Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I Inspected My Take-Home Interview Project. It Was a Whole Operation

citizendot.github.io

Post reply on HN
Print view View original

121–130 of 135 posts

Re: I Inspected My Take-Home Interview Project. It Was a Whole Operation

#121

Post by mtlynch »

CITIZENDOT wrote: post #83
mtlynch wrote: post #66

> Naturally, the next move was pivoting from defense to offense. I wanted to see if the attackers left any vulnerable services exposed on their IP. Why not attack them through the C2 interface? That's where I'd expect them to slip up.

> C2 interface do you mean the machine which is connected through the victim's machine? if so, i should put this in a VM, run and see where it's sending/receiving requests from. i'll do that.

Yeah, exactly. If there's a C2 server, there's some protocol for communication between the C2 server and each victim node.

You can intentionally infect a machine with the malware but then watch the traffic between the victim node and the C2 server. If you get lucky, the C2 server assumes that the victim node is trusted and doesn't sanity check victim->server communication.

Note that this cranks up the danger quite a few notches, though it sounds like you know what you're doing.

Re: I Inspected My Take-Home Interview Project. It Was a Whole Operation

#122

Post by electroglyph »

anal_reactor wrote: post #98
IvanGoncharov wrote: post #56

Wow, after reading this article, I figured out I was hacked, but with a way more sophisticated attack. A few weeks ago, I had an interview with a CTO of a totally legit company. It was weird because he had disabled the camera, and the person had a strong accent. But everything else sounded like a normal screening interview, and the person definitely knew what he was talking about. At the end of the interview, he expl…

It's so weird to me that I'm on same social media as people worthy of targeted attacks. Like, I'm a total nobody, all I get is "Free Spins For You!" and "I am a dying German billionaire...". My favorite email had a subject "Sorry I broke your vagina".

If it makes you feel any better, my apology was genuine.

Re: I Inspected My Take-Home Interview Project. It Was a Whole Operation

#123

Post by manarth »

Scaled wrote: post #117
CITIZENDOT wrote: post #58

Earlier quoted context omitted.

> I wonder if vscode would still load the script if you click “don’t trust author” It doesn't. VSCode dev replied here on it here: https://news.ycombinator.com/item?id=46719712 . But, I don't think anybody pays attention to the workspace trust. When ".vscode" has launch commands, it should rather say, "Trusting this workspace runs the following command on your behalf" or something similar.

Yeah, I had no idea Microsoft thinks trust means auto run immediately a script. I always just thought it was something more pedestrian, like restricting debug launch links or something. I will probably not use vs code at all for untrusted repos now.

  > "I will probably not use vs code at all for untrusted repos now"
The meaning of "Trust" is pretty unambiguous. If you're clicking "Trust this" for a repository you don't trust, I'm not sure that switching IDEs is going to help you much.

Re: I Inspected My Take-Home Interview Project. It Was a Whole Operation

#124

Post by NetOpWibby »

IvanGoncharov wrote: post #56

Wow, after reading this article, I figured out I was hacked, but with a way more sophisticated attack. A few weeks ago, I had an interview with a CTO of a totally legit company. It was weird because he had disabled the camera, and the person had a strong accent. But everything else sounded like a normal screening interview, and the person definitely knew what he was talking about. At the end of the interview, he expl…

2FA FTW!

Glad the scumbags didn’t get anything but your time.

Re: I Inspected My Take-Home Interview Project. It Was a Whole Operation

#125

Post by manarth »

fragmede wrote: post #88
syngrog66 wrote: post #74

I once received a suspiciously too good to be true job offer, and at the last minute they surprised me by insisting I use a specific laptop they insisted on mailing me. One they would possess prior to me, and "configure" as superuser, before giving to me to use while working for them. I declined, as diplomatically as I could. I should not have to spell out in precise detail how dangerous to me their proposal was. In…

You'll have to spell it out for me the problem, because that seems entirely what a corporation with an actual IT department would do.

Perhaps logging into GitHub (without creating a separate "johndoe-mynewcorp" account)?

I'd need to see a number of red flags before interpreting a corporate laptop as an attack vector though.

And if it is an attack vector, hey, free laptop right? (OK, giving an adversary your home address is an issue, but not giving your employer your home address would be seen by the employer as an issue, so more of an impasse).

Re: I Inspected My Take-Home Interview Project. It Was a Whole Operation

#126

Post by zeratax »

hyperhello wrote: post #114
zeratax wrote: post #111

Earlier quoted context omitted.

I feel like vscode is doing everything right here and they cant really do much about users choosing to ignore security warnings. Other IDEs here do exactly the same or less. Not saying there isn't room to improve, but again if you're uninstalling vscode what are you going to replace it with?

Hiding malicious behavior behind security warnings you can only click yes or no to is the Microsoft way of neatly denying responsibility, and it compounds and reinforces itself. This pdf looks like a pdf, acts like a pdf, opens like a pdf, what are you going to do? You clicked OK so you wanted that Outlook virus to email itself to everyone on your address book and send their bitcoin to Madagascar, not Microsoft.

what is the alternative here? never ever running git hooks, lsps etc. all of these are vulnerable. and again no other ide here has a better solution.

Re: I Inspected My Take-Home Interview Project. It Was a Whole Operation

#127

Post by anal_reactor »

electroglyph wrote: post #122
anal_reactor wrote: post #98

Earlier quoted context omitted.

It's so weird to me that I'm on same social media as people worthy of targeted attacks. Like, I'm a total nobody, all I get is "Free Spins For You!" and "I am a dying German billionaire...". My favorite email had a subject "Sorry I broke your vagina".

If it makes you feel any better, my apology was genuine.

It's okay, I can still repurpose it and make a handbag.

Re: I Inspected My Take-Home Interview Project. It Was a Whole Operation

#128

Post by bdavbdav »

lathiat wrote: post #67
IvanGoncharov wrote: post #56

Wow, after reading this article, I figured out I was hacked, but with a way more sophisticated attack. A few weeks ago, I had an interview with a CTO of a totally legit company. It was weird because he had disabled the camera, and the person had a strong accent. But everything else sounded like a normal screening interview, and the person definitely knew what he was talking about. At the end of the interview, he expl…

Yikes. Going to need containerised vscode in this world.

DevContainers works great

Re: I Inspected My Take-Home Interview Project. It Was a Whole Operation

#129

Post by aykutulis »

Most of the time I don't pull external sources (a repo, files, etc.) onto my laptop. Maybe I've passed up some opportunities, but every company that hired me never asked me to install anything: they either used a known live-coding platform, or shared their private repo read-only so I could look without pulling it and then create my own repo to share back.

I also try to talk to people at the company, but I mean employees I can verify independently, not whoever the recruiter puts in front of me. From the stories here, the person on the call can be the scammer, so a convincing conversation isn't proof on its own.

Re: I Inspected My Take-Home Interview Project. It Was a Whole Operation

#130

Post by GitPushOrigin »

petterroea wrote: post #79

Recently there seems to be an uptick in North-Korean attacks against developers. In addition to this type of attack, which has been going on for years, I recently get ~1 email a week from North Korean hackers. It's always a "Hello, I found your profile, want to collaborate?" e-mail. Discord communities I am in for programming are similar. People show up and within a few days either ask for a job or suggest cooperatio…

And they're using LLMs, which are convincing enough from a basic conversational standpoint to prevent being immediately filtered as a bot as easily as in the past.
Post reply on HN