Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A backdoor in a LinkedIn job offer

roman.pt

Post reply on HN
Print view View original

201–210 of 331 posts

Re: A backdoor in a LinkedIn job offer

#201

Post by medwards666 »

pants2 wrote: post #56
wxw wrote: post #16

> a recruiter at a small crypto startup [...] she described a broken proof-of-concept they needed a lead engineer for, and then sent me a public GitHub repo to review. Specifically, she asked me to “check out the deprecated Node modules issue.” > ...buried between walls of commented-out tests, the payload runs anything the server sends back to your machine. > npm runs prepare automatically after npm install, so just…

LinkedIn offers no way for $company to disavow users who claim to work for $company - they will appear on the official company page as long as it's in their profile. We've had fake recruiters that claim to work for us running basically the same scam. These are great fake profiles: LinkedIn Premium, tons of relevant posts, etc... but they don't work for us, and we get angry messages from people saying our recruiter tr…

I had it several years ago when I was running my own one-man consultancy [ie: self-employed] ... somehow I'd managed to have six or seven people on LI claiming to work for the same company.

Reported them to LI and nothing was ever done about it. Eventually the accounts disappeared as I guess they were either shut down or repurposed.

Re: A backdoor in a LinkedIn job offer

#202

Post by teiferer »

nijave wrote: post #113
jmward01 wrote: post #77

Earlier quoted context omitted.

I see several comments like this implying nothing can be done. But that is far from the truth. First, an agency that actually answered the phone could coordinate directly with LinkedIn and other tech companies to quickly take down these fake accounts and minimize harm to others. We all know how incredibly hard it is to contact a tech company. Second, an agency that answers the phone could help less technical people f…

Taking things down doesn't help much unless the platform has something in place to make it hard to recreate them. >they could do the hard job of combining leads and working with appropriate agencies to maybe find and prevent these things over time At least in the U.S., everyone will cry government overreach and no one will fund it. In other countries, they should probably just ban U.S. platforms unless they're reacha…

> just ban U.S. platforms

Try that and see your champagne exports be tarriffed with 100% in no time.

Re: A backdoor in a LinkedIn job offer

#204

Post by gleenn »

nijave wrote: post #110
gleenn wrote: post #32

Earlier quoted context omitted.

Friends don't let friends use NPM. At this point it is so wildly crazy watching people get owned, I don't understand how anyone uses it when they could use e.g. PNMPM and block one if the most obvious and frequently exploited holes. These tools with arbitrary code execution when trying to download some code have got to stop. Edit: typos

>These tools with arbitrary code execution when trying to download some code have got to stop But you still end up with the code on your machine and risk it being ran. Bigger issue is giant, inscrutible dependency trees. In this example, if they tried to run the test suite or application, they'd have been in the same boat. Afaik all or most languages have some way to run arbitrary code at install time but it seems no…

Claude Code regularly installs dependencies using (p)npm after I e.g. pull a company main branch to get in sync with my teammates. That happens often. So I pull, Claude edits some code as you requested and it should pass because Claude did alright, but your local box has out-of-date deps. So then Claude runs (p)npm i and now we have automatic exploitation of this gaping hole in npm given extremely common and current AI tooling. Someone has to figure out how to stop AI from running that command or NPM needs to stop that behavior, and I guarantee you it will be easier to get one tool to change than all AI.

Re: A backdoor in a LinkedIn job offer

#205

Post by blablabla123 »

dantodor wrote: post #139

Been through this 3 times in the last 6 months. They're getting better. Very credible LI profiles, code looks OK if you only take a glance... The bell start ringing when they insist you to run locally their sh*t

Similar for me. One was for an overly very well paid position. I always run (p)npm audit before running npm repos, so lots of issues were found. I tried to fix them but I would have gone over the time limit. So I asked the recruiter about it and if it makes sense to run it in an isolated VM. No answer...

The other was for a DevEx crypto service. While I was very suspicious the code looked okay but the recruiter was strange and changed their profile to a different person eventually. I think this was a crypto stealing scam though since it required connecting to a wallet. I don't have any crypto though, so I might be okay for now. Although reinstalling my system clean would be the only sure way in theory...

Re: A backdoor in a LinkedIn job offer

#206

Post by latexr »

sph wrote: post #196
pants2 wrote: post #56

Earlier quoted context omitted.

LinkedIn offers no way for $company to disavow users who claim to work for $company - they will appear on the official company page as long as it's in their profile. We've had fake recruiters that claim to work for us running basically the same scam. These are great fake profiles: LinkedIn Premium, tons of relevant posts, etc... but they don't work for us, and we get angry messages from people saying our recruiter tr…

> LinkedIn offers no way for $company to disavow users who claim to work for $company - they will appear on the official company page as long as it's in their profile. I had the opposite problem: my company name was equivalent to the owner of an online casino. It took me a year to figure out that the enormous amount of spam I was getting about ‘guest post placement’, and people contacting me about deals was because L…

> I don’t know how do they even harvest emails from Linkedin.

https://haveibeenpwned.com/Breach/LinkedIn

Re: A backdoor in a LinkedIn job offer

#207

Post by IshKebab »

Joel_Mckay wrote: post #170
mock-possum wrote: post #165

Earlier quoted context omitted.

Because uh every OS on earth has the exact same vulnerabilities? How are you supposed to stop a user from downloading something random from the internet and running it?

Some posix like systems mount /home with noexec in fstab. Practically, most systems leave it off because many out-of-band user space script language package ecosystems stop working. =3 There are also adaptive application firewalls that are user friendly. https://github.com/evilsocket/opensnitch

noexec clearly isn't going to help if you run untrusted JavaScript...

Re: A backdoor in a LinkedIn job offer

#208

Post by 55555 »

mrhottakes wrote: post #14
jmward01 wrote: post #8

So, this is a crime right? Why isn't there a well known '911' for cybercrime to report things like this to and get help? Society needs to catch up with the actual dangers out there and build support networks for this ASAP. This is organized crime and needs organized defense to deal with it.

Unfortunately most evil cybercriminals know the "one weird trick" of "do your crimes in countries that don't care about the crimes"

Something I've always wondered, because I'm a bit of a contrarian and I wonder if we're really any different: Could an American citizen hack and steal from Iranians and Russians with impunity from America? The issues that prevent the US from extraditing Russians who hack us -- don't they work both ways?

Re: A backdoor in a LinkedIn job offer

#209

Post by OrangeMusic »

gitaarik wrote: post #188
elwebmaster wrote: post #99

Why is npm still not blocked by every OS on earth is beyond me. These guys will never learn.

How does npm differ from any other package manager in that sense?

They typically don't execute arbitrary code when setting up the project.

Re: A backdoor in a LinkedIn job offer

#210

Post by suttontom »

matltc wrote: post #191

The difference between pre- and post-chatbot writeups is stark: https://igor-blue.github.io/2021/03/24/apt1.html $100 says OP is Claude

I don't want to be cynical, but maybe spending hours every day using Claude has made some of us particularly attuned to picking this up. For some reason as soon as I read "The trap was in app/test/index.js," I instantly knew it was Claude. It's too bad, because there will obviously be some false positives, but it makes me immediately disregard the author.
Post reply on HN