Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A backdoor in a LinkedIn job offer

roman.pt

Post reply on HN
Print view View original

51–60 of 331 posts

Re: A backdoor in a LinkedIn job offer

#51

Post by afpx »

gleenn wrote: post #32
wxw wrote: post #16

> a recruiter at a small crypto startup [...] she described a broken proof-of-concept they needed a lead engineer for, and then sent me a public GitHub repo to review. Specifically, she asked me to “check out the deprecated Node modules issue.” > ...buried between walls of commented-out tests, the payload runs anything the server sends back to your machine. > npm runs prepare automatically after npm install, so just…

Friends don't let friends use NPM. At this point it is so wildly crazy watching people get owned, I don't understand how anyone uses it when they could use e.g. PNMPM and block one if the most obvious and frequently exploited holes. These tools with arbitrary code execution when trying to download some code have got to stop. Edit: typos

Github / Microsoft could easily fix this, couldn't they? Leaving NPM up in its current state seems criminal, especially since LLMs generate NPM commands so frequently.

Re: A backdoor in a LinkedIn job offer

#52

Post by john_strinlai »

Diti wrote: post #33
john_strinlai wrote: post #17

Earlier quoted context omitted.

the main issue is that we lack a global '911'. secondary is the effort asymmetry between spinning up one of these scams (near 0 effort) and catching/prosecuting these scams (big effort, astronomical cost)

> the main issue is that we lack a global '911'. 911 is for emergencies. I don’t think the global 911 service would give any attention to a LinkedIn scam.

i used the same terminology as the parent, and i think we all know what is meant by it

Re: A backdoor in a LinkedIn job offer

#53

Post by firefax »

Xirdus wrote: post #44
bityard wrote: post #20

Earlier quoted context omitted.

To put it bluntly and perhaps a bit cynically, on the tree of bad things that people do to other people, this is pretty high-hanging fruit. Right up there next to scam phone calls that prey on the elderly while claiming to be from Microsoft support. It's basically impossible to catch suspects because they are either smart enough to cover their tracks very well, or (more often) live in countries whose governments don'…

Hard disagree on the scam phone calls. It would be trivial to eradicate them almost completely if the phone operators did the bare minimum to fight against it. At any point in time, any given US phone number is handled by exactly one phone carrier. There is nothing stopping that carrier from requiring name and address to issue that phone number. They already do for 99.99% of their legitimate customers. It would be ve…

>It would be trivial to eradicate them almost completely

Absolutely true, but droning their data centers might have some policy repercussions.

Re: A backdoor in a LinkedIn job offer

#55

Post by john_strinlai »

pocksuppet wrote: post #50
john_strinlai wrote: post #17

Earlier quoted context omitted.

the main issue is that we lack a global '911'. secondary is the effort asymmetry between spinning up one of these scams (near 0 effort) and catching/prosecuting these scams (big effort, astronomical cost)

what about the outcome asymmetry between spinning up one of these scams (get one guy's computer) and getting caught (jail for life)

you arent getting jail for life for this, even in the extremely remote chance you are caught. you are probably getting more than one guy's computer, though.

Re: A backdoor in a LinkedIn job offer

#56

Post by pants2 »

wxw wrote: post #16

> a recruiter at a small crypto startup [...] she described a broken proof-of-concept they needed a lead engineer for, and then sent me a public GitHub repo to review. Specifically, she asked me to “check out the deprecated Node modules issue.” > ...buried between walls of commented-out tests, the payload runs anything the server sends back to your machine. > npm runs prepare automatically after npm install, so just…

LinkedIn offers no way for $company to disavow users who claim to work for $company - they will appear on the official company page as long as it's in their profile.

We've had fake recruiters that claim to work for us running basically the same scam. These are great fake profiles: LinkedIn Premium, tons of relevant posts, etc... but they don't work for us, and we get angry messages from people saying our recruiter tried to scam them. No, they're not our recruiter despite showing up on our company page on LinkedIn. No number of reports could get them taken down.

I finally got it solved by buying drinks for a buddy of mine that works for LinkedIn, but not all startups have that connection!

Re: A backdoor in a LinkedIn job offer

#57

Post by mhitza »

wxw wrote: post #16

> a recruiter at a small crypto startup [...] she described a broken proof-of-concept they needed a lead engineer for, and then sent me a public GitHub repo to review. Specifically, she asked me to “check out the deprecated Node modules issue.” > ...buried between walls of commented-out tests, the payload runs anything the server sends back to your machine. > npm runs prepare automatically after npm install, so just…

Things like this where a tried and tested method on Upwork, particularly in the 2021-2022 crypto/nft highs. At some point they branched out from crypto projects and cast a wide net across different categories.

Last I recall was a download of a windows scr (screensaver masquerading) file.

Linkedin is a new low, and I'm sure the platform doesn't really care (look, more jobs), just as ad network companies (Google, Meta) don't really care about scam ads.

Re: A backdoor in a LinkedIn job offer

#58

Post by zuzululu »

I'm working 3 remote jobs right now and I can tell you guys to really watch out.

Often they are not malicious, just unsavory business practice where they want free consulting with no intention of hiring you. Another tell is the person is quick to jump to a take home screening project and they are quite good at getting at engineers heads that "leetcode is outdated/they dont believe in it" and whatever they want you to hear.

They know engineers are desperate for jobs right now and if you don't have a backbone they will exploit it.

I am much wiser now that I work multiple salary jobs remotely I realize these 3 golden rules:

- Don't stay loyal to your employers.

- Don't stay honest to those don't value it.

- Don't stay complacent always innovate.

Re: A backdoor in a LinkedIn job offer

#60

Post by f055 »

I used to get 2-3 shady crypto offers per week on LinkedIn. It stopped when I started replying with AI generated responses demanding multiple verification steps: official email, official offer link, terms and scope etc. And a note with a firm refusal to run any code or install any package on my machine for "recruitment tasks".
Post reply on HN