A lot of people are focusing on how irresponsible the engineer was about using the work computer. That's obviously an issue but the bigger failure mode to me is the Engineer C's container deployment token.
That's a huge red-flag. In a company of this size, the deployments should be via CI only. CI isn't just to increase the speed and reliability of deployments but also to provide a clean room to build the software! Even if it's a token that was copied and pasted temporarily, the systems in place should not have to require this type of 1. copy 2. paste 3. remember-to-delete the token from my PC.
Also, Binance should be paying for intrusion testing. Better to pay a trusted company to do this kind of thing instead of letting North Korea show you how it's done. I don't think this exact exploit path would have been found but I bet the intrusion testing would have figured out another way to use Engineer C's token.
> Even if it's a token that was copied and pasted temporarily, the systems in place should not have to require this type of 1. copy 2. paste 3. remember-to-delete the token from my PC.
One of the first things I did in my last job was shift processes like this off my team's computers, aside from the security ramifications all it takes is one dumb mistake, one up-arrow too many, one didn't-read-the-whole-line, and now you're doing something to production by accident!
I think it will remain uncommon. I agree it would be a good test, but companies and employees alike get very angry when pentesting gets too close to sensitive subjects.
Anyone who fell for it would not only get in trouble for poor security practice, they would reveal that they were job searching. That opens an entire can of worms that creates problems beyond the pentest. This also angers other employees who see it as a double-trap being sprung on employees.
Another major problem is that responsible employees who accept the fake interview but then use their personal laptop to do the interview will have their personal laptop compromised by the pentesters. Responsible testers will immediately abort, but some will try to use the personal laptop to pivot deeper which is a huge ick. It’s also really bad if the company is compromising personal laptops of people who are doing the right thing (switching to personal gear for interviews).
Sometimes called "Full Spectrum Attack Simulation" where initial entry can include physical access or spear phishing. They can span months in elapsed time (not effort) so as to be more realistic. However there are still ethical and safety constraints and even phishing may not be able to use the (effective) technique of stressing the recipient too much or of course blackmail or coercing. So I think fake interviews may not be allowed in many cases, to protect the employees.
It'll be hard to time a job opening receiving interviews to line up with intrusion tests in a way that people would not be on guard against it in a way not normal.
Doing ANYTHING on a work issued laptop outside of your role is such a dumb idea for a litany of obvious reasons that I'm genuinely shocked people do it. Let alone participate in interviews for other companies on it.
In my last job we used Zoom for interviews. The link we sent would work in any web browser, but if the candidate was signed into a Zoom account on their computer we'd be able to see it. I'd say >70% of them were on their company account.
Even worse when you have to do stuff like screenshare or coding. I've had candidates share their screen and have obvious proprietary material in open windows. I've seen countless email inboxes and calendars. I've seen candidates do coding exercises using internal IDEs, dev environments and dev tools. I've had them talk – fully unprompted – about internal tech and unreleased projects. And I'm talking about Google, Meta, Amazon, Coinbase, Uber.
At this point I'm convinced that a large chunk of tech interviews are happening just to extract insider info from employees.
How does that prevent you from using your personal laptop for a job interview?
It would never occur to me to use an employer's hardware for such a purpose. It seems absurdly lazy, but I know that not everyone's life works like mine, so I would like to understand why this would be a real problem for people.
I had a really bad meeting one day that became the straw that broke the camel's back. When I went back to my desk, I saw an interesting job posting. I immediately fired up the company's copy of Word to draft up a resume, and used the company computer to send the email from my personal account. Less than a month later, I was working for the new company. It was done intentionally. I almost sent the resume via company email, but I really wanted to ensure I could access any response.
But if he'd done the interview on his personal laptop then he would have had his personal crypto wallet drained instead, seems like he came out ahead this way.
Working in a financial institution, I was surprised they could do all this. Our work laptops are so locked down (sometimes maybe too locked down) that we'd never be able to download a random .exe
I think Binance needs to start having IT Security like a bank as well.
It does boggle my mind as well. I’ve only ever worked in high security industries as a developer, and I’ve never had admin access unless I was on hardware deployment. Limited user accounts, Firewall blocks, Active Directory audits, and full file system and network log audits are the name of the game where I have been. Anything external gets flagged quickly by automation and anything severe gets an immediate phone call. Falling for a pen tester phishing more than once, getting your laptop stolen, and so on can get you on the poor performer list. It just seems obvious for critical domains.
Usually it starts with a locked down laptop, then request after request, you get more rights, even admin on the laptop because otherwise you can't do anything as a software developer.
Banks, at least in the U.S., are highly regulated and this would be very abnormal and subject to regulatory non-compliance, especially when the bank crosses into “big bank” territory. This stuff is regularly audited internally and externally.
Around 2005, my employer at the time did a refresh of our it equipment, replacing all the cheap stuff we had been acquired with. They asked everyone to say if they need a laptop, as desktops were the default at the time. I said I didn't, and was surprised when he turned out that almost everyone else said they did. Most of them didn't really need one, and presumably were planning to use them for personal stuff.
