pages, i'll have to use some cdn for images.
nphardon 24 hours ago [-]
always a good day when we get an a post on front actually related to hacking on hackernews.
ivanjermakov 23 hours ago [-]
Except hackernews is about different kind of hackers.
> 1. A person who enjoys exploring the details of programmable systems and how to stretch their capabilities, as opposed to most users, who prefer to learn only the minimum necessary. RFC1392, the Internet Users' Glossary, usefully amplifies this as: A person who delights in having an intimate understanding of the internal workings of a system, computers and computer networks in particular.
> 2. One who programs enthusiastically (even obsessively) or who enjoys programming rather than just theorizing about programming.
CITIZENDOT 20 hours ago [-]
thanks!
markoman 15 hours ago [-]
[dead]
darth_avocado 23 hours ago [-]
If LinkedIn actually cared about preventing scams, they could implement verification using company emails if you want to list your current employment. And if it is too much of a heavy burden, then at the minimum you should have it as an optional feature that recruiters would have to comply with, if they want to be legitimate.
CITIZENDOT 23 hours ago [-]
> they could implement verification using company emails
The legitimate recruiters should start using it then.
burningChrome 21 hours ago [-]
Myself and my friends have for years created fake profiles to catfish recruiters and companies to find out what job reqs they have open and what they're looking for in a candidate. When JS frameworks got huge, it was really helpful to separate the legit companies and recruiters from the scammers.
I would imagine a lot of what went on then, is going on now with all the AI jobs and demand for people who have even a cursory knowledge of LLM's and automation.
aykutulis 5 hours ago [-]
Most of the time I don't pull external sources (a repo, files, etc.) onto my laptop. Maybe I've passed up some opportunities, but every company that hired me never asked me to install anything: they either used a known live-coding platform, or shared their private repo read-only so I could look without pulling it and then create my own repo to share back.
I also try to talk to people at the company, but I mean employees I can verify independently, not whoever the recruiter puts in front of me. From the stories here, the person on the call can be the scammer, so a convincing conversation isn't proof on its own.
ChrisMarshallNY 24 hours ago [-]
I assume these types of things are going to become more and more common.
Looks like these folks really did their homework.
It's nasty, but I have to respect their skills. I'll bet it works, quite often.
CITIZENDOT 24 hours ago [-]
yea, i had fun looking around, this felt like a ctf challenge lol. if they had any vuln on their server, it would've been even better.
LoganDark 24 hours ago [-]
Their "skills" might just be borrowed from some LLM.
ChrisMarshallNY 23 hours ago [-]
I dunno. The Norks seem to be really good at this, and have been, for a long time.
I suspect it's clever, experienced, engineers, leveraging LLMs.
throw_m239339 24 hours ago [-]
Yeah, this scam is probably all automated at first place. Welcome to the "agent era"...
In my case it was a .vscode hook. Stay safe out there :)
syntaxing 21 hours ago [-]
That was a fun read, I wonder if vscode would still load the script if you click “don’t trust author”? That being said, can you embed something yourself and push the commit?
CITIZENDOT 21 hours ago [-]
> I wonder if vscode would still load the script if you click “don’t trust author”
But, I don't think anybody pays attention to the workspace trust. When ".vscode" has launch commands, it should rather say, "Trusting this workspace runs the following command on your behalf" or something similar.
Scaled 11 hours ago [-]
Yeah, I had no idea Microsoft thinks trust means auto run immediately a script. I always just thought it was something more pedestrian, like restricting debug launch links or something. I will probably not use vs code at all for untrusted repos now.
manarth 7 hours ago [-]
> "I will probably not use vs code at all for untrusted repos now"
The meaning of "Trust" is pretty unambiguous. If you're clicking "Trust this" for a repository you don't trust, I'm not sure that switching IDEs is going to help you much.
hyperhello 18 hours ago [-]
Typical. I’m uninstalling VSCode right now. Does it leave any malware behind that can still run things? Probably.
zeratax 12 hours ago [-]
I feel like vscode is doing everything right here and they cant really do much about users choosing to ignore security warnings. Other IDEs here do exactly the same or less.
