Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A backdoor in a LinkedIn job offer

roman.pt

Post reply on HN
Print view View original

291–300 of 331 posts

Re: A backdoor in a LinkedIn job offer

#291

Post by game_the0ry »

> Instead of cloning and installing dependencies, I spun up a throwaway VPS on Hetzner, cloned the repo there, and pointed Pi at it in read-only mode, with only file-reading tools enabled...

Good man, knows what he is doing.

FWIW, I only run ai cli tools on a hostinger vps, never on my personal device. Also allows me to run YOLO mode across the board. If I am working on a web project, then I use preview develop deploys for testing, so I do not even have to work on my machine. Its very fun workflow for experimentation. Still trying to work the kinks to make it easier.

> I reported the repo to GitHub and the recruiter to LinkedIn. So far nothing has changed and the code is still up.

Come on, github...

Re: A backdoor in a LinkedIn job offer

#292

Post by jghn »

valar_m wrote: post #284
jghn wrote: post #282

I can not imagine a situation where some random person messages me on linkedin asking me to solve a coding challenge, and I do anything other than block them.

I'm guessing you've never experienced the enormous pressure of needing to find a job to buy food and clothes for your family. That's good, I'm glad that you don't know that feeling. But if you did, you'd know how easy it could be for a person to start feeling more and more desperate for any kind of lifeline.

There is still no chance that my first reaction to a random stranger asking me to do work for them is "sure", without building some sort of connection. Granted, that means I could still get phished via a coding exercise, but it would require a bit more effort on the attacker's part.

Re: A backdoor in a LinkedIn job offer

#293

Post by jimijazz »

throwawayffffas wrote: post #271
throwawayffffas wrote: post #259

Hm, the url returns a png. Did he obscure the actual url? Couldn't get it to send me json or js... Update: found a clone of the repo on github and got the payload, all you have to do is add a header `bearrtoken: logo` It's obfuscated, I will feed it to qwen to see what can be gleaned.

So fed it to qwen. It seems to think it just a downloader and persistence mechanism for another payload. I will try to download it too and see what qwen thinks of that.

thanks for following down the rabbit hole, let us know what you find! also... why qwen?

Re: A backdoor in a LinkedIn job offer

#294

Post by throwa356262 »

rendaw wrote: post #221
tweetle_beetle wrote: post #64

Earlier quoted context omitted.

LinkedIn didn't even disavow people pretending to work for LinkedIn until someone had too much fun with it - https://chrisduffycomedy.com/blog/2016/11/2/6-months-as-the-...

What happened in the end?

Microsoft bought LinkedIn.

He got a huge package.

Everyone lived happily ever after.

(LinkedIn eventually locked and then deleted his account, https://awesomeatyourjob.com/1140-bringing-more-laughter-fun...)

Re: A backdoor in a LinkedIn job offer

#295

Post by bryan_w »

dakolli wrote: post #266
SauntSolaire wrote: post #82

Earlier quoted context omitted.

> simply for being one of the last communist countries Well, that plus their 50 nuclear warheads and continued ICBM development, amongst other things.

We have what, 2500 of them, and we threaten them with them... Wouldn't you? Iran deserves them too.

Yes and we want them to have zero. What do you not understanding about this?

Re: A backdoor in a LinkedIn job offer

#296

Post by philote »

teiferer wrote: post #197
jzig wrote: post #80

Earlier quoted context omitted.

I don't have friends, therefore I must use LinkedIn to get a job. Hooray!

I know you are joking, but there is something about this that I really don't get. "Friends" here really means "a professional network". Many nerds despise having one or maintaining/building one. At the same time, people pour weeks/months/years of their life into optimizing their modest investment portfolios. 0.01 percentage points of yearly cost differences of some passive ETF. That surely compounds. But you know wha…

I don't disagree, but broadening your network is a very different skill (being social) than handling investment portfolios. And for some of us, it's not that we necessarily despise creating or maintaining a network, it's that we suck at it.

Re: A backdoor in a LinkedIn job offer

#298

Post by fckgw »

maxaw wrote: post #290

this happened to me too. few things about the process made me suspicious. i downloaded the repo and told claude to "find the malware". took about 15 seconds. remote code execution that would have run upon npm install, iirc. many layers of obfuscation. in implementation, a little different to the op's situation but there are similarities. it was a "crypto startup". maybe they think people in crypto world are more forg…

They target people looking at crypto startups because they're after wallets and seed phrases

Re: A backdoor in a LinkedIn job offer

#299

Post by throwawayffffas »

jimijazz wrote: post #293
throwawayffffas wrote: post #271

Earlier quoted context omitted.

So fed it to qwen. It seems to think it just a downloader and persistence mechanism for another payload. I will try to download it too and see what qwen thinks of that.

thanks for following down the rabbit hole, let us know what you find! also... why qwen?

> why qwen

I have it running locally, and i don't want to add credentials to the vm with the malware.

According to qwen:

It's cross platform

It has a bunch of persistence mechanisms.

It downloads another pack from pub-1fe39d600a4447ba895ef1c848d32e7e.r2.dev, Verified I got the secondary payload

This pack looks like a python 3.10 environment along with an executable called cupsd.

And downloads another js script from http://138.201.125.58:1224/client/99/77

That script then proceeds to download three python scripts that use the aforementioned python environment and do their business, qwen is having trouble de-obfuscating their urls and I am busy.

Re: A backdoor in a LinkedIn job offer

#300

Post by john-state-moz »

BobAliceInATree wrote: post #37

> I reported the repo to GitHub and the recruiter to LinkedIn. So far nothing has changed and the code is still up. Oh, Microsoft.

Same story for me. I gave them the repo link and messages. Nothing 2 weeks later. Now I just block them and even then, you can't select a proper reason (there's no "other" field for a block), so I just say they're impersonating someone and leave it at that. We cannot let this become the primary site for job postings.
Post reply on HN