The company was a bit salty about this as laptops are more expensive, but they got them. And of course the company befitted, as that was the end of a clear separation between work and home. You have your laptop, you can answer email and attend meetings with people in other time zones. Before, it was easy; work stuff stayed on work computers and those didn't leave the office when you went home.
Not much around here, while it is tolerated for accessing something over the Web, the cyber security trainings explicitly mention being a possible way for job termination when something goes wrong, after installing anything not cleared by IT.
Yeah, I almost suspect a lot of these cases are BYOD (like the above commenter who said 70% of the Zoom interviews he hosted showed the candidate using their current company's Zoom account). I just can't imagine there are that many people dumb enough to interview on a "work computer" otherwise. In the world of small or less tech savvy companies, BYOD is pretty common.
It is one thing to do personal things on a work laptop, it is another all together to give your children free reign. Are there no penal measures taken to deter this anymore?
We are talking about highly educated people who work in software development (i.e. can assumed to have some minimum viable knowledge about computers), and not about the dumbest imaginable users.
> Don't be too proud of this technological terror you've constructed.
-Darth Vader.
Being able to make React components does not require you to be smarter than the average person.
You also have multiple types of intelligence. I worked with a brilliant intern once. The kid was over 100k in student loan debt and didn’t know the loans can’t get discharged.
> SWE's are the worst about security, I swear most are worse than the average person when it comes to security practices.
My experience is completely different: many software developers are rather paranoid with respect to security, and have quite a good (though far from expert-level) knowledge about security. It's rather that many software developers are quite hostile to security practices that are mostly "security theater" and obstructs them in doing their work.
It's an anecdote, but one of my coworkers has Steam installed on his MacBook (of all computers). He is a data scientist. Technically, we're only allowed to install software from an approved list maintained by the IT security team. They clearly aren't enforcing that policy, though.
I've worked for a couple companies whose stance on me having a linux work laptop was "fine, but you have to support yourself".
So despite it being a "company" computer I personally installed the blank SSD and installed Arch on it and did not install any company spyware.
I was perfectly comfortable also having Steam installed so I could entertain myself on the plane on business trips. I knew everything installed and spyware wasn't on the list.
When I work at companies that have MDM set up on my computer, I don't do that.
Anec-data - as an interviewer, last year, I had my first sketchy, perhaps 'North Korean', candidate.
The name on the CV, was, for the sake of privacy, Michael Smith, from Australia, and ticked the right boxes.
We'd expect a fluent, Aussie-accented English speaker. Instead, we had a candidate with a webcam that wouldn't work (weird!!), with clearly accented English of a East-Asian background. I suppose there's a vanishing chance they really were Mike Smith of Adelaide or wherever, but we couldn't take that chance. We tried rescheduling, but tumbleweeds...
Pretty funny that tech makes candidates jump through all sorts of automated, inhumane loops to even advance to talking to a real human in the hiring process.
I remember in the mid-90s going to an interview in Manhattan - pre-Internet. Someone met me and led me to a table and said, "Here's where you're going to take your test." I said, "I don't take tests." She said "Everyone that comes in takes the test". I said, "Well, that's no longer true because I came in and I'm leaving without taking the test"
While I love the "edgy-ness" of this, I remember doing something like this around 2013 in Manhattan and kind of enjoyed it. They had me go into a room, and gave me a paper with an open ended question: it was something along the lines of, write as much detail as I could about what happens when a user visits a URL in a web browser. E.g. explain as much as I know about TCP, HTTP requests, web servers, etc. I think I touched on how Cookies worked as well.
No AI, no leet code, just old fashioned gauging someone's experience and communication skills.
I'm fine with technical interviews that are "test-like", with questions and answers and discussion and with an engineer who is my technical equal. But this was not that.
The more inhumane the screener the worse the job in my experience.
Had one recently that waived me thru and then sent me straight to talking to senior management/stakeholders/etc but literally no one on the team itself.
Couldn’t get a straight answer as to what team does, what role is for, real day to day I’d be walking.
Only clear thing was scale of architectural mess stemming from a political mess… and not a lot of interest in changing it.
They wanted a seasoned tech body to throw into the grinder 12-15hr days to replace the last one. No thanks.
It's also for liability. If someone comes in with the intention of suing them, they can point to the test and have objective evidence that the rejection was not based on race or gender. It also allows them to gather data after the employee gets established and succeeds or fails.
Also in the mid 90s, you actually had to be smart to work in this field. There was no stack overflow or reddit to search. And CS programs were nascent.
Companies certainly have taken it too far, but I don't blame them for some usage of standard tests.
I honestly don't know what's so wrong about taking a test for a job, unless the job already requires some kind of certifications/licenses. I, personally, wish that my doctors and lawyers have passed some tests.
> I honestly don't know what's so wrong about taking a test for a job, unless the job already requires some kind of certifications/licenses.