Not saying there isn't room to improve, but again if you're uninstalling vscode what are you going to replace it with?
hyperhello 12 hours ago [-]
Hiding malicious behavior behind security warnings you can only click yes or no to is the Microsoft way of neatly denying responsibility, and it compounds and reinforces itself. This pdf looks like a pdf, acts like a pdf, opens like a pdf, what are you going to do? You clicked OK so you wanted that Outlook virus to email itself to everyone on your address book and send their bitcoin to Madagascar, not Microsoft.
zeratax 6 hours ago [-]
what is the alternative here? never ever running git hooks, lsps etc. all of these are vulnerable. and again no other ide here has a better solution.
ge96 24 hours ago [-]
There was a funny video I saw recently someone's running Red Star OS on their computer and a scammer is trying to scam them thinking it's Windows
Unrelated to this git pre commit hook attack but yeah
fitsumbelay 22 hours ago [-]
TIL about tree ...
I stopped being surprised by new stuff I learn about an OS I've been using for 25+ and 10+ as my daily whip and just enjoy the discovery-buzz
these take-home interview nightmare stories are so common ... I'd hate to see a bad actor take advantage by offering a "service" to unsuspecting and underinformed folks like ... erm ... me
22 hours ago [-]
rybosome 17 hours ago [-]
I also learned about tree today and second this sentiment. What a delightful perspective to consider it a discovery buzz.
matltc 16 hours ago [-]
One of those programs that shoulda been in coreutils
gtowey 24 hours ago [-]
My takeaway from this is that I should use the same defense as when someone calls you "from you bank". When they reach out directly, go to the real company's site to apply and contact a real recruiter. If you can't validate that the business is legit before, then assume malfeasance.
technion 24 hours ago [-]
Companies make this hard, a bit like various email scams where legit company communication comes from seemingly random domains (hello paypal). Often the company is legit, but theres no public contact that knows anything about the recruiter thats working for them.
bombcar 24 hours ago [-]
Healthcare companies are the WORST at this - they will send you legitimate email from h34lthc4re.biz with a heart-happy-health.phishing.info link that you HAVE to use - and it's all legit.
paxys 23 hours ago [-]
Even if the attempt is legit, going to the company’s website/careers page to try and reach them is pointless. You application will just get lost among the thousands of others. Your best bet is to ask the recruiter to email you and check for a @<company.com> email address. And even if the attempt checks out don’t run untrusted code on your machine.
24 hours ago [-]
yieldcrv 23 hours ago [-]
it was in this moment, that gtowey’s outdated job solutions transitioned them from unc to boomer
gtowey 23 hours ago [-]
I think you misunderstood.
I'm not talking about switching to cold contacting companies as a job hunting strategy. I'm saying if you get a suspicious outreach from a rando on linked in on behalf of a company THEN you only continue if you can reach out to the same person via official company channels.
yieldcrv 17 hours ago [-]
in principle that makes sense but there is no vector of reaching anyone
actual first party recruiter’s linkedin inbox is unusable full of candidates trying to take initiative, and there is no way to reach anyone from the company from the outside cold specifically to avoid that exact thing
drnick1 23 hours ago [-]
Are these kinds of tests still relevant in the AI age? Genuine question, I have not interviewed for a very long time. They seem as useful as take home college exams.
floren 19 hours ago [-]
Although the questions sometimes trigger useful hallucinations (we were able to instantly disqualify tons from our last hiring batch due to a hallucinated Go stdlib call, their code didn't even compile), the other thing is that you can ask the candidate to talk about their code during an interview. I've seen plenty that submitted good answers but couldn't answer even basic questions about the code they wrote ("what does a sync.Waitgroup do?")
CITIZENDOT 21 hours ago [-]
It's either leetcode style interviews or take-home assessments AFAIK
AlexITC 16 hours ago [-]
Unfortunately this is becoming common, it happened to me today, I was suspicious at first but when they guy showed his face (first time, I guess this was a mistake) in the meet I started trusting them, suddenly their interted started failing and he suggested we both turn the camera off.
I was asked quickly about my experienced and he shared that I was a perfect fit, immediatelly I was asked for my github username, then, I was asked to share my screen, I ended the call to not waste more time but my guess is that I would be asked to do something with the project live.
