[dead]
I Inspected My Take-Home Interview Project. It Was a Whole Operation
101–110 of 135 posts
Re: I Inspected My Take-Home Interview Project. It Was a Whole Operation
#102> Why use a raw IP address? If anything, this screams “malware.” If the victim is deep enough to check hook's content, it's unlikely they will just stop here losing suspicion. I'm sure most devs wouldn't think that doing `git commit` can be malicious (git security oversight?).
> git security oversight?
Executing downloaded code without prior review always is these days, regardless of the tool that does it.
Re: I Inspected My Take-Home Interview Project. It Was a Whole Operation
#103[deleted]
Re: I Inspected My Take-Home Interview Project. It Was a Whole Operation
#104how to protect against something like this?
Re: I Inspected My Take-Home Interview Project. It Was a Whole Operation
#105Ok, how do I disable git hooks unless it’s in a manually blessed directory?
git config --global core.hooksPath /dev/null
git config core.hooksPath "$PWD/.git/hooks"
Re: I Inspected My Take-Home Interview Project. It Was a Whole Operation
#106how to protect against something like this?
1. restrict outbound connections by binary.
2. restrict outbound connections to known malicious IPs or domains.
3. run untrusted code/apps:
- under a different user
- or inside a sandbox
- or in a VM
Re: I Inspected My Take-Home Interview Project. It Was a Whole Operation
#107Bruh the harry potter theme song scared the shit out of me as it turned itself on. Bad UX for a personal site. Great article btw !
sorry, i added it to set the mood for my site :') yk, like moving lamps at the top, hanging dementor at the right side (only visible on desktops). should i remove it?
I liked it. I wondered where the music was coming from initially, but I liked it.
Re: I Inspected My Take-Home Interview Project. It Was a Whole Operation
#108> You don’t even have to run a git command, just opening this directory in VSCode is enough to get infected.
LOL, is that shit being worked on by former Outlook developers, bringing with them their zero click bags of tricks?
Re: I Inspected My Take-Home Interview Project. It Was a Whole Operation
#109I checked for a way to globally disable git hooks. There is no built-in way of doing this.
git config --global core.hooksPath /dev/nullRe: I Inspected My Take-Home Interview Project. It Was a Whole Operation
#110> Why use a raw IP address? If anything, this screams “malware.” If the victim is deep enough to check hook's content, it's unlikely they will just stop here losing suspicion. I'm sure most devs wouldn't think that doing `git commit` can be malicious (git security oversight?).
if you just clone a repo no githooks are every automatically enabled. but since this was downloaded not cloned it's a different story