Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A backdoor in a LinkedIn job offer

roman.pt

Post reply on HN
Print view View original

311–320 of 331 posts

Re: A backdoor in a LinkedIn job offer

#311

Post by lazide »

bit-anarchist wrote: post #310
lazide wrote: post #239

Earlier quoted context omitted.

That is literally just a translation difference for bribery, a common issue for Brazilian Portuguese vs English. [ https://www.jusbrasil.com.br/topicos/10598684/artigo-317-do-... ]. [ https://www.britannica.com/topic/bribery ]

I'm not fond of Brittanica's definition of corruption [ https://www.britannica.com/topic/bribery ]. Improper and usually unlawful conduct intended to secure a benefit for oneself or another. It might as well describe any crime, similar to definition c from earlier. Even still, Britannica memtions gifts, which points to corruption being primarily connected to bribery: In societies with a culture of ritualized gift giv…

Corruption is a general term, yes. And bribery is a specific crime, which falls under that unbrella. At least in English.

Re: A backdoor in a LinkedIn job offer

#312

Post by bit-anarchist »

kortex wrote: post #272
bit-anarchist wrote: post #120

Earlier quoted context omitted.

[flagged]

That sure is an interesting take from someone with "anarchist" in their username. IMHO corruption is any time you use power/influence/station in order to skew the normal well-behaved channels of governance (cybernetics) for personal gain. Any system with hierarchy can have corruption. Bernie Madoff was an example of illegal, private industry corruption.

I'm not fond of that definition for a couple of reasons:

1. praxeologically, all individuals act for personal gain, which is subjective in nature;

2. most private corporations don't have a well-defined governance (aside from the occasional constitution), specially ones that rely on gift/favor-based economies, such as seen in certain tribes. Governments tend to be an exception due their unique legal nature.

Bernie Madoff's case can best described as a Ponzi scheme, a form of massive fraud scheme.

In a sibling comment, I realized that "corruption" isn't a defined crime in most jurisdictions, aside from Brazil, for some reason, so it's kind of wrong of me to say that corruption is legally defined.

Still, my particular peeve here is the implication of immoral conduct without context on LinkedIn's own rules.

Re: A backdoor in a LinkedIn job offer

#313

Post by teiferer »

philote wrote: post #296
teiferer wrote: post #197

Earlier quoted context omitted.

I know you are joking, but there is something about this that I really don't get. "Friends" here really means "a professional network". Many nerds despise having one or maintaining/building one. At the same time, people pour weeks/months/years of their life into optimizing their modest investment portfolios. 0.01 percentage points of yearly cost differences of some passive ETF. That surely compounds. But you know wha…

I don't disagree, but broadening your network is a very different skill (being social) than handling investment portfolios. And for some of us, it's not that we necessarily despise creating or maintaining a network, it's that we suck at it.

And that's my point. Putting just a little bit of minimal effort pays off much more than micro-optimizing some etf investment. Big time.

Re: A backdoor in a LinkedIn job offer

#314

Post by bit-anarchist »

Terr_ wrote: post #235
bit-anarchist wrote: post #120

Earlier quoted context omitted.

[flagged]

> corruption necessarily envolves the government False. [0] If the bank teller demands a bribe to let you withdraw from your account, that's corruption, even though they aren't working for the government. > Corruption is the dishonest, fraudulent, or criminal use of entrusted authority or power for personal gain or other unlawful or unethical benefits. Corruption occurs in politics, business, education, media, and ot…

That's either the crime of extortion (which is more broad than corruption) or failing to comply with official duties, which will likely result in firing. When I spoke of the crime of corruption, as expanded in a sibling comment, I was referring to a charge labelled "corruption". It seems, under US, there isn't a law against corruption per se, but against variations of fraud, extortion, etc. Unlike Brazil, for instance, where corruption is, specifically, a crime against the public administration. Still, my bad.

I concede that, outside of formal law, one can describe certain deviations of official attributions of private corps.' agents as corruption.

Re: A backdoor in a LinkedIn job offer

#316

Post by andyroid »

Grimburger wrote: post #244
jmward01 wrote: post #77

Earlier quoted context omitted.

I see several comments like this implying nothing can be done. But that is far from the truth. First, an agency that actually answered the phone could coordinate directly with LinkedIn and other tech companies to quickly take down these fake accounts and minimize harm to others. We all know how incredibly hard it is to contact a tech company. Second, an agency that answers the phone could help less technical people f…

> But that is far from the truth Just install a Russian locale on your computer to prevent malicious programs even starting and get on with your day because it's the truth. Snowden is a free man in 2026 despite the United States of America very much wanting to put him in jail.

Free as in being trapped in Russia for life.

Re: A backdoor in a LinkedIn job offer

#317

Post by andyroid »

mDyJzDPmBdG wrote: post #230
OrangeMusic wrote: post #209

Earlier quoted context omitted.

