Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We identified a North Korean hacker who tried to get a job

blog.kraken.com

Post reply on HN
Print view View original

71–80 of 309 posts

Re: We identified a North Korean hacker who tried to get a job

#71

Post by kelseyfrog »

klodolph wrote: post #48
kelseyfrog wrote: post #42

Earlier quoted context omitted.

If this harms the crypto industry even a little I'm not sure I'd feel even a twinge of sympathy. Is there anything I can do to assist NK in these affairs?

“These people (crypto industry) are bad people so it is justified to ignore the rule of law when hurting them” is a classic bad take. What you can do is regulate crypto into oblivion and make people feel bad about working in crypto. If you assist NK, then you’re hurting crypto but you’re funding NK operations (e.g. NK soldiers assisting Russia against Ukraine).

If I don't assist NK then I'm tacitly assisting the crypto industry. We're in trolley problem territory now.

Re: We identified a North Korean hacker who tried to get a job

#72

Post by tinktank »

donnachangstein wrote: post #4

They used their leet "OSINT" skillz to ask the most basic of questions and background checks that nearly any traditional interview process would immediately uncover, then think it's so novel it's worthy of a blog post. On the surface it seems the "security" industry is lacking in the most basic of security processes when hiring. I don't think I've ever worked anywhere that could accidentally hire a North Korean witho…

Why the condescending negativity? What would you they rather have done instead?

Re: We identified a North Korean hacker who tried to get a job

#73

Post by arduanika »

Dachande663 wrote: post #3

From somewhere in the depths of an old reddit thread, someone recommended asking candidates "How fat is Kim Jong Un?" Instant hang-up.

In the depths of an old reddit thread, OR in a different thread that happens to appear today, alongside this one, on HN front page!

https://news.ycombinator.com/item?id=43853382

Re: We identified a North Korean hacker who tried to get a job

#76

Post by corytheboyd »

noitpmeder wrote: post #46
corytheboyd wrote: post #24

Earlier quoted context omitted.

How do weekly 1:1 meetings with a manager not catch this very quickly? Okay, maybe the original suave interviewer comes back for those… Still feels like a good EM would pick up on discrepancies between work done and how the suave person talks about it. It depresses me, but you’re probably right about in-office work being the only guarantee against this type of scam. I wish we could just have nice things.

This isn't necessarily the issue here -- this attempt seemed to be fairly motivated and had access to resources (AI, coaches, ...) to help them get through the process. IF they can get such a 'candidate' hired... whats to say they couldn't continue the sham. One could imagine a team of hackers could easily pass of work that a single IC could reasonably have produced. If their goal is exfiltration (or some other hack)…

Yeah, that feels more right, and feels like a problem that is only going to get worse.

Re: We identified a North Korean hacker who tried to get a job

#77

Post by stackedinserter »

I would hire this person, set up a very basic work environment, forced him to run a spyware, learn something about them and made more interesting blogpost.

Actually, that's a job for counter-intelligence agencies (NSA? RCMP?), but I guess they will just laugh you call them.

Re: We identified a North Korean hacker who tried to get a job

#79

Post by criddell »

beezlebroxxxxxx wrote: post #19
Multiplayer wrote: post #7

Here's a heretical thought: Remote hiring is a massive achilles heel. I've been duped simply by hiring a great engineering candidate who then farmed out the actual work to remote workers in Pakistan and India. We caught on fairly quickly thanks to one of them forgetting to login to one of our backend systems via vpn a few times. No idea how many companies he was "working for" but I'd bet we were one of many. Remote w…

I've heard through the grapevine of some designers (one who worked at Shopify) getting caught using Fiverr (or something similar) to farm out all of their work. Despite all the weird crazy dog and pony show and jumping through hoops that most companies do now, most companies are abysmal at hiring.

What can you do during the hiring process to know that this amazing person, who aces every part of the interview, will farm out their work to cheap subcontractors?
Post reply on HN