You already have a degree from some university, and you already worked in software development for quite some time. So it's very annoying to do some test over and over again for every job application.
No one wants to talk about the "internal AI Tool" being used to elevate to not 1 but 2 DevOps engineers?
> use of an internal AI tool as a springboard. The attacker leveraged the compromised computer of engineer B and used an internal AI tool to gain control over the Wallet DevOps Engineer A and another Wallet Software Engineer C. The attacker soon discovered Wallet DevOps Engineer A had a container deployment permission token on his computer.
With the AI craze going on recently I've worked at multiple companies where an internal AI tool was vibecoded and I've always been worried about the security implications.
Imagine being able to steal billions in crypto from your work laptop and using same laptop to run code sent to you by another company. I wish I had their problems.
It is crazy that this Engineer A fell for this malware ad (how do people still fall for these & how does Google still get away with serving malware like that):
It is kind of weird that they mention it though, if they replaced the devices and rotated credentials? Just to later mention that an "internal AI tool" was used to steal that Engineer As credentials again?
And also, what are those "obfuscation techniques"? It looks very straight forward, replacing the pyenv, there's nothing much obfuscated in it? Except for putting it in a different folder.
I actually got contacted by North Koreans posing as Japanese VC looking to partner in the Nordics. I have an agent that scans my emails and does the inverse filtering, suggests when I should take a look. This is because I get insane amount of cold inbound. But it also flags suspicious emails and uses network tools to find out info about the sender. It flagged that one as a NK account (I later confirmed it was already flagged on the watch list in various reddit channels). Everyone should be arming themselves with email filtering agents now. What I’m worried about is grandmas and grandpas and general ppl that are behind the tech curve.
I have been getting these since early 2023, still, most of them are simple to spot, the other side typically has video turned off, asks a bit about your experience and just nods without digging, they are in a hurry to send you their coding challenge.
In one of these many calls I got to see the face from the other side but lasted a few seconds only. Then he claimed that internet was bad and suggested we continued without video.
In this case they claim it was a 2 rounds interview with video turned on to simulate a more normal recruiting process.
Of course all of us are prone to get caught with the shield off but what surprises me is that the targeted dev took the challenge in the device from work.
It's just a cherry on top of the existing hiring process in the IT. It wouldn't surprised that it will make things even worse - companies will be more scared to talk to anyone and good candidates will be scared to reply
If she hadn't done it on her work laptop, her personal would have been pwned anyway. It's not clear to me how to protect oneself while also looking for work.
My hunch is that this was partly an inside job. The "fake job interview" and "mistakenly downloaded trojaned homebrew" stories are to give plausible deniability. But they're not very plausible imho.
They are very plausible though. There are so many fake job interview scams right now thats its insane. I've personally come across multiple that ive noticed, who knows if there are any that I didnt.
A very recent one wanted me to download an executable which was to "stop me from cheating with AI", which was clearly fake. I've had plenty of interviews where I was expected to clone, fix, and run a repo, which as far as I can tell, all were from legitimate companies. An illegitimate company could easy do the same process with malware.
>> "...and is working with law enforcement, blockchain intel firms, and security researchers to trace and freeze the assets. The crypto exchange has also hired independent cybersecurity experts to conduct a cybersecurity review of the incident, and recommend additional protective measures."
>> trace and freeze the assets
It has gotten to the point where the advertised permanence of cryptocoin transactions is a serous national security threat, literally funneling $6+billion to a nation-state whose publicly avowed statements is to destroy the US to fund its nuclear weapons program.
The party is ending. The house lights are flashing. Crypto will either become controlled so illegitimate transactions will be roll-back-able (presumably with proper court or NatSec orders), or it will be banned.
This is Binance/CZ's version of the story, but no one really knows the truth.
They have a massive incentive to invent a story to cover up the incident. I'm not saying it's a cover-up, but the motive is definitely there.
North Korea has denied responsibility, whereas they usually own up to their actions.
Disregarding that, it just doesn't make sense for their internal security to be so lax.
I've worked at big companies but with AUM lower than Binance, a lot of control and safeguards are in place to prevent one "rogue" employee from stealing everything.
It's pretty much impossible for a company like Binance to not have implemented such things. I do not buy it.
Founder of Callstrike here .. we build real time deepfake & voice impersonation attack simulation tools for a living so this is literally what I deal with every day.
The biggest irony is that we get at least a couple of signups every month from South Korea, Russia, India, Nigeria just to try getting access to our platform for running these attacks ..
Here is the most recent copy paste from a Calendly invite ..
>Invitee Email:
>ashley@cairnsovereign.net
>Invitee Time Zone:
>Central European Time
>Questions:
>Please share anything that will help prepare for our meeting.
>We are an MSP from the UK that is look for a deepfake platform to run campaigns for our clients. We typically use open source software but there is a gap in our portfolio for deepfake testing that we can't fill with our usual open source philosophy.
The company website https://www.cairnsovereign.net/ was registered just 2 days ago .. they have no linkedin presence, fake CEO and fake CTO and fake everything ..
