Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A backdoor in a LinkedIn job offer

roman.pt

Post reply on HN
Print view View original

121–130 of 331 posts

Re: A backdoor in a LinkedIn job offer

#121

Post by quietsegfault »

wxw wrote: post #16

> a recruiter at a small crypto startup [...] she described a broken proof-of-concept they needed a lead engineer for, and then sent me a public GitHub repo to review. Specifically, she asked me to “check out the deprecated Node modules issue.” > ...buried between walls of commented-out tests, the payload runs anything the server sends back to your machine. > npm runs prepare automatically after npm install, so just…

I recently went through an interview—o-thon and got a couple obvious scammers. I hope it’s because it’s more prevalent, and not because I seem stupid enough to fall for it!

Re: A backdoor in a LinkedIn job offer

#122

Post by 0xpgm »

BobAliceInATree wrote: post #37

> I reported the repo to GitHub and the recruiter to LinkedIn. So far nothing has changed and the code is still up. Oh, Microsoft.

Weird, isn't it? Microsoft owns all of LinkedIn, Github and NPM.

All three either have security or stability issues, which seems to get worse, not better, as microsoft goes more into AI. Where is the AI productivity (10x by some accounts!) within the company going to?

Re: A backdoor in a LinkedIn job offer

#123

Post by lazide »

bit-anarchist wrote: post #120
underlipton wrote: post #86

Earlier quoted context omitted.

>I finally got it solved by buying drinks for a buddy of mine that works for LinkedIn I'd like people to understand that this is a form of corruption. We've normalized many like it. LI knows that the only way to force them to fix the issue is to go through a drawn-out legal process, save a spate of bad press (RIP 60 Minutes), so of course they won't.

[flagged]

Bwahaha, no it doesn’t.

Legally ‘corruption’ doesn’t exist, as in there is no single law saying ‘corruption is illegal’. (What is ‘corruption’ exactly?)

There are laws against bribery, which does generally only apply to the government, but in many locations applies to pseudo-government roles like notaries, apostiloes, lawyers, etc.

There are laws against embezzlement (a type of corruption), and those definitely apply to private individuals.

There are laws against insider trading, a type of corruption. Those generally only apply to businesses/private folks, not the government, with some exceptions.

Then there is the various kinds of fraud, blackmail, etc. Most people would consider them corruption too. Those apply to private individuals and government agents too.

And many more. It’s a smorgasbord.

Re: A backdoor in a LinkedIn job offer

#124

Post by jamesfinlayson »

pants2 wrote: post #90
sensanaty wrote: post #67

Earlier quoted context omitted.

My last 2 companies, LinkedIn asked me to add an email address associated with the said company and actually confirm via said email in order to add them to my profile. So, if I worked for FooCompany, I had to have a @FooCompany.com email which is setup by someone at the company itself. Does this not cover what you're talking about?

According to my research, LinkedIn only does this for executive and now recruiter-like titles, but not broadly. You may be able to in order to get "verified on LinkedIn" but it's not a requirement for showing association with a company. https://www.theverge.com/news/771210/linkedin-recruiter-exec...

I'm bottom of the ladder but have seeing the option to do it for at least a year.

Re: A backdoor in a LinkedIn job offer

#126

Post by ChrisMarshallNY »

pants2 wrote: post #56
wxw wrote: post #16

> a recruiter at a small crypto startup [...] she described a broken proof-of-concept they needed a lead engineer for, and then sent me a public GitHub repo to review. Specifically, she asked me to “check out the deprecated Node modules issue.” > ...buried between walls of commented-out tests, the payload runs anything the server sends back to your machine. > npm runs prepare automatically after npm install, so just…

LinkedIn offers no way for $company to disavow users who claim to work for $company - they will appear on the official company page as long as it's in their profile. We've had fake recruiters that claim to work for us running basically the same scam. These are great fake profiles: LinkedIn Premium, tons of relevant posts, etc... but they don't work for us, and we get angry messages from people saying our recruiter tr…

> LinkedIn offers no way for $company to disavow users who claim to work for $company - they will appear on the official company page as long as it's in their profile.

I remember getting an office manager, working from Dubai (I think), for my one-person, basically nonexistent company, working from my living room, in New York.

She may still be there. I never bother checking into LI, except making an occasional post, every few months.

Re: A backdoor in a LinkedIn job offer

#127

Post by cbm-vic-20 »

pants2 wrote: post #56
wxw wrote: post #16

> a recruiter at a small crypto startup [...] she described a broken proof-of-concept they needed a lead engineer for, and then sent me a public GitHub repo to review. Specifically, she asked me to “check out the deprecated Node modules issue.” > ...buried between walls of commented-out tests, the payload runs anything the server sends back to your machine. > npm runs prepare automatically after npm install, so just…

LinkedIn offers no way for $company to disavow users who claim to work for $company - they will appear on the official company page as long as it's in their profile. We've had fake recruiters that claim to work for us running basically the same scam. These are great fake profiles: LinkedIn Premium, tons of relevant posts, etc... but they don't work for us, and we get angry messages from people saying our recruiter tr…

I was looking for people who I had worked with at a company that was acquired 15 years ago, and some random person claims to be the CEO of that company.

Re: A backdoor in a LinkedIn job offer

#128

Post by evilduck »

sheept wrote: post #98
afpx wrote: post #51

Earlier quoted context omitted.

Github / Microsoft could easily fix this, couldn't they? Leaving NPM up in its current state seems criminal, especially since LLMs generate NPM commands so frequently.

Is it possible to fix it in a backwards compatible way? Removing lifecycle scripts is at least a semver major change, and would complicate existing projects relying on packages with lifecycle scripts from upgrading.

This is a real world trolley problem scenario. You can break workflows or you can let everyone get pwned by supply chain attacks. Which is the greater harm?

Re: A backdoor in a LinkedIn job offer

#129

Post by schrodinger »

0x20cowboy wrote: post #100
gleenn wrote: post #32

Earlier quoted context omitted.

Friends don't let friends use NPM. At this point it is so wildly crazy watching people get owned, I don't understand how anyone uses it when they could use e.g. PNMPM and block one if the most obvious and frequently exploited holes. These tools with arbitrary code execution when trying to download some code have got to stop. Edit: typos

I agree, but I’d extend that to any language using a package manager at this point. “A little copying is better than a little dependency” even more correct now. All my current projects have all the code needed in the repo (unless impossible, and aside from a compiler which I guess could also be compromised)

IYKYK

Re: A backdoor in a LinkedIn job offer

#130

Post by blindriver »

LinkedIn is a cesspool of scams now.

They know there's a high degree of fraud and they don't do anything about it. They don't care.

I've gotten tricked into sending my resume and talking on the phone with legitimate looking recruiters from Google, Netflix, Meta, OpenAI, Anthropic, etc, but LinkedIn does nothing about it.

Post reply on HN