hckrnws

Wow, after reading this article, I figured out I was hacked, but with a way more sophisticated attack.

A few weeks ago, I had an interview with a CTO of a totally legit company. It was weird because he had disabled the camera, and the person had a strong accent. But everything else sounded like a normal screening interview, and the person definitely knew what he was talking about. At the end of the interview, he explained to me that during the technical interview I would need to make some modifications to their project (it's an OSS product), so he asked me to clone the repo and check the setup.

Later, the HR person said the CTO got sick, so the interview would be postponed. But a few days later, the HR profile was deleted from LinkedIn. It was super weird, but it didn't trigger my suspicion until I saw this post on HackNews. I checked, and the repo I was cloning and running during the interview had a malware payload.

P.S. I think it was a targeted attack because in the past I maintained a very popular NPM package with 43+M weekly downloads. That's my only explanation for why someone would carry out such a sophisticated social-engineering attack against me.

P.P.S. It's great that I have 2FA everywhere, and I always publish NPM packages manually without using tokens. But I need to wipe my laptop and reinstall everything.

Recently there seems to be an uptick in North-Korean attacks against developers. In addition to this type of attack, which has been going on for years, I recently get ~1 email a week from North Korean hackers. It's always a "Hello, I found your profile, want to collaborate?" e-mail.

Discord communities I am in for programming are similar. People show up and within a few days either ask for a job or suggest cooperation. Sure, you could argue these Discord people may actually be out of a job (in this economy, very likely), but the volume and similarity of the messages say otherwise. You can also tell people show up in... _weird places_ to ask for jobs. An example being the Discord community for a not-really-used Python library with ~0 actual activity - either this person is very bad at finding good places to jobhunt or some attacker is just crawling a list of Discord communities and attacking them all.

It's a shame but there are a _lot_ of attacks that abuse our trust in each other nowadays. A good reminder to, like mom and dad said, never trust strangers on the internet

> They embedded a script that checks the victim’s host operating system and silently executes a remote payload.

Seems like this is becoming a recurring theme, similar story was on the front page last month.

https://news.ycombinator.com/item?id=48546294

My takeaway from this was that Claude was being completely useless as a helper Thanks to all the safety safeguards and that nonsense.

> Why use a raw IP address? If anything, this screams “malware.”

If the victim is deep enough to check hook's content, it's unlikely they will just stop here losing suspicion. I'm sure most devs wouldn't think that doing `git commit` can be malicious (git security oversight?).

> Side note: Why use a raw IP address? If anything, this screams “malware.” At least register a decoy domain like lint-checker.com or jenkins-ci-runner.net. If the threat actors who wrote this are reading: take notes people!

Maybe they don't want to give any identifying info to the domain registrar? Or just minimizing their online presence?

always a good day when we get an a post on front actually related to hacking on hackernews.

Hmm, did anyone else have issues loading the screenshots here? I had to open most of them in a new tab to see them.

Regardless, that's a pretty sneaky scam, and definitely something that caught out a ton of would be candidates in the past. What's more, the Visual Studio Code project mentioned in the article sounds even more horrifying. Like, the tool seriously lets you run custom code whenever someone opens your project? That feels like a really blatant malware vector that should probably have at least some sort of security mitigation...

It's also rather worrying how little these job sites are doing about scams like this too. I get it, it's perhaps a bit difficult to catch out all kinds of wrongdoing here. But you'd think it'd be simple enough to restrict accounts from claiming to be associated with a company or organisation if there's no proof they work there. At the moment, you can basically claim to work for any company you like, or that you have any type degree from any institution under the sun. If this was verified in any real way, and messages had a large warning at the top if the original claiming to be from an organisation wasn't confirmed to work there, a lot of scams would far more difficult to pull off.

If LinkedIn actually cared about preventing scams, they could implement verification using company emails if you want to list your current employment. And if it is too much of a heavy burden, then at the minimum you should have it as an optional feature that recruiters would have to comply with, if they want to be legitimate.

I assume these types of things are going to become more and more common.

Looks like these folks really did their homework.

It's nasty, but I have to respect their skills. I'll bet it works, quite often.

There was a funny video I saw recently someone's running Red Star OS on their computer and a scammer is trying to scam them thinking it's Windows

Unrelated to this git pre commit hook attack but yeah

That was a fun read, I wonder if vscode would still load the script if you click “don’t trust author”? That being said, can you embed something yourself and push the commit?

Posted about this back in May: https://blog.denv.it/posts/i-was-likely-targeted-by-dprk-in-...

In my case it was a .vscode hook. Stay safe out there :)

TIL about tree ...

