Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A backdoor in a LinkedIn job offer

roman.pt

Post reply on HN
Print view View original

321–330 of 331 posts

Re: A backdoor in a LinkedIn job offer

#321

Post by jaapz »

HelloNurse wrote: post #276
jaapz wrote: post #268

Earlier quoted context omitted.

And using DNS to prove that a domain is actually owned by this organization

Email domains of employee addresses aren't necessarily owned by the company. For example: - a startup with legacy personal email addresses from one or two universities - a spin-off sharing the email domain (and the whole IT infrastructure) of the parent company - cheapskates using six approved free email services For security purposes, on the other hand, the important part is proving that the LinkedIn account is owne…

So? Then you can't do this. For companies that do want more control over their linkedin organizations, it is still a useful feature. For companies using free e-mail services... they probably don't care anyway.

Re: A backdoor in a LinkedIn job offer

#322

Post by evilduck »

sheept wrote: post #138
evilduck wrote: post #128

Earlier quoted context omitted.

This is a real world trolley problem scenario. You can break workflows or you can let everyone get pwned by supply chain attacks. Which is the greater harm?

People will not adopt a safer version if it broke their workflows. Adoption is part of preventing supply chain attacks.

Sure they will. When the real or perceived cost of addressing supply chain attacks exceeds the cost of changing tooling workflows, they will switch.

Re: A backdoor in a LinkedIn job offer

#324

Post by treszkai »

ruperthair wrote: post #224
matltc wrote: post #191

The difference between pre- and post-chatbot writeups is stark: https://igor-blue.github.io/2021/03/24/apt1.html $100 says OP is Claude

I think that comment is a little unfair, as the one you link to is a much more sophisticated attack. Thanks for the link, though. Great read!

OP has many posts from years ago, with wildly differing language: https://roman.pt/posts/alembic-enums/

Re: A backdoor in a LinkedIn job offer

#325

Post by nsvd2 »

kobebrookskC3 wrote: post #216
teiferer wrote: post #202

Earlier quoted context omitted.

> just ban U.S. platforms Try that and see your champagne exports be tarriffed with 100% in no time.

china seems to be doing fine. what are you gonna do, tariff the country that makes all your stuff? 100% tariff on iphones and macbooks?

Well, yes, China has a large number of tarrifs imposed on it from the U.S.

Re: A backdoor in a LinkedIn job offer

#326

Post by PennRobotics »

gleenn wrote: post #32
wxw wrote: post #16

> a recruiter at a small crypto startup [...] she described a broken proof-of-concept they needed a lead engineer for, and then sent me a public GitHub repo to review. Specifically, she asked me to “check out the deprecated Node modules issue.” > ...buried between walls of commented-out tests, the payload runs anything the server sends back to your machine. > npm runs prepare automatically after npm install, so just…

Friends don't let friends use NPM. At this point it is so wildly crazy watching people get owned, I don't understand how anyone uses it when they could use e.g. PNMPM and block one if the most obvious and frequently exploited holes. These tools with arbitrary code execution when trying to download some code have got to stop. Edit: typos

Thanks for the reminder. I installed npm yesterday to extract Electron app contents and forgot to remove it afterward.

Re: A backdoor in a LinkedIn job offer

#329

Post by amai »

Isn't that the old trick: download this “suspicios.zip,” unzip it, and click on “backdoor.exe”? Except that in this case, the backdoor code wasn't hidden in the binary - it was open-source, which is why an AI was able to detect it.

PS I think "smello" is really not a good name for a startup.

Post reply on HN