I Inspected My Take-Home Interview Project. It Was a Whole Operation
168 points
1 hour ago
| 11 comments
| citizendot.github.io
| HN
wxw
41 minutes ago
[-]
> They embedded a script that checks the victim’s host operating system and silently executes a remote payload.

Seems like this is becoming a recurring theme, similar story was on the front page last month.

https://news.ycombinator.com/item?id=48546294

reply
guessmyname
35 minutes ago
[-]
> […] and silently executes a remote payload

Silently only because @OP is not running Little Snitch (or the equivalent on Windows/Linux).

I’m in the habit of running `tree -a` or the more modern `erd --hidden` but in this case I wouldn’t have needed to, and I wouldn’t have had to audit the scripts either. Little Snitch would have popped up an alert the moment cURL tried to reach that remote server, which is obviously suspicious, and I would have ended the “interview” right there.

reply
ivanjermakov
4 minutes ago
[-]
> Why use a raw IP address? If anything, this screams “malware.”

If the victim is deep enough to check hook's content, it's unlikely they will just stop here losing suspicion. I'm sure most devs wouldn't think that doing `git commit` can be malicious (git security oversight?).

reply
lantry
22 minutes ago
[-]
> Side note: Why use a raw IP address? If anything, this screams “malware.” At least register a decoy domain like lint-checker.com or jenkins-ci-runner.net. If the threat actors who wrote this are reading: take notes people!

Maybe they don't want to give any identifying info to the domain registrar? Or just minimizing their online presence?

reply
HPsquared
5 minutes ago
[-]
That's probably the reason bare IP addresses are associated with sketchy stuff.
reply
CITIZENDOT
13 minutes ago
[-]
fair point
reply
nphardon
47 minutes ago
[-]
always a good day when we get an a post on front actually related to hacking on hackernews.
reply
ivanjermakov
2 minutes ago
[-]
Except hackernews is about different kind of hackers.

http://www.catb.org/jargon/html/H/hacker.html

> 1. A person who enjoys exploring the details of programmable systems and how to stretch their capabilities, as opposed to most users, who prefer to learn only the minimum necessary. RFC1392, the Internet Users' Glossary, usefully amplifies this as: A person who delights in having an intimate understanding of the internal workings of a system, computers and computer networks in particular.

> 2. One who programs enthusiastically (even obsessively) or who enjoys programming rather than just theorizing about programming.

reply
darth_avocado
25 minutes ago
[-]
If LinkedIn actually cared about preventing scams, they could implement verification using company emails if you want to list your current employment. And if it is too much of a heavy burden, then at the minimum you should have it as an optional feature that recruiters would have to comply with, if they want to be legitimate.
reply
CITIZENDOT
17 minutes ago
[-]
> they could implement verification using company emails

they added this back in 2023 (https://news.linkedin.com/2023/april/linkedin-s-new-verifica...), but very less people actually bother to verify with their email, so not having it doesn't always mean it's illegitimate.

reply
darth_avocado
14 minutes ago
[-]
The legitimate recruiters should start using it then.
reply
ge96
56 minutes ago
[-]
There was a funny video I saw recently someone's running Red Star OS on their computer and a scammer is trying to scam them thinking it's Windows

Unrelated to this git pre commit hook attack but yeah

reply
drnick1
8 minutes ago
[-]
Are these kinds of tests still relevant in the AI age? Genuine question, I have not interviewed for a very long time. They seem as useful as take home college exams.
reply
ChrisMarshallNY
1 hour ago
[-]
I assume these types of things are going to become more and more common.

Looks like these folks really did their homework.

It's nasty, but I have to respect their skills. I'll bet it works, quite often.

reply
CITIZENDOT
54 minutes ago
[-]
yea, i had fun looking around, this felt like a ctf challenge lol. if they had any vuln on their server, it would've been even better.
reply
LoganDark
59 minutes ago
[-]
Their "skills" might just be borrowed from some LLM.
reply
ChrisMarshallNY
35 minutes ago
[-]
I dunno. The Norks seem to be really good at this, and have been, for a long time.

I suspect it's clever, experienced, engineers, leveraging LLMs.

reply
throw_m239339
55 minutes ago
[-]
Yeah, this scam is probably all automated at first place. Welcome to the "agent era"...
reply
gtowey
57 minutes ago
[-]
My takeaway from this is that I should use the same defense as when someone calls you "from you bank". When they reach out directly, go to the real company's site to apply and contact a real recruiter. If you can't validate that the business is legit before, then assume malfeasance.
reply
technion
48 minutes ago
[-]
Companies make this hard, a bit like various email scams where legit company communication comes from seemingly random domains (hello paypal). Often the company is legit, but theres no public contact that knows anything about the recruiter thats working for them.
reply
bombcar
45 minutes ago
[-]
Healthcare companies are the WORST at this - they will send you legitimate email from h34lthc4re.biz with a heart-happy-health.phishing.info link that you HAVE to use - and it's all legit.
reply
paxys
43 minutes ago
[-]
Even if the attempt is legit, going to the company’s website/careers page to try and reach them is pointless. You application will just get lost among the thousands of others. Your best bet is to ask the recruiter to email you and check for a @<company.com> email address. And even if the attempt checks out don’t run untrusted code on your machine.
reply
yieldcrv
37 minutes ago
[-]
it was in this moment, that gtowey’s outdated job solutions transitioned them from unc to boomer
reply
gtowey
22 minutes ago
[-]
I think you misunderstood.

I'm not talking about switching to cold contacting companies as a job hunting strategy. I'm saying if you get a suspicious outreach from a rando on linked in on behalf of a company THEN you only continue if you can reach out to the same person via official company channels.

reply
sailfast
13 minutes ago
[-]
Really hate that the USG overreaction on Fable has given us a neutered version of AIs for DEFENSIVE capabilities even when we just want an explanation of what we’re being subjected to with this malware.

Give defenders a better shot…

reply
rdksu
52 minutes ago
[-]
Bruh the harry potter theme song scared the shit out of me as it turned itself on. Bad UX for a personal site. Great article btw !
reply
ladybro
39 minutes ago
[-]
Where can one be whimsical and fun if not for a personal site?
reply
CITIZENDOT
47 minutes ago
[-]
sorry, i added it to set the mood for my site :') yk, like moving lamps at the top, hanging dementor at the right side (only visible on desktops).

should i remove it?

reply
seanobannon
32 minutes ago
[-]
absolutely not! it is a delightful source of whimsy on an increasingly uniform web
reply
Lammy
35 minutes ago
[-]
Middle ground: make it respect `prefers-reduced-motion` :)
reply
projektfu
23 minutes ago
[-]
No, it's your playground. My podcast was talking about the music the guest was making and I thought he was playing something Potter related.
reply
aftbit
17 minutes ago
[-]
I used developer tools to delete the dementor, then I muted the site when it started playing music.
reply
eightysixfour
42 minutes ago
[-]
No, it made me laugh.
reply
john_strinlai
36 minutes ago
[-]
>should i remove it?

there is no place for fun, whimsy, moods, or personalization on the web. sorry.

(no, at least not at the request of random internet stranger #10545346)

reply
ChrisMarshallNY
15 minutes ago
[-]
Around here, many people have their sense of humor, removed, during their first colonoscopy.

I joke, anyway, and bear the downvotes. Totally worth it.

reply
busymom0
5 minutes ago
[-]
Nah, keep it. It's your site and that's where you get to have fun!
reply
ikistuach
45 minutes ago
[-]
yes
reply