I haven't dig into their malware approach (yet) but this pattern is too frequent to easily recognize it.
luciana1u 21 hours ago [-]
at some point companies will realize they can just post all their backlog as take-home assignments and eliminate the engineering department entirely
tclancy 22 hours ago [-]
Had something similar but less dangerous recently: I “won” a month’s subscription to a brand new “high paying, not on the public sites” job board where if I wrote a cool integration I would make a bunch of money (except the fine print said they could just take it). It took about a minute and a half of playing with the API to see they hadn’t even bothered to fully trim the listings they scraped from other sites. Each job application required you to answer a fairly detailed engineering issue. Best I could tell is they stole your answer, applied to the gig and then did one of those bait and switch interviews with the actual company.
22 hours ago [-]
mtlynch 20 hours ago [-]
> Naturally, the next move was pivoting from defense to offense. I wanted to see if the attackers left any vulnerable services exposed on their IP.
Why not attack them through the C2 interface? That's where I'd expect them to slip up.
CITIZENDOT 18 hours ago [-]
> C2 interface
do you mean the machine which is connected through the victim's machine? if so, i should put this in a VM, run and see where it's sending/receiving requests from. i'll do that.
mtlynch 8 hours ago [-]
Yeah, exactly. If there's a C2 server, there's some protocol for communication between the C2 server and each victim node.
You can intentionally infect a machine with the malware but then watch the traffic between the victim node and the C2 server. If you get lucky, the C2 server assumes that the victim node is trusted and doesn't sanity check victim->server communication.
Note that this cranks up the danger quite a few notches, though it sounds like you know what you're doing.
ericol 20 hours ago [-]
Nice read, but having your home page play music is incredible rude.
ButlerianJihad 19 hours ago [-]
Oh that was way more common in the Wild Wacky West days.
Thankfully all my browsers are now configured to mute all sound from all sites until I grant express permission to play sound. Nips it in the bud, every time!
23 hours ago [-]
sph 14 hours ago [-]
Ok, how do I disable git hooks unless it’s in a manually blessed directory?
andOlga 13 hours ago [-]
git config --global core.hooksPath /dev/null
Then, in repos you want to turn it on:
git config core.hooksPath "$PWD/.git/hooks"
This also works on Windows (and presumably other operating systems where /dev/null does not exist) as it seems to be handled as a special-case value.
sph 12 hours ago [-]
I would have liked for git to ask me first (like direnv does), rather than disabling them altogether, but this is good enough for now, so thanks.
14 hours ago [-]
darkstar999 19 hours ago [-]
I checked for a way to globally disable git hooks. There is no built-in way of doing this.
barumrho 17 hours ago [-]
Hooks are not checked in to the repo, so they used a zip archive.
andOlga 13 hours ago [-]
git config --global core.hooksPath /dev/null
sailfast 23 hours ago [-]
Really hate that the USG overreaction on Fable has given us a neutered version of AIs for DEFENSIVE capabilities even when we just want an explanation of what we’re being subjected to with this malware.
Give defenders a better shot…
SlightlyLeftPad 18 hours ago [-]
Welp, this is not going make this job market any easier to navigate.
pudgywalsh 21 hours ago [-]
Did no one else read far enough to see this was a DPRK (Best Korea) APT campaign?
> You don’t even have to run a git command, just opening this directory in VSCode is enough to get infected.
LOL, is that shit being worked on by former Outlook developers, bringing with them their zero click bags of tricks?
zeratax 12 hours ago [-]
vscode explicitly warns you when you open a directory and gives you the choice to open it in restricted mode without all the integrations. it's not zero click at all.
iamcreasy 21 hours ago [-]
Interesting read. Is docker sandbox a solution in this situation?
zwu-var 20 hours ago [-]
Not always. The safest way is to use a throwaway remote VM when dealing with untrusted content. Sandbox escaping is unlikely but still a risk on your laptop.
rdksu 24 hours ago [-]
Bruh the harry potter theme song scared the shit out of me as it turned itself on. Bad UX for a personal site. Great article btw !
ladybro 23 hours ago [-]
Where can one be whimsical and fun if not for a personal site?
CITIZENDOT 24 hours ago [-]
sorry, i added it to set the mood for my site :') yk, like moving lamps at the top, hanging dementor at the right side (only visible on desktops).
should i remove it?
seanobannon 23 hours ago [-]
absolutely not! it is a delightful source of whimsy on an increasingly uniform web
Lammy 23 hours ago [-]
Middle ground: make it respect `prefers-reduced-motion` :)
projektfu 23 hours ago [-]
No, it's your playground. My podcast was talking about the music the guest was making and I thought he was playing something Potter related.
john_strinlai 23 hours ago [-]
>should i remove it?
there is no place for fun, whimsy, moods, or personalization on the web. sorry.
(no, at least not at the request of random internet stranger #10545346)
ChrisMarshallNY 23 hours ago [-]
Around here, many people have their sense of humor, removed, during their first colonoscopy.
I joke, anyway, and bear the downvotes. Totally worth it.
Quarrelsome 23 hours ago [-]
NEVER PURGE YOUR WHIMSY.
eightysixfour 23 hours ago [-]
No, it made me laugh.
dsmurrell 13 hours ago [-]
I liked it. I wondered where the music was coming from initially, but I liked it.
aftbit 23 hours ago [-]
I used developer tools to delete the dementor, then I muted the site when it started playing music.
Nah, keep it. It's your site and that's where you get to have fun!
ikistuach 23 hours ago [-]
yes
zombot 14 hours ago [-]
The post title really buries the lede.
> You don’t even have to run a git command, just opening this directory in VSCode is enough to get infected.
The old adage that Microslop and Security in the same sentence is a contradiction in terms still applies, now with a vengeance.
Never open 3rd-party stuff with VSCode.
zeratax 12 hours ago [-]
Okay but this is just not true here. VSCode always first asks you if you trust the author of this code and if not gives you the option to open the directory in restricted mode
pedrosousa 14 hours ago [-]
how to protect against something like this?
gus_ 13 hours ago [-]
1. restrict outbound connections by binary.
2. restrict outbound connections to known malicious IPs or domains.
3. run untrusted code/apps:
- under a different user
- or inside a sandbox
- or in a VM
4. remove exec permissions to temporary directories (/tmp, /var/tmp, /dev/shm)
HackerThemAll 11 hours ago [-]
Why isn't there a tool that would check those dangerous places, such as git hooks, VSCode and Claude commands that launch automatically, and warn the user of consequences, showing the hook code, allowing to allowlist this single repo if the user deem it secure? I'd say it should be a job of AV/EDR/XDR easily... Or a dedicated software with a highly protected service, and a tray/UI part.
ErroneousBosh 11 hours ago [-]
I don't understand why you'd just clone a random repo that someone tells you to like that.
If you want to hire me, I do not want to see your code until I see money from you.
I do not want your code on my computer until there is a contract and quite a lot of money in my account. Even then, I'd prefer you to keep your code on your computers, which I will connect to.
For a "take-home interview"? You want me to work for you for free? Nah. Pay me.
wslh 23 hours ago [-]
I assume an standard way to do this is through a VM provided by the recruiter, right?
simoneree 21 hours ago [-]
I don't think you should trust the recruiter's VM any more than their code. Spin up instead your own disposable VM or container with no creds or host mounts.
Clearly, judging by recent openai news, sandboxes are not unbreakable, but at least there's nothing worth stealing and you throw it away afterward.
wslh 21 hours ago [-]
I assume a VM that is running in the cloud will be enough. Not thinking about a local one.
CITIZENDOT 22 hours ago [-]
yea, i'm just lazy
JohnnyBlackRed 14 hours ago [-]
[dead]
syngrog66 19 hours ago [-]
I once received a suspiciously too good to be true job offer, and at the last minute they surprised me by insisting I use a specific laptop they insisted on mailing me. One they would possess prior to me, and "configure" as superuser, before giving to me to use while working for them.
I declined, as diplomatically as I could. I should not have to spell out in precise detail how dangerous to me their proposal was. In the eyes of an adversary/APT predator: ignorant --> naive --> gullible --> prey --> profit. Rinse, repeat, scale up.
claytonjy 19 hours ago [-]
Isn’t this how most tech companies, if not most companies in general, operate? Ive only had one BYOD job in 15 years. Even if you’re a contractor this is common.
CITIZENDOT 19 hours ago [-]
hmm, i don't understand why you think this is suspicious. doing their stuff on their machine is ... fine i guess?
fragmede 17 hours ago [-]
You'll have to spell it out for me the problem, because that seems entirely what a corporation with an actual IT department would do.
manarth 7 hours ago [-]
Perhaps logging into GitHub (without creating a separate "johndoe-mynewcorp" account)?
I'd need to see a number of red flags before interpreting a corporate laptop as an attack vector though.
And if it is an attack vector, hey, free laptop right? (OK, giving an adversary your home address is an issue, but not giving your employer your home address would be seen by the employer as an issue, so more of an impasse).
A few weeks ago, I had an interview with a CTO of a totally legit company. It was weird because he had disabled the camera, and the person had a strong accent. But everything else sounded like a normal screening interview, and the person definitely knew what he was talking about. At the end of the interview, he explained to me that during the technical interview I would need to make some modifications to their project (it's an OSS product), so he asked me to clone the repo and check the setup.
Later, the HR person said the CTO got sick, so the interview would be postponed. But a few days later, the HR profile was deleted from LinkedIn. It was super weird, but it didn't trigger my suspicion until I saw this post on HackNews. I checked, and the repo I was cloning and running during the interview had a malware payload.
P.S. I think it was a targeted attack because in the past I maintained a very popular NPM package with 43+M weekly downloads. That's my only explanation for why someone would carry out such a sophisticated social-engineering attack against me.
P.P.S. It's great that I have 2FA everywhere, and I always publish NPM packages manually without using tokens. But I need to wipe my laptop and reinstall everything.
I checked other similar threads on HN, but they don't mention an actual Google Meet call with a scammer.
Just give me the specification and I will build it end to end myself.
If you’re serious you would consider it. If you don’t - I dodged a bullet.
If you consider that people are using LLMs for code generation pretty much exclusively now this should be possible with any stack.
Though other stuff on your system might be less preventative, and that could run stuff in the repo folder. And I kinda wish git would force review of hooks and executable config everywhere before they're run - I would absolutely enable that, security is sometimes a bit annoying and that's inescapable.
Going to need containerised vscode in this world.
> I maintained a very popular NPM package with 43+M weekly downloads
makes sense why they targetted you, good that you have 2FA enabled.
Glad the scumbags didn’t get anything but your time.
Discord communities I am in for programming are similar. People show up and within a few days either ask for a job or suggest cooperation. Sure, you could argue these Discord people may actually be out of a job (in this economy, very likely), but the volume and similarity of the messages say otherwise. You can also tell people show up in... _weird places_ to ask for jobs. An example being the Discord community for a not-really-used Python library with ~0 actual activity - either this person is very bad at finding good places to jobhunt or some attacker is just crawling a list of Discord communities and attacking them all.
It's a shame but there are a _lot_ of attacks that abuse our trust in each other nowadays. A good reminder to, like mom and dad said, never trust strangers on the internet
Seems like this is becoming a recurring theme, similar story was on the front page last month.
https://news.ycombinator.com/item?id=48546294
If the victim is deep enough to check hook's content, it's unlikely they will just stop here losing suspicion. I'm sure most devs wouldn't think that doing `git commit` can be malicious (git security oversight?).
Executing downloaded code without prior review always is these days, regardless of the tool that does it.
Maybe they don't want to give any identifying info to the domain registrar? Or just minimizing their online presence?
Regardless, that's a pretty sneaky scam, and definitely something that caught out a ton of would be candidates in the past. What's more, the Visual Studio Code project mentioned in the article sounds even more horrifying. Like, the tool seriously lets you run custom code whenever someone opens your project? That feels like a really blatant malware vector that should probably have at least some sort of security mitigation...
It's also rather worrying how little these job sites are doing about scams like this too. I get it, it's perhaps a bit difficult to catch out all kinds of wrongdoing here. But you'd think it'd be simple enough to restrict accounts from claiming to be associated with a company or organisation if there's no proof they work there. At the moment, you can basically claim to work for any company you like, or that you have any type degree from any institution under the sun. If this was verified in any real way, and messages had a large warning at the top if the original claiming to be from an organisation wasn't confirmed to work there, a lot of scams would far more difficult to pull off.
http://www.catb.org/jargon/html/H/hacker.html
> 1. A person who enjoys exploring the details of programmable systems and how to stretch their capabilities, as opposed to most users, who prefer to learn only the minimum necessary. RFC1392, the Internet Users' Glossary, usefully amplifies this as: A person who delights in having an intimate understanding of the internal workings of a system, computers and computer networks in particular.
