Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We identified a North Korean hacker who tried to get a job

blog.kraken.com

Post reply on HN
Print view View original

181–190 of 309 posts

Re: We identified a North Korean hacker who tried to get a job

#181

Post by tough »

eunos wrote: post #172
ta1243 wrote: post #37

Earlier quoted context omitted.

They're getting interviews left and right https://www.theregister.com/2025/04/29/north_korea_worker_in... According to Crowdstrike (the company that wiped out most of global technology last year) at least > My favorite interview question, because we've interviewed quite a few of these folks, is something to the effect of 'How fat is Kim Jong Un?' They terminate the call instantly

> How fat is Kim Jong Un Ha if I got asked that during an interview, I'd think either I went to the wrong interview or the interview is a red flag.

In crypto has become a known joke to ask that before hiring bc NK state actors really are focsuesd on it and hacking companies etc.

Re: We identified a North Korean hacker who tried to get a job

#182

Post by tough »

cj wrote: post #164
corytheboyd wrote: post #17

Earlier quoted context omitted.

> yet fake people are getting hired left and right. Hate to be that person, but what are you reading that makes you think this is true? Agree that the article is pretty dumb though, especially the OSINT and Crypto “don’t trust, verify” comments. Feels like content marketing that didn’t really hit.

80% of our recruiter's time is spent trying to figure out which candidates are real and which are fake. It's really, really bad. We post a role, get 500 applicants, and nearly all of them are not legitimate. They all look amazing, really great resume, impressive LinkedIn, etc... but when you dig a little deeper, it's not that hard to find a bunch of red flags (LinkedIn profile create We're extremely vigilant about th…

maybe leave the photo id ask for when there's suspicion only is fine

Re: We identified a North Korean hacker who tried to get a job

#183

Post by mvdtnz »

donnachangstein wrote: post #4

They used their leet "OSINT" skillz to ask the most basic of questions and background checks that nearly any traditional interview process would immediately uncover, then think it's so novel it's worthy of a blog post. On the surface it seems the "security" industry is lacking in the most basic of security processes when hiring. I don't think I've ever worked anywhere that could accidentally hire a North Korean witho…

You need to keep in mind that only the dumbest people on Earth remain in the crypto space in 2025.

Re: We identified a North Korean hacker who tried to get a job

#184

Post by arandomhuman »

gouggoug wrote: post #176
anonymousiam wrote: post #83

Commenting on the events, CSO Nick Percoco, said: “Don’t trust, verify. This core crypto principle is more relevant than ever in the digital age. State-sponsored attacks aren’t just a crypto, or U.S. corporate, issue – they’re a global threat. Any individual or business handling value is a target, and resilience starts with operationally preparing to withstand these types of attacks.” It's funny to see the CSO of a c…

Not to mention the silliness of this statement: "This core crypto principle is more relevant than ever in the digital age" I wonder what crypto-currency looked like before the digital age... Edit: added -currency suffix to crypto :p

One time pads, enigma machines, Caesar ciphers :p

Re: We identified a North Korean hacker who tried to get a job

#185

Post by squigz »

ryandrake wrote: post #141
bri3d wrote: post #69

Earlier quoted context omitted.

> On the surface it seems the "security" industry is lacking in the most basic of security processes when hiring. They found this person at the top of the funnel, before they even started the process, and then chose to go through with it out of curiosity / for advertising. I personally think it's silly (I don't think the advertising or learning about some comically basic TTP like "interview coaching" was worth their…

> I will say that hiring for remote jobs has gotten to be a gigantic time waste lately. Not sure why this would be any different for remote jobs. All job interview processes (remote and in-office) I've ever done have had an in-person step, and that should be enough to filter these fake candidates, no? Are companies really doing 100% remote interviews, as in: you sign the offer letter without even meeting a single per…

All interview processes I've went through have indeed been 100% remote. When considering this, you should keep in mind the amount of developers that aren't earning top 1% incomes or being offered stock in companies. Things are probably a lot more casual than you may be used to.

Re: We identified a North Korean hacker who tried to get a job

#187

Post by bluGill »

ryandrake wrote: post #141
bri3d wrote: post #69

Earlier quoted context omitted.