They typically don't execute arbitrary code when setting up the project.

If a build tool has any support for tests, it can execute arbitrary code, since that is what tests are. I am quite sure Maven's pom.xml can install binary jar into local .m2/repository, and later use it as plugin during generate-sources phase - and that is something an IDE will want to do when opening project. NPM attacks are really product of its popularity (and update churn that community already got used to).

You’re not wrong, but what an IDE does when opening a project directory is an issue with that tool, and not one directly addressable by the maintainers of the dependency management tool.

The more direct comparison would be whatever the equivalence of “npm install” is for a given language, and what it allows to run. Sounds like they’re making good progress to fix that, but it’s certainly more than a popularity issue.

Re: A backdoor in a LinkedIn job offer

#318

Post by monksy »

pants2 wrote: post #56
wxw wrote: post #16

> a recruiter at a small crypto startup [...] she described a broken proof-of-concept they needed a lead engineer for, and then sent me a public GitHub repo to review. Specifically, she asked me to “check out the deprecated Node modules issue.” > ...buried between walls of commented-out tests, the payload runs anything the server sends back to your machine. > npm runs prepare automatically after npm install, so just…

LinkedIn offers no way for $company to disavow users who claim to work for $company - they will appear on the official company page as long as it's in their profile. We've had fake recruiters that claim to work for us running basically the same scam. These are great fake profiles: LinkedIn Premium, tons of relevant posts, etc... but they don't work for us, and we get angry messages from people saying our recruiter tr…

Yet they'll go after fun users that make paraody pages saying they worked at places during huge failures. I.e. Dan Woods. (he's the guy that said he worked at aws for a month and then us-east1 went down, etc)

Re: A backdoor in a LinkedIn job offer

#319

Post by throwawayffffas »

1dontnkow_ wrote: post #308
throwawayffffas wrote: post #299

Earlier quoted context omitted.

> why qwen I have it running locally, and i don't want to add credentials to the vm with the malware. According to qwen: It's cross platform It has a bunch of persistence mechanisms. It downloads another pack from pub-1fe39d600a4447ba895ef1c848d32e7e.r2.dev, Verified I got the secondary payload This pack looks like a python 3.10 environment along with an executable called cupsd. And downloads another js script from h…

I'm actually curios to know how do you people visit the link securely? I guess a VM but could in theory something be resilient enough to misuse the Shared Clipboard or something to access your host machine? Also what is your go to OS? Hm, when I think of it an old Raspberry Pi could be my go to for this, but always physically.

tldr: Qubes OS, disposable vms, don't run the malware, physical isolation sounds better but is its own can of worms.

> I'm actually curios to know how do you people visit the link securely?

Disposable vm with a connection to tor. Then copied to a disposable vm with access only to one port on my llm server the one running llama.cpp.

> I guess a VM but could in theory something be resilient enough to misuse the Shared Clipboard or something to access your host machine?

When I am doing this kind of thing i have some rules.

Rule #1 Do not run the malware.

Rule #2 No copying from the analysis vm.

Given the malware is not run it's highly unlikely that any Xen vulnerabilities can be exploited or llama.cpp vulnerabilities for that matter.

Ideally I would not be using my own llm server but proxying the requests through another vm that contains temporary credentials to a llm provider. But I did not have the time to set that up.

> Also what is your go to OS?

Qubes OS

> Hm, when I think of it an old Raspberry Pi could be my go to for this, but always physically.

Physical isolation has it's own issues. If you don't airgap the device it could exploit other devices in your network, old residential routers are not exactly bulletproof especially from the lan side. Additionally, physical devices could be vulnerable to bios and UEFI firmware persistence mechanisms.

Re: A backdoor in a LinkedIn job offer

#320

Post by lebed2045 »

Revenge! A friend of mine was scammed this way two years ago.

So when I finally received a similar offer on LinkedIn, I made them pay to me, twice XD

They sent me a GitHub repository and claimed they needed help deploying a token or something similar. The obvious goal was to get me to run their code while connected to a wallet with real funds.

I told them: sure, I can probably help, but my time costs money.

So I convinced them to pay me for a consultation. For half an hour, I explained how “amazing and simple” the process was, and how they could do it themselves. They claimed to be from the US, but on the call they had an extremely heavy Asian accent. I even recorded part of it on camera, because the whole situation was ridiculous.

Before they could get too furious, I told them I did not have more time and that they would need to book another call. So they paid me a second time.

Before the second call, i got myself absolutely new macbook was for fun testing it, basically a fresh Mac (i should have been using vm because it’s faster to restore but that time i wasn’t familiar with UTM and i got parallels which is scam itself), just to see how their scam worked.

The scam was classic npm install-style: get someone to run scripts from a Git repo and hope they are unaware of how much access that can give to their machine.

Honestly, two years ago, I also did not fully understand that simple ‘nom install’ could give attackers such deep access to your computer.

Post reply on HN