I checked for a way to globally disable git hooks. There is no built-in way of doing this.
Hooks are not checked in to the repo, so they used a zip archive.
I Inspected My Take-Home Interview Project. It Was a Whole Operation
91–100 of 135 posts
Re: I Inspected My Take-Home Interview Project. It Was a Whole Operation
#92TIL about tree ... I stopped being surprised by new stuff I learn about an OS I've been using for 25+ and 10+ as my daily whip and just enjoy the discovery-buzz these take-home interview nightmare stories are so common ... I'd hate to see a bad actor take advantage by offering a "service" to unsuspecting and underinformed folks like ... erm ... me
One of those programs that shoulda been in coreutils
Re: I Inspected My Take-Home Interview Project. It Was a Whole Operation
#93Unfortunately this is becoming common, it happened to me today, I was suspicious at first but when they guy showed his face (first time, I guess this was a mistake) in the meet I started trusting them, suddenly their interted started failing and he suggested we both turn the camera off.
I was asked quickly about my experienced and he shared that I was a perfect fit, immediatelly I was asked for my github username, then, I was asked to share my screen, I ended the call to not waste more time but my guess is that I would be asked to do something with the project live.
I haven't dig into their malware approach (yet) but this pattern is too frequent to easily recognize it.
Re: I Inspected My Take-Home Interview Project. It Was a Whole Operation
#94Wow, after reading this article, I figured out I was hacked, but with a way more sophisticated attack. A few weeks ago, I had an interview with a CTO of a totally legit company. It was weird because he had disabled the camera, and the person had a strong accent. But everything else sounded like a normal screening interview, and the person definitely knew what he was talking about. At the end of the interview, he expl…
Sorry but not using a devpod or a vm for that in this age is just irresponsible. A random npm package can already do a lot of damage.
Re: I Inspected My Take-Home Interview Project. It Was a Whole Operation
#95always a good day when we get an a post on front actually related to hacking on hackernews.
[dead]
Re: I Inspected My Take-Home Interview Project. It Was a Whole Operation
#96Posted about this back in May:
https://blog.denv.it/posts/i-was-likely-targeted-by-dprk-in-...
In my case it was a .vscode hook. Stay safe out there :)
Re: I Inspected My Take-Home Interview Project. It Was a Whole Operation
#97Earlier quoted context omitted.
Yeah, I refuse to just clone random projects. Luckily, I’m a rails developer - and scaffolding entire applications takes literally minutes. Just give me the specification and I will build it end to end myself. If you’re serious you would consider it. If you don’t - I dodged a bullet. If you consider that people are using LLMs for code generation pretty much exclusively now this should be possible with any stack.
Cloning should be fine on its own - git hooks aren't installable automatically, for reasons like this, and they treat anything that makes cloning unsafe as a pretty severe security issue so new discoveries get plugged quickly. This post's malware is possible because it's from a general archive, not a clone. Though other stuff on your system might be less preventative, and that could run stuff in the repo folder. And…
It's not the cloning that gets you. It's the inevitable step of running whatever you cloned to "run the tests" or "see how it works".
Re: I Inspected My Take-Home Interview Project. It Was a Whole Operation
#98Wow, after reading this article, I figured out I was hacked, but with a way more sophisticated attack. A few weeks ago, I had an interview with a CTO of a totally legit company. It was weird because he had disabled the camera, and the person had a strong accent. But everything else sounded like a normal screening interview, and the person definitely knew what he was talking about. At the end of the interview, he expl…
It's so weird to me that I'm on same social media as people worthy of targeted attacks. Like, I'm a total nobody, all I get is "Free Spins For You!" and "I am a dying German billionaire...". My favorite email had a subject "Sorry I broke your vagina".
Re: I Inspected My Take-Home Interview Project. It Was a Whole Operation
#99Ok, how do I disable git hooks unless it’s in a manually blessed directory?
Re: I Inspected My Take-Home Interview Project. It Was a Whole Operation
#100The post title really buries the lede.
> You don’t even have to run a git command, just opening this directory in VSCode is enough to get infected.
The old adage that Microslop and Security in the same sentence is a contradiction in terms still applies, now with a vengeance.
Never open 3rd-party stuff with VSCode.