> On the surface it seems the "security" industry is lacking in the most basic of security processes when hiring. They found this person at the top of the funnel, before they even started the process, and then chose to go through with it out of curiosity / for advertising. I personally think it's silly (I don't think the advertising or learning about some comically basic TTP like "interview coaching" was worth their…

> I will say that hiring for remote jobs has gotten to be a gigantic time waste lately. Not sure why this would be any different for remote jobs. All job interview processes (remote and in-office) I've ever done have had an in-person step, and that should be enough to filter these fake candidates, no? Are companies really doing 100% remote interviews, as in: you sign the offer letter without even meeting a single per…

10 years ago all interviews were in person. With the pandemic they all went 100% remote. We proved that 100% remote positions can work and so there is temptation to continue doing 100% remote interviews for people that will be working remote anyway.

Though we have been burned by someone we believe (but cannot prove) was 100% remote and working two jobs at the same time (they were laid off in a recent downsizing before we could get enough evidence, but they didn't seem as productive as we would expect). So I expect even if you apply for a 100% remote position you will need to do one round of interviews onsite. (though who knows if this will protect us)

Re: We identified a North Korean hacker who tried to get a job

#188

Post by hn_throwaway_99 »

donnachangstein wrote: post #4

They used their leet "OSINT" skillz to ask the most basic of questions and background checks that nearly any traditional interview process would immediately uncover, then think it's so novel it's worthy of a blog post. On the surface it seems the "security" industry is lacking in the most basic of security processes when hiring. I don't think I've ever worked anywhere that could accidentally hire a North Korean witho…

Couldn't agree more. While I might not be as harsh against the blog post author, they made it seem like they were doing some high-level reconnaissance work, and at the end of the day the thing that made the NK candidate "unravel" was questions like "tell me about some restaurants in your town".

All this goes to show is that, for many companies, their hiring process for offshore employees is so sad that basic human interactions that would easily uncover blatant attempts like this are skipped.

Re: We identified a North Korean hacker who tried to get a job

#189

Post by vunderba »

ryandrake wrote: post #148
Multiplayer wrote: post #7

Here's a heretical thought: Remote hiring is a massive achilles heel. I've been duped simply by hiring a great engineering candidate who then farmed out the actual work to remote workers in Pakistan and India. We caught on fairly quickly thanks to one of them forgetting to login to one of our backend systems via vpn a few times. No idea how many companies he was "working for" but I'd bet we were one of many. Remote w…

I don't think this has anything to do with remote vs. onsite work. It has more to do with remote vs. onsite interviews . A thorough onsite interview should catch all of these fake candidates. Companies should be doing at least one onsite interview regardless of whether the role itself is remote or onsite.

A friend of mine's company is completely remote only, but they use a shared workspace to conduct interviews for exactly this reason.

Re: We identified a North Korean hacker who tried to get a job

#190

Post by hnlmorg »

bri3d wrote: post #69
donnachangstein wrote: post #4

They used their leet "OSINT" skillz to ask the most basic of questions and background checks that nearly any traditional interview process would immediately uncover, then think it's so novel it's worthy of a blog post. On the surface it seems the "security" industry is lacking in the most basic of security processes when hiring. I don't think I've ever worked anywhere that could accidentally hire a North Korean witho…

> On the surface it seems the "security" industry is lacking in the most basic of security processes when hiring. They found this person at the top of the funnel, before they even started the process, and then chose to go through with it out of curiosity / for advertising. I personally think it's silly (I don't think the advertising or learning about some comically basic TTP like "interview coaching" was worth their…

> I disagree completely with other posts claiming only crypto and finance are being targeted; while it's hard to confirm

I can definitely confirm it’s not just finance and crypto being targeted.

I can also confirm it’s not just state sponsored North Korean agents too. Sometimes it’s just individuals trying to fake it until they make it.

However I dont agree with your conclusion that remote interviews are not dead because of this. Yes it’s annoying and time consuming filtering out these culprits, but the interview process already was an annoying and time consuming process to begin with. So I wouldn’t be so quick to throw the baby out with the bath water.

Post reply on HN