I Inspected My Take-Home Interview Project. It Was a Whole Operation
- > They embedded a script that checks the victim’s host operating system and silently executes a remote payload.
Seems like this is becoming a recurring theme, similar story was on the front page last month.
https://news.ycombinator.com/item?id=48546294
- My takeaway from this was that Claude was being completely useless as a helper Thanks to all the safety safeguards and that nonsense.
by ivanjermakov
0 subcomment
- > Why use a raw IP address? If anything, this screams “malware.”
If the victim is deep enough to check hook's content, it's unlikely they will just stop here losing suspicion. I'm sure most devs wouldn't think that doing `git commit` can be malicious (git security oversight?).
- always a good day when we get an a post on front actually related to hacking on hackernews.
by fitsumbelay
1 subcomments
- TIL about tree ...
I stopped being surprised by new stuff I learn about an OS I've been using for 25+ and 10+ as my daily whip and just enjoy the discovery-buzz
these take-home interview nightmare stories are so common ... I'd hate to see a bad actor take advantage by offering a "service" to unsuspecting and underinformed folks like ... erm ... me
- > Side note: Why use a raw IP address? If anything, this screams “malware.” At least register a decoy domain like lint-checker.com or jenkins-ci-runner.net. If the threat actors who wrote this are reading: take notes people!
Maybe they don't want to give any identifying info to the domain registrar? Or just minimizing their online presence?
- There was a funny video I saw recently someone's running Red Star OS on their computer and a scammer is trying to scam them thinking it's Windows
Unrelated to this git pre commit hook attack but yeah
by darth_avocado
1 subcomments
- If LinkedIn actually cared about preventing scams, they could implement verification using company emails if you want to list your current employment. And if it is too much of a heavy burden, then at the minimum you should have it as an optional feature that recruiters would have to comply with, if they want to be legitimate.
by ChrisMarshallNY
2 subcomments
- I assume these types of things are going to become more and more common.
Looks like these folks really did their homework.
It's nasty, but I have to respect their skills. I'll bet it works, quite often.
- My takeaway from this is that I should use the same defense as when someone calls you "from you bank". When they reach out directly, go to the real company's site to apply and contact a real recruiter. If you can't validate that the business is legit before, then assume malfeasance.
- Are these kinds of tests still relevant in the AI age? Genuine question, I have not interviewed for a very long time. They seem as useful as take home college exams.
- I assume an standard way to do this is through a VM provided by the recruiter, right?
- Really hate that the USG overreaction on Fable has given us a neutered version of AIs for DEFENSIVE capabilities even when we just want an explanation of what we’re being subjected to with this malware.
Give defenders a better shot…
- Bruh the harry potter theme song scared the shit out of me as it turned itself on. Bad UX for a personal site. Great article btw !
Hacker News