I still accepted the invite and joined and the person has a strong northern british accent .. he askd me to let his AI bot join the call to take notes ... i refused .. to which he swore and said that if a meeting bot is not allowed .. then i dont want to talk and abruptly hung up ...
PS: if anyone wants to see .. this is what a real time voice impersonation call and real time deepfake faceswap .. looks like ..
People from big companies I talk to all the time are now pulling into h I secops teams to literally assed whether a candidate is safe. It's getting very expensive.
What surprises me most about the Binance hacking story is that Binance employees seem to have used their work laptops for some "programming test" (whose purpose was - as we now know - spreading malware).
I mean: if you even consider leaving your current company, you better leave no traces of your plan on your work laptop: you either use a private laptop or, even better, some burner laptop/computer that you reset afterwards.
Probably. I have seen many colleagues across the cubicle aisles spending their time on things completely unrelated to their work. I would be baffled to hear that you have not had similar experiences.
As a hiring manager, do you hold that behavior against candidates for positions where poor security practices could become a major liability for your company?
Zoom exploits could have done this without downloads. I don't interview on a computer with sensitive data, it's usually a throwaway. I sometimes get judged for doing the interview on a Chromebook or an old Mac and I hope that interviewers understand why I choose to do it this way.
A lot of detail on what Engineer A, B and C did. But this would've been prevented if Engineer A didn't have "a container deployment permission token on his computer".
What the fuck? On a target as big as Binance? Every developer should be treated as a liability and never be able to deploy by themselves.
Not as easy as that, these can be real people with genuine businesses across the other side of the world, which sounds like what happened here. They only have to seem friendly and genuine before asking you to perform a coding test or whatever.
Unfortunately:
1) The dev downloaded it onto a work laptop which was really poor behaviour
2) It sounds like the developer environment was very open instead of segmented. Common but an easy control to use in a high-risk environment.
3) Sounds like a lack of any elevation process e.g. if a developer needed to access a wallet, it very much should sound an alarm/require explicit permission etc.
I think we need to implement a new handshake protocol for job interviews.
Both candidate and recruiter have to call Kim Jong Un a big fat tosser (other swearwords are available) on a recorded video before the interview continues.
A lot of people are focusing on how irresponsible the engineer was about using the work computer. That's obviously an issue but the bigger failure mode to me is the Engineer C's container deployment token.
That's a huge red-flag. In a company of this size, the deployments should be via CI only. CI isn't just to increase the speed and reliability of deployments but also to provide a clean room to build the software! Even if it's a token that was copied and pasted temporarily, the systems in place should not have to require this type of 1. copy 2. paste 3. remember-to-delete the token from my PC.
Also, Binance should be paying for intrusion testing. Better to pay a trusted company to do this kind of thing instead of letting North Korea show you how it's done. I don't think this exact exploit path would have been found but I bet the intrusion testing would have figured out another way to use Engineer C's token.
> Even if it's a token that was copied and pasted temporarily, the systems in place should not have to require this type of 1. copy 2. paste 3. remember-to-delete the token from my PC.
One of the first things I did in my last job was shift processes like this off my team's computers, aside from the security ramifications all it takes is one dumb mistake, one up-arrow too many, one didn't-read-the-whole-line, and now you're doing something to production by accident!
I also did that, for a team deploying smart contract on chain from local.
It took a couple months to get the pipeline out of their laptop.
Worth it, yes, as we found interesting things in there which explained why they were so reluctant to deploy upgrades.
> as we found interesting things in there which explained why they were so reluctant to deploy upgrades
.. backdoors which enabled the dev to deploy exploits of their own which wouldn't be visible through CI?
I have saw companies doing social engineering as part of their intrution testing, I imagine fake interviews are (or will become) part of these.
I think it will remain uncommon. I agree it would be a good test, but companies and employees alike get very angry when pentesting gets too close to sensitive subjects.
Anyone who fell for it would not only get in trouble for poor security practice, they would reveal that they were job searching. That opens an entire can of worms that creates problems beyond the pentest. This also angers other employees who see it as a double-trap being sprung on employees.
Another major problem is that responsible employees who accept the fake interview but then use their personal laptop to do the interview will have their personal laptop compromised by the pentesters. Responsible testers will immediately abort, but some will try to use the personal laptop to pivot deeper which is a huge ick. It’s also really bad if the company is compromising personal laptops of people who are doing the right thing (switching to personal gear for interviews).
Sometimes called "Full Spectrum Attack Simulation" where initial entry can include physical access or spear phishing. They can span months in elapsed time (not effort) so as to be more realistic. However there are still ethical and safety constraints and even phishing may not be able to use the (effective) technique of stressing the recipient too much or of course blackmail or coercing. So I think fake interviews may not be allowed in many cases, to protect the employees.
It'll be hard to time a job opening receiving interviews to line up with intrusion tests in a way that people would not be on guard against it in a way not normal.
Fake interviews would be a huge time sink and probably piss off your staff.
