81–90 of 135 posts
Hmm, did anyone else have issues loading the screenshots here? I had to open most of them in a new tab to see them. Regardless, that's a pretty sneaky scam, and definitely something that caught out a ton of would be candidates in the past. What's more, the Visual Studio Code project mentioned in the article sounds even more horrifying. Like, the tool seriously lets you run custom code whenever someone opens your proj…
> Naturally, the next move was pivoting from defense to offense. I wanted to see if the attackers left any vulnerable services exposed on their IP. Why not attack them through the C2 interface? That's where I'd expect them to slip up.
do you mean the machine which is connected through the victim's machine? if so, i should put this in a VM, run and see where it's sending/receiving requests from. i'll do that.
That was a fun read, I wonder if vscode would still load the script if you click “don’t trust author”? That being said, can you embed something yourself and push the commit?
> I wonder if vscode would still load the script if you click “don’t trust author” It doesn't. VSCode dev replied here on it here: https://news.ycombinator.com/item?id=46719712 . But, I don't think anybody pays attention to the workspace trust. When ".vscode" has launch commands, it should rather say, "Trusting this workspace runs the following command on your behalf" or something similar.
> Side note: Why use a raw IP address? If anything, this screams “malware.” At least register a decoy domain like lint-checker.com or jenkins-ci-runner.net. If the threat actors who wrote this are reading: take notes people! Maybe they don't want to give any identifying info to the domain registrar? Or just minimizing their online presence?
Or possibly these hosts fell victims of their malware, too, and see now used as proxies.
Hmm, did anyone else have issues loading the screenshots here? I had to open most of them in a new tab to see them. Regardless, that's a pretty sneaky scam, and definitely something that caught out a ton of would be candidates in the past. What's more, the Visual Studio Code project mentioned in the article sounds even more horrifying. Like, the tool seriously lets you run custom code whenever someone opens your proj…
Earlier quoted context omitted.
it was in this moment, that gtowey’s outdated job solutions transitioned them from unc to boomer
I think you misunderstood. I'm not talking about switching to cold contacting companies as a job hunting strategy. I'm saying if you get a suspicious outreach from a rando on linked in on behalf of a company THEN you only continue if you can reach out to the same person via official company channels.
actual first party recruiter’s linkedin inbox is unusable full of candidates trying to take initiative, and there is no way to reach anyone from the company from the outside cold specifically to avoid that exact thing
I once received a suspiciously too good to be true job offer, and at the last minute they surprised me by insisting I use a specific laptop they insisted on mailing me. One they would possess prior to me, and "configure" as superuser, before giving to me to use while working for them. I declined, as diplomatically as I could. I should not have to spell out in precise detail how dangerous to me their proposal was. In…
Wow, after reading this article, I figured out I was hacked, but with a way more sophisticated attack. A few weeks ago, I had an interview with a CTO of a totally legit company. It was weird because he had disabled the camera, and the person had a strong accent. But everything else sounded like a normal screening interview, and the person definitely knew what he was talking about. At the end of the interview, he expl…
Yeah, I refuse to just clone random projects. Luckily, I’m a rails developer - and scaffolding entire applications takes literally minutes. Just give me the specification and I will build it end to end myself. If you’re serious you would consider it. If you don’t - I dodged a bullet. If you consider that people are using LLMs for code generation pretty much exclusively now this should be possible with any stack.
Though other stuff on your system might be less preventative, and that could run stuff in the repo folder. And I kinda wish git would force review of hooks and executable config everywhere before they're run - I would absolutely enable that, security is sometimes a bit annoying and that's inescapable.
TIL about tree ... I stopped being surprised by new stuff I learn about an OS I've been using for 25+ and 10+ as my daily whip and just enjoy the discovery-buzz these take-home interview nightmare stories are so common ... I'd hate to see a bad actor take advantage by offering a "service" to unsuspecting and underinformed folks like ... erm ... me