Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A backdoor in a LinkedIn job offer

roman.pt

Post reply on HN
Print view View original

221–230 of 331 posts

Re: A backdoor in a LinkedIn job offer

#221

Post by rendaw »

tweetle_beetle wrote: post #64
pants2 wrote: post #56

Earlier quoted context omitted.

LinkedIn offers no way for $company to disavow users who claim to work for $company - they will appear on the official company page as long as it's in their profile. We've had fake recruiters that claim to work for us running basically the same scam. These are great fake profiles: LinkedIn Premium, tons of relevant posts, etc... but they don't work for us, and we get angry messages from people saying our recruiter tr…

LinkedIn didn't even disavow people pretending to work for LinkedIn until someone had too much fun with it - https://chrisduffycomedy.com/blog/2016/11/2/6-months-as-the-...

What happened in the end?

Re: A backdoor in a LinkedIn job offer

#222

Post by HelloNurse »

freeopinion wrote: post #174
sensanaty wrote: post #67

Earlier quoted context omitted.

My last 2 companies, LinkedIn asked me to add an email address associated with the said company and actually confirm via said email in order to add them to my profile. So, if I worked for FooCompany, I had to have a @FooCompany.com email which is setup by someone at the company itself. Does this not cover what you're talking about?

You mean @fooco.com? Or @foocousa.com? Or @fooco.xyz? @fooco.ai? @foocoltd.net? @foo.co.uk? How would LinkedIn validate that your email domain belongs to the company you claim to work for?

With a company-managed list of owned domains where real employees have their work email addresses (unrelated to website domains).

Re: A backdoor in a LinkedIn job offer

#224

Post by ruperthair »

matltc wrote: post #191

The difference between pre- and post-chatbot writeups is stark: https://igor-blue.github.io/2021/03/24/apt1.html $100 says OP is Claude

I think that comment is a little unfair, as the one you link to is a much more sophisticated attack. Thanks for the link, though. Great read!

Re: A backdoor in a LinkedIn job offer

#225

Post by zkmon »

wxw wrote: post #16

> a recruiter at a small crypto startup [...] she described a broken proof-of-concept they needed a lead engineer for, and then sent me a public GitHub repo to review. Specifically, she asked me to “check out the deprecated Node modules issue.” > ...buried between walls of commented-out tests, the payload runs anything the server sends back to your machine. > npm runs prepare automatically after npm install, so just…

I stay away anything that needs npm. I regularly scan for node-modules folders and rm -rf it.

Re: A backdoor in a LinkedIn job offer

#227

Post by sensanaty »

freeopinion wrote: post #174
sensanaty wrote: post #67

Earlier quoted context omitted.

My last 2 companies, LinkedIn asked me to add an email address associated with the said company and actually confirm via said email in order to add them to my profile. So, if I worked for FooCompany, I had to have a @FooCompany.com email which is setup by someone at the company itself. Does this not cover what you're talking about?

You mean @fooco.com? Or @foocousa.com? Or @fooco.xyz? @fooco.ai? @foocoltd.net? @foo.co.uk? How would LinkedIn validate that your email domain belongs to the company you claim to work for?

What HelloNurse said, whoever it is that runs the company page on LinkedIn provides a list of domains that they consider theirs.

Re: A backdoor in a LinkedIn job offer

#228

Post by tliltocatl »

pants2 wrote: post #56
wxw wrote: post #16

> a recruiter at a small crypto startup [...] she described a broken proof-of-concept they needed a lead engineer for, and then sent me a public GitHub repo to review. Specifically, she asked me to “check out the deprecated Node modules issue.” > ...buried between walls of commented-out tests, the payload runs anything the server sends back to your machine. > npm runs prepare automatically after npm install, so just…

LinkedIn offers no way for $company to disavow users who claim to work for $company - they will appear on the official company page as long as it's in their profile. We've had fake recruiters that claim to work for us running basically the same scam. These are great fake profiles: LinkedIn Premium, tons of relevant posts, etc... but they don't work for us, and we get angry messages from people saying our recruiter tr…

I wonder if a cease and desist to their legal department would work better?

Re: A backdoor in a LinkedIn job offer

#229

Post by mDyJzDPmBdG »

andy99 wrote: post #40
BobAliceInATree wrote: post #37

> I reported the repo to GitHub and the recruiter to LinkedIn. So far nothing has changed and the code is still up. Oh, Microsoft.

I once saw an ad on LinkedIn made up to look like the CBC (Canadian news) linking to a fake video of the Canadian prime minister announcing a crypto investment plan for all Canadians, with a link to sign up. I reported the ad to LinkedIn and shortly after got a reply telling me they investigated and didn’t find any violation of their policies.

> they investigated and didn’t find any violation of their policies.

When my YT Premium elapsed 70% od ads YT decided to show me were deepfake investment scams (of terrible quality), and Google also didn't find them to violate any of their policy. The remaining 30% were strait up foreign state-level propaganda, those I didn't even bother to report.

Re: A backdoor in a LinkedIn job offer

#230

Post by mDyJzDPmBdG »

OrangeMusic wrote: post #209
gitaarik wrote: post #188

Earlier quoted context omitted.

How does npm differ from any other package manager in that sense?

They typically don't execute arbitrary code when setting up the project.

If a build tool has any support for tests, it can execute arbitrary code, since that is what tests are. I am quite sure Maven's pom.xml can install binary jar into local .m2/repository, and later use it as plugin during generate-sources phase - and that is something an IDE will want to do when opening project. NPM attacks are really product of its popularity (and update churn that community already got used to).
Post reply on HN