They don't have to respond. It gives employers an even stronger signal they should be kept right?
Using pentesting to also test employee loyalty is a great way to get the entire company to hate working there.
Doing ANYTHING on a work issued laptop outside of your role is such a dumb idea for a litany of obvious reasons that I'm genuinely shocked people do it. Let alone participate in interviews for other companies on it.
In my last job we used Zoom for interviews. The link we sent would work in any web browser, but if the candidate was signed into a Zoom account on their computer we'd be able to see it. I'd say >70% of them were on their company account.
Even worse when you have to do stuff like screenshare or coding. I've had candidates share their screen and have obvious proprietary material in open windows. I've seen countless email inboxes and calendars. I've seen candidates do coding exercises using internal IDEs, dev environments and dev tools. I've had them talk – fully unprompted – about internal tech and unreleased projects. And I'm talking about Google, Meta, Amazon, Coinbase, Uber.
At this point I'm convinced that a large chunk of tech interviews are happening just to extract insider info from employees.
as a candidate it's pretty tough scheduling interviews past 5pm or on the weekends
Which is why time off exists, at least on countries with civilised labour laws.
No need to take the day off. It's pretty common to be "sick" when you have an interview.
What’s preventing you from using a personal laptop ?
Their current job, presumably
How does that prevent you from using your personal laptop for a job interview?
It would never occur to me to use an employer's hardware for such a purpose. It seems absurdly lazy, but I know that not everyone's life works like mine, so I would like to understand why this would be a real problem for people.
I had a really bad meeting one day that became the straw that broke the camel's back. When I went back to my desk, I saw an interesting job posting. I immediately fired up the company's copy of Word to draft up a resume, and used the company computer to send the email from my personal account. Less than a month later, I was working for the new company. It was done intentionally. I almost sent the resume via company email, but I really wanted to ensure I could access any response.
Hi Bob, why are you using your personal laptop at your desk instead of the company's laptop?
If you are openly interviewing for other jobs from your desk I don't think which laptop you use is going to be anyone's concern.
But if he'd done the interview on his personal laptop then he would have had his personal crypto wallet drained instead, seems like he came out ahead this way.
Found the optimist
Working in a financial institution, I was surprised they could do all this. Our work laptops are so locked down (sometimes maybe too locked down) that we'd never be able to download a random .exe
I think Binance needs to start having IT Security like a bank as well.
It does boggle my mind as well. I’ve only ever worked in high security industries as a developer, and I’ve never had admin access unless I was on hardware deployment. Limited user accounts, Firewall blocks, Active Directory audits, and full file system and network log audits are the name of the game where I have been. Anything external gets flagged quickly by automation and anything severe gets an immediate phone call. Falling for a pen tester phishing more than once, getting your laptop stolen, and so on can get you on the poor performer list. It just seems obvious for critical domains.
Usually it starts with a locked down laptop, then request after request, you get more rights, even admin on the laptop because otherwise you can't do anything as a software developer.
Banks, at least in the U.S., are highly regulated and this would be very abnormal and subject to regulatory non-compliance, especially when the bank crosses into “big bank” territory. This stuff is regularly audited internally and externally.
Most banks give you a crippled version of Admin rights via a 3rd party tool. If you need more than that, tough/you're doing it wrong.
You can dev without admin.
ah but that is boring, disruptive and too sysadminny. Its like the 90s. Cool companies have macbooks with full local admin. Devs need full access.
Cryptocurrency is like finding out why financial regulations exist speedrun
I do know people who no longer have a personal computer, and use exclusively their work-issued computer. I wonder how common that is.
Around 2005, my employer at the time did a refresh of our it equipment, replacing all the cheap stuff we had been acquired with. They asked everyone to say if they need a laptop, as desktops were the default at the time. I said I didn't, and was surprised when he turned out that almost everyone else said they did. Most of them didn't really need one, and presumably were planning to use them for personal stuff.
The company was a bit salty about this as laptops are more expensive, but they got them. And of course the company befitted, as that was the end of a clear separation between work and home. You have your laptop, you can answer email and attend meetings with people in other time zones. Before, it was easy; work stuff stayed on work computers and those didn't leave the office when you went home.
Here it doesn't matter, the employees aren't required, by law, to answer any of that.
Not much around here, while it is tolerated for accessing something over the Web, the cyber security trainings explicitly mention being a possible way for job termination when something goes wrong, after installing anything not cleared by IT.
May be the opposite, but BYOD is a thing and has the same result, security-wise…
Yeah, I almost suspect a lot of these cases are BYOD (like the above commenter who said 70% of the Zoom interviews he hosted showed the candidate using their current company's Zoom account). I just can't imagine there are that many people dumb enough to interview on a "work computer" otherwise. In the world of small or less tech savvy companies, BYOD is pretty common.
Usually BYOD requires IT clearance and installation of the same management software like company devices.
A lot of people just think laptop == laptop.
At several companies I’ve seen folks run torrents to watch movies at work.
