Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A backdoor in a LinkedIn job offer

roman.pt

Post reply on HN
Print view View original

261–270 of 331 posts

Re: A backdoor in a LinkedIn job offer

#261

Post by berkes »

throwawayffffas wrote: post #259

Hm, the url returns a png. Did he obscure the actual url? Couldn't get it to send me json or js... Update: found a clone of the repo on github and got the payload, all you have to do is add a header `bearrtoken: logo` It's obfuscated, I will feed it to qwen to see what can be gleaned.

Same here.

I tried content-types, user-agent, but no luck. I'm not sure what the user-agent of `req` is, but the default `node-fetch/1.0` does make the response json. They are a 307, but the result is a png.

I presume the original payload may have contained information that the hackers want to keep from prying eyes. Esp. now that it landed on HN, it makes sense to take it offline and replace with an actual png to avoid people finding information in it that may harm their future hacks or so?

Re: A backdoor in a LinkedIn job offer

#262

Post by vidarh »

ionwake wrote: post #254

Im not sure if anyone will read this, but I consider myself pretty savvy having been on the internet over decades however I nearly succumbed to a highly complex Linkedin "Interview with video call just to get me to install malware". It was the most bizarely long roundabout way to get me to isntall malware I had ever witnessed I couldnt fathom it was real, I mean they interviewed me for half an hour. Now you might thi…

Yeah, the camera off thing has happened to me too, and it should be a red flag to anyone if an interview situation.

Re: A backdoor in a LinkedIn job offer

#263

Post by throwawayffffas »

berkes wrote: post #261
throwawayffffas wrote: post #259

Hm, the url returns a png. Did he obscure the actual url? Couldn't get it to send me json or js... Update: found a clone of the repo on github and got the payload, all you have to do is add a header `bearrtoken: logo` It's obfuscated, I will feed it to qwen to see what can be gleaned.

Same here. I tried content-types, user-agent, but no luck. I'm not sure what the user-agent of `req` is, but the default `node-fetch/1.0` does make the response json. They are a 307, but the result is a png. I presume the original payload may have contained information that the hackers want to keep from prying eyes. Esp. now that it landed on HN, it makes sense to take it offline and replace with an actual png to avo…

Got it after adding the header: `bearrtoken: logo`.

Without seeing the request code I initially assumed it would be `Authorization: Bearer logo` that did the trick.

Re: A backdoor in a LinkedIn job offer

#264

Post by vidarh »

dantodor wrote: post #139

Been through this 3 times in the last 6 months. They're getting better. Very credible LI profiles, code looks OK if you only take a glance... The bell start ringing when they insist you to run locally their sh*t

The big red flag should be giving github access before signing any contracts.

Re: A backdoor in a LinkedIn job offer

#265

Post by berkes »

jmward01 wrote: post #8

So, this is a crime right? Why isn't there a well known '911' for cybercrime to report things like this to and get help? Society needs to catch up with the actual dangers out there and build support networks for this ASAP. This is organized crime and needs organized defense to deal with it.

In the Netherlands there's an official government agency that allows a simple mail or report: https://www.ncsc.nl/en/report-an-incident-to-ncsc-nl

I presume more countries have this, not sure about the US though (CISA maybe? CERT/CC?). CERT is the overarching org that manages local agencies like this Dutch NCSC. Though I am not sure if and how easy it is, globally, to report incidents.

Re: A backdoor in a LinkedIn job offer

#266

Post by dakolli »

SauntSolaire wrote: post #82
dakolli wrote: post #68

Earlier quoted context omitted.

[flagged]

> simply for being one of the last communist countries Well, that plus their 50 nuclear warheads and continued ICBM development, amongst other things.

We have what, 2500 of them, and we threaten them with them... Wouldn't you? Iran deserves them too.

Re: A backdoor in a LinkedIn job offer

#268

Post by jaapz »

HelloNurse wrote: post #222
freeopinion wrote: post #174

Earlier quoted context omitted.

You mean @fooco.com? Or @foocousa.com? Or @fooco.xyz? @fooco.ai? @foocoltd.net? @foo.co.uk? How would LinkedIn validate that your email domain belongs to the company you claim to work for?

With a company-managed list of owned domains where real employees have their work email addresses (unrelated to website domains).

And using DNS to prove that a domain is actually owned by this organization
Post reply on HN