I stopped being surprised by new stuff I learn about an OS I've been using for 25+ and 10+ as my daily whip and just enjoy the discovery-buzz

these take-home interview nightmare stories are so common ... I'd hate to see a bad actor take advantage by offering a "service" to unsuspecting and underinformed folks like ... erm ... me

My takeaway from this is that I should use the same defense as when someone calls you "from you bank". When they reach out directly, go to the real company's site to apply and contact a real recruiter. If you can't validate that the business is legit before, then assume malfeasance.

Nobody mentioning the Harry Potter-esque font used for the headline of TFA?

Wow.

Are these kinds of tests still relevant in the AI age? Genuine question, I have not interviewed for a very long time. They seem as useful as take home college exams.

Most of the time I don't pull external sources (a repo, files, etc.) onto my laptop. Maybe I've passed up some opportunities, but every company that hired me never asked me to install anything: they either used a known live-coding platform, or shared their private repo read-only so I could look without pulling it and then create my own repo to share back.

I also try to talk to people at the company, but I mean employees I can verify independently, not whoever the recruiter puts in front of me. From the stories here, the person on the call can be the scammer, so a convincing conversation isn't proof on its own.

The post title really buries the lede.

> You don’t even have to run a git command, just opening this directory in VSCode is enough to get infected.

The old adage that Microslop and Security in the same sentence is a contradiction in terms still applies, now with a vengeance.

Never open 3rd-party stuff with VSCode.

Unfortunately this is becoming common, it happened to me today, I was suspicious at first but when they guy showed his face (first time, I guess this was a mistake) in the meet I started trusting them, suddenly their interted started failing and he suggested we both turn the camera off.

I was asked quickly about my experienced and he shared that I was a perfect fit, immediatelly I was asked for my github username, then, I was asked to share my screen, I ended the call to not waste more time but my guess is that I would be asked to do something with the project live.

I haven't dig into their malware approach (yet) but this pattern is too frequent to easily recognize it.

Why isn't there a tool that would check those dangerous places, such as git hooks, VSCode and Claude commands that launch automatically, and warn the user of consequences, showing the hook code, allowing to allowlist this single repo if the user deem it secure? I'd say it should be a job of AV/EDR/XDR easily... Or a dedicated software with a highly protected service, and a tray/UI part.

I don't understand why you'd just clone a random repo that someone tells you to like that.

If you want to hire me, I do not want to see your code until I see money from you.

I do not want your code on my computer until there is a contract and quite a lot of money in my account. Even then, I'd prefer you to keep your code on your computers, which I will connect to.

For a "take-home interview"? You want me to work for you for free? Nah. Pay me.

at some point companies will realize they can just post all their backlog as take-home assignments and eliminate the engineering department entirely

Had something similar but less dangerous recently: I “won” a month’s subscription to a brand new “high paying, not on the public sites” job board where if I wrote a cool integration I would make a bunch of money (except the fine print said they could just take it). It took about a minute and a half of playing with the API to see they hadn’t even bothered to fully trim the listings they scraped from other sites. Each job application required you to answer a fairly detailed engineering issue. Best I could tell is they stole your answer, applied to the gig and then did one of those bait and switch interviews with the actual company.

> Naturally, the next move was pivoting from defense to offense. I wanted to see if the attackers left any vulnerable services exposed on their IP.

Why not attack them through the C2 interface? That's where I'd expect them to slip up.

I assume an standard way to do this is through a VM provided by the recruiter, right?

Nice read, but having your home page play music is incredible rude.

I checked for a way to globally disable git hooks. There is no built-in way of doing this.

Really hate that the USG overreaction on Fable has given us a neutered version of AIs for DEFENSIVE capabilities even when we just want an explanation of what we’re being subjected to with this malware.

Give defenders a better shot…

Ok, how do I disable git hooks unless it’s in a manually blessed directory?

Did no one else read far enough to see this was a DPRK (Best Korea) APT campaign?

Welp, this is not going make this job market any easier to navigate.

Interesting read. Is docker sandbox a solution in this situation?

Bruh the harry potter theme song scared the shit out of me as it turned itself on. Bad UX for a personal site. Great article btw !

> You don’t even have to run a git command, just opening this directory in VSCode is enough to get infected.

LOL, is that shit being worked on by former Outlook developers, bringing with them their zero click bags of tricks?

how to protect against something like this?

I once received a suspiciously too good to be true job offer, and at the last minute they surprised me by insisting I use a specific laptop they insisted on mailing me. One they would possess prior to me, and "configure" as superuser, before giving to me to use while working for them.

I declined, as diplomatically as I could. I should not have to spell out in precise detail how dangerous to me their proposal was. In the eyes of an adversary/APT predator: ignorant --> naive --> gullible --> prey --> profit. Rinse, repeat, scale up.