Once I was on a Zoom call, and I noticed music production software on my colleagues computer.
When I pointed it out, they responded with something like “ Ohh, my kids make music.”
Neat, I guess.
>Ohh, my kids make music.
It is one thing to do personal things on a work laptop, it is another all together to give your children free reign. Are there no penal measures taken to deter this anymore?
> A lot of people just think laptop == laptop.
We are talking about highly educated people who work in software development (i.e. can assumed to have some minimum viable knowledge about computers), and not about the dumbest imaginable users.
> Don't be too proud of this technological terror you've constructed.
-Darth Vader.
Being able to make React components does not require you to be smarter than the average person.
You also have multiple types of intelligence. I worked with a brilliant intern once. The kid was over 100k in student loan debt and didn’t know the loans can’t get discharged.
SWE's are the worst about security, I swear most are worse than the average person when it comes to security practices.
"Need some new software" = "Download it from some random website"
"Software won't run" = "Turn off AV and get it everything permission"
"Still won't run" = "run as root"
> SWE's are the worst about security, I swear most are worse than the average person when it comes to security practices.
My experience is completely different: many software developers are rather paranoid with respect to security, and have quite a good (though far from expert-level) knowledge about security. It's rather that many software developers are quite hostile to security practices that are mostly "security theater" and obstructs them in doing their work.
The following Reddit post
> https://www.reddit.com/r/NonPoliticalTwitter/comments/1e8do2...
and the top answer
> https://www.reddit.com/r/NonPoliticalTwitter/comments/1e8do2...
describe the mindset that I observe rather well.
> We are talking about highly educated people
That's a bit of charity isn't it? Lot's of people in tech that really not that clever even if they are smart. Also, people in HR aren't as tech savvy.
Nearly all people who work in tech have a university degree, many even a PhD.
It's an anecdote, but one of my coworkers has Steam installed on his MacBook (of all computers). He is a data scientist. Technically, we're only allowed to install software from an approved list maintained by the IT security team. They clearly aren't enforcing that policy, though.
Don't worry, they'll enforce it when someone installs something unapproved and it causes a problem.
Thanks for the laughs.
No, 'people who work in software development' != 'highly educated people' and those both != 'understand how computers work'.
> highly educated people who work in software development
> dumbest imaginable users.
They are often one and the same.
This!
I don't know how people are ok using their personal accounts on work-laptops full of spyware.
I've worked for a couple companies whose stance on me having a linux work laptop was "fine, but you have to support yourself".
So despite it being a "company" computer I personally installed the blank SSD and installed Arch on it and did not install any company spyware.
I was perfectly comfortable also having Steam installed so I could entertain myself on the plane on business trips. I knew everything installed and spyware wasn't on the list.
When I work at companies that have MDM set up on my computer, I don't do that.
It's dumb ideas all the way down, starting with the fact that this work laptop had a direct path to a multi-billion dollar signing environment.
It's convenient. I'm not lugging two laptops around!
Interviewing for another company on your work laptop is levels of idgaf I can't achieve
Well so-rry but if you give me a macbook powerful enough to play cyberpunk 2077 on it, that's what I'm gonna do.
At least dual-boot a second OS that they have no control over.
I highly doubt that a company will like that you dual boot their machines.
lol maybe the employees wanted the company to see it.
Anec-data - as an interviewer, last year, I had my first sketchy, perhaps 'North Korean', candidate.
The name on the CV, was, for the sake of privacy, Michael Smith, from Australia, and ticked the right boxes.
We'd expect a fluent, Aussie-accented English speaker. Instead, we had a candidate with a webcam that wouldn't work (weird!!), with clearly accented English of a East-Asian background. I suppose there's a vanishing chance they really were Mike Smith of Adelaide or wherever, but we couldn't take that chance. We tried rescheduling, but tumbleweeds...
Pretty funny that tech makes candidates jump through all sorts of automated, inhumane loops to even advance to talking to a real human in the hiring process.
And now you get results like this.
I remember in the mid-90s going to an interview in Manhattan - pre-Internet. Someone met me and led me to a table and said, "Here's where you're going to take your test." I said, "I don't take tests." She said "Everyone that comes in takes the test". I said, "Well, that's no longer true because I came in and I'm leaving without taking the test"
While I love the "edgy-ness" of this, I remember doing something like this around 2013 in Manhattan and kind of enjoyed it. They had me go into a room, and gave me a paper with an open ended question: it was something along the lines of, write as much detail as I could about what happens when a user visits a URL in a web browser. E.g. explain as much as I know about TCP, HTTP requests, web servers, etc. I think I touched on how Cookies worked as well.
No AI, no leet code, just old fashioned gauging someone's experience and communication skills.
I did this as a test in 2018! Compares to the leetcode screens now, it was a dream
I'm fine with technical interviews that are "test-like", with questions and answers and discussion and with an engineer who is my technical equal. But this was not that.
The more inhumane the screener the worse the job in my experience.