> 2. One who programs enthusiastically (even obsessively) or who enjoys programming rather than just theorizing about programming.
they added this back in 2023 (https://news.linkedin.com/2023/april/linkedin-s-new-verifica...), but very less people actually bother to verify with their email, so not having it doesn't always mean it's illegitimate.
I would imagine a lot of what went on then, is going on now with all the AI jobs and demand for people who have even a cursory knowledge of LLM's and automation.
I also try to talk to people at the company, but I mean employees I can verify independently, not whoever the recruiter puts in front of me. From the stories here, the person on the call can be the scammer, so a convincing conversation isn't proof on its own.
Looks like these folks really did their homework.
It's nasty, but I have to respect their skills. I'll bet it works, quite often.
I suspect it's clever, experienced, engineers, leveraging LLMs.
In my case it was a .vscode hook. Stay safe out there :)
It doesn't. VSCode dev replied here on it here: https://news.ycombinator.com/item?id=46719712.
But, I don't think anybody pays attention to the workspace trust. When ".vscode" has launch commands, it should rather say, "Trusting this workspace runs the following command on your behalf" or something similar.
Unrelated to this git pre commit hook attack but yeah
I stopped being surprised by new stuff I learn about an OS I've been using for 25+ and 10+ as my daily whip and just enjoy the discovery-buzz
these take-home interview nightmare stories are so common ... I'd hate to see a bad actor take advantage by offering a "service" to unsuspecting and underinformed folks like ... erm ... me
I'm not talking about switching to cold contacting companies as a job hunting strategy. I'm saying if you get a suspicious outreach from a rando on linked in on behalf of a company THEN you only continue if you can reach out to the same person via official company channels.
actual first party recruiter’s linkedin inbox is unusable full of candidates trying to take initiative, and there is no way to reach anyone from the company from the outside cold specifically to avoid that exact thing
I was asked quickly about my experienced and he shared that I was a perfect fit, immediatelly I was asked for my github username, then, I was asked to share my screen, I ended the call to not waste more time but my guess is that I would be asked to do something with the project live.
I haven't dig into their malware approach (yet) but this pattern is too frequent to easily recognize it.
Why not attack them through the C2 interface? That's where I'd expect them to slip up.
do you mean the machine which is connected through the victim's machine? if so, i should put this in a VM, run and see where it's sending/receiving requests from. i'll do that.
You can intentionally infect a machine with the malware but then watch the traffic between the victim node and the C2 server. If you get lucky, the C2 server assumes that the victim node is trusted and doesn't sanity check victim->server communication.
Note that this cranks up the danger quite a few notches, though it sounds like you know what you're doing.
Thankfully all my browsers are now configured to mute all sound from all sites until I grant express permission to play sound. Nips it in the bud, every time!
Give defenders a better shot…
LOL, is that shit being worked on by former Outlook developers, bringing with them their zero click bags of tricks?
should i remove it?
there is no place for fun, whimsy, moods, or personalization on the web. sorry.
(no, at least not at the request of random internet stranger #10545346)
I joke, anyway, and bear the downvotes. Totally worth it.
> You don’t even have to run a git command, just opening this directory in VSCode is enough to get infected.
The old adage that Microslop and Security in the same sentence is a contradiction in terms still applies, now with a vengeance.
Never open 3rd-party stuff with VSCode.
2. restrict outbound connections to known malicious IPs or domains.
3. run untrusted code/apps:
4. remove exec permissions to temporary directories (/tmp, /var/tmp, /dev/shm)If you want to hire me, I do not want to see your code until I see money from you.
I do not want your code on my computer until there is a contract and quite a lot of money in my account. Even then, I'd prefer you to keep your code on your computers, which I will connect to.
For a "take-home interview"? You want me to work for you for free? Nah. Pay me.
Clearly, judging by recent openai news, sandboxes are not unbreakable, but at least there's nothing worth stealing and you throw it away afterward.
I declined, as diplomatically as I could. I should not have to spell out in precise detail how dangerous to me their proposal was. In the eyes of an adversary/APT predator: ignorant --> naive --> gullible --> prey --> profit. Rinse, repeat, scale up.
I'd need to see a number of red flags before interpreting a corporate laptop as an attack vector though.
And if it is an attack vector, hey, free laptop right? (OK, giving an adversary your home address is an issue, but not giving your employer your home address would be seen by the employer as an issue, so more of an impasse).