Had one recently that waived me thru and then sent me straight to talking to senior management/stakeholders/etc but literally no one on the team itself.
Couldn’t get a straight answer as to what team does, what role is for, real day to day I’d be walking.
Only clear thing was scale of architectural mess stemming from a political mess… and not a lot of interest in changing it.
They wanted a seasoned tech body to throw into the grinder 12-15hr days to replace the last one. No thanks.
I'm confused, I'm probably missing here something.
By 'test' you mean a school-type paper exam, questions and answers? (On unspecified topics.)
Why would you refuse that, when applying to a job?
And I bet you both came away from that interview feeling like you’d dodged a bullet. The interviewer just as much as yourself.
Wow how tough.
It's also for liability. If someone comes in with the intention of suing them, they can point to the test and have objective evidence that the rejection was not based on race or gender. It also allows them to gather data after the employee gets established and succeeds or fails.
Also in the mid 90s, you actually had to be smart to work in this field. There was no stack overflow or reddit to search. And CS programs were nascent.
Companies certainly have taken it too far, but I don't blame them for some usage of standard tests.
I honestly don't know what's so wrong about taking a test for a job, unless the job already requires some kind of certifications/licenses. I, personally, wish that my doctors and lawyers have passed some tests.
More often than not the test is at best tangentially related to the role.
At worst it’s the biggest hardos on the team writing a bunch of brain teasers and gotchas as a hazing ritual.
> I honestly don't know what's so wrong about taking a test for a job, unless the job already requires some kind of certifications/licenses.
You already have a degree from some university, and you already worked in software development for quite some time. So it's very annoying to do some test over and over again for every job application.
Excellent choice! No amount of money feels as good as claiming the respect you deserve.
Haha owned
No one wants to talk about the "internal AI Tool" being used to elevate to not 1 but 2 DevOps engineers?
> use of an internal AI tool as a springboard. The attacker leveraged the compromised computer of engineer B and used an internal AI tool to gain control over the Wallet DevOps Engineer A and another Wallet Software Engineer C. The attacker soon discovered Wallet DevOps Engineer A had a container deployment permission token on his computer.
With the AI craze going on recently I've worked at multiple companies where an internal AI tool was vibecoded and I've always been worried about the security implications.
Imagine being able to steal billions in crypto from your work laptop and using same laptop to run code sent to you by another company. I wish I had their problems.
It is crazy that this Engineer A fell for this malware ad (how do people still fall for these & how does Google still get away with serving malware like that):
https://isc.sans.edu/diary/32942
It is kind of weird that they mention it though, if they replaced the devices and rotated credentials? Just to later mention that an "internal AI tool" was used to steal that Engineer As credentials again?
And also, what are those "obfuscation techniques"? It looks very straight forward, replacing the pyenv, there's nothing much obfuscated in it? Except for putting it in a different folder.
Let's not victim blame plz
I was #opentowork on LinkedIn and got approached multiple times with fake companies and interviews. LinkedIn is not doing enough to combat this.
I even create a 1 man company for my consulting services and I receive ads about how people at my company saved me a spot on an online game.
LinkedIn is partially responsible for their neglect here.
I actually got contacted by North Koreans posing as Japanese VC looking to partner in the Nordics. I have an agent that scans my emails and does the inverse filtering, suggests when I should take a look. This is because I get insane amount of cold inbound. But it also flags suspicious emails and uses network tools to find out info about the sender. It flagged that one as a NK account (I later confirmed it was already flagged on the watch list in various reddit channels). Everyone should be arming themselves with email filtering agents now. What I’m worried about is grandmas and grandpas and general ppl that are behind the tech curve.
How would the North Koreans profit from hacking grandma's PC?
Compromise the pc and use it a zombie for other ops. That's one example.
Source posted earlier: "29 October Binance Security Incident: Initial Findings and Response Update" https://news.ycombinator.com/item?id=50359377
Pretty lame of The Register not to reference the original source.
> Pretty lame of The Register not to reference the original source.
They did, in their sentence "the incident report said".
Why did the employee have direct access to $6.3 billion in customer funds?
No directly, but he could deploy code that had access to customers' wallets. Which is even worse.
I have been getting these since early 2023, still, most of them are simple to spot, the other side typically has video turned off, asks a bit about your experience and just nods without digging, they are in a hurry to send you their coding challenge.
In one of these many calls I got to see the face from the other side but lasted a few seconds only. Then he claimed that internet was bad and suggested we continued without video.
In this case they claim it was a 2 rounds interview with video turned on to simulate a more normal recruiting process.
Of course all of us are prone to get caught with the shield off but what surprises me is that the targeted dev took the challenge in the device from work.
Running interview assignment on a work computer… tsk tsk
at the very least, run it inside a docker container (making sure of network and volumes i would say)
Hindsight is 20/20. Although why aren't assignments just a pdf
"This code has multiple faults. Your task is to find and fix them all."
didn't specify the eng's role but oh the irony if the assignment was for a SecOps job :)
This is what I was trying to figure out. Did they think it was for an internal role or something?
Some people just make really dumb decisions.
Like giving people direct access to $6.3 billion?
It was rather indirect access.
Further evidence that 1) recruiting is broken and 2) developers make great targets, and we need to respond accordingly.
Pretty sure it was his last job interview ever
It's just a cherry on top of the existing hiring process in the IT. It wouldn't surprised that it will make things even worse - companies will be more scared to talk to anyone and good candidates will be scared to reply
How do these dumb people that have access to billions of funds fall to these fake interviews?
You don't know how deep the rabbit hole goes. Maybe the interviewer thinks they are hiring for a real job.
If she hadn't done it on her work laptop, her personal would have been pwned anyway. It's not clear to me how to protect oneself while also looking for work.
These are simply malicious interviews, not fake. If your company is important enough, you've got one or two inside already.
I think we have reached peak whatever we're in. I think from here on out, things are gonna change.
Good thing they didn't get anything important.
If you want to learn more about the Lazarus group behind this heist, the BBC did an excellent podcast on another one of their operations:
https://www.bbc.com/audio/series/w27vqd03
(It's also on Spotify, Apple Podcasts etc)
My hunch is that this was partly an inside job. The "fake job interview" and "mistakenly downloaded trojaned homebrew" stories are to give plausible deniability. But they're not very plausible imho.
They are very plausible though. There are so many fake job interview scams right now thats its insane. I've personally come across multiple that ive noticed, who knows if there are any that I didnt.
A very recent one wanted me to download an executable which was to "stop me from cheating with AI", which was clearly fake. I've had plenty of interviews where I was expected to clone, fix, and run a repo, which as far as I can tell, all were from legitimate companies. An illegitimate company could easy do the same process with malware.
>> "...and is working with law enforcement, blockchain intel firms, and security researchers to trace and freeze the assets. The crypto exchange has also hired independent cybersecurity experts to conduct a cybersecurity review of the incident, and recommend additional protective measures."
>> trace and freeze the assets
It has gotten to the point where the advertised permanence of cryptocoin transactions is a serous national security threat, literally funneling $6+billion to a nation-state whose publicly avowed statements is to destroy the US to fund its nuclear weapons program.
The party is ending. The house lights are flashing. Crypto will either become controlled so illegitimate transactions will be roll-back-able (presumably with proper court or NatSec orders), or it will be banned.
This is Binance/CZ's version of the story, but no one really knows the truth.
They have a massive incentive to invent a story to cover up the incident. I'm not saying it's a cover-up, but the motive is definitely there.
North Korea has denied responsibility, whereas they usually own up to their actions.
Disregarding that, it just doesn't make sense for their internal security to be so lax.
I've worked at big companies but with AUM lower than Binance, a lot of control and safeguards are in place to prevent one "rogue" employee from stealing everything.
It's pretty much impossible for a company like Binance to not have implemented such things. I do not buy it.
Founder of Callstrike here .. we build real time deepfake & voice impersonation attack simulation tools for a living so this is literally what I deal with every day.
The biggest irony is that we get at least a couple of signups every month from South Korea, Russia, India, Nigeria just to try getting access to our platform for running these attacks ..
Here is the most recent copy paste from a Calendly invite ..
>Invitee Email: >ashley@cairnsovereign.net
>Invitee Time Zone: >Central European Time
>Questions:
>Please share anything that will help prepare for our meeting.
>We are an MSP from the UK that is look for a deepfake platform to run campaigns for our clients. We typically use open source software but there is a gap in our portfolio for deepfake testing that we can't fill with our usual open source philosophy.
The company website https://www.cairnsovereign.net/ was registered just 2 days ago .. they have no linkedin presence, fake CEO and fake CTO and fake everything ..
I still accepted the invite and joined and the person has a strong northern british accent .. he askd me to let his AI bot join the call to take notes ... i refused .. to which he swore and said that if a meeting bot is not allowed .. then i dont want to talk and abruptly hung up ...
PS: if anyone wants to see .. this is what a real time voice impersonation call and real time deepfake faceswap .. looks like ..
https://www.callstrike.ai/deepfake-security-training
https://www.callstrike.ai/voice-phishing-simulator
People from big companies I talk to all the time are now pulling into h I secops teams to literally assed whether a candidate is safe. It's getting very expensive.
It's one of the reason ojcp exists.
What surprises me most about the Binance hacking story is that Binance employees seem to have used their work laptops for some "programming test" (whose purpose was - as we now know - spreading malware).
I mean: if you even consider leaving your current company, you better leave no traces of your plan on your work laptop: you either use a private laptop or, even better, some burner laptop/computer that you reset afterwards.
Am I the only one baffled by the fact that the engineer uses a work PC for a personal job interview assignment?
Probably. I have seen many colleagues across the cubicle aisles spending their time on things completely unrelated to their work. I would be baffled to hear that you have not had similar experiences.
Well I've done the same too. But I would not use my work PC.
I don't even use my home PC for interviews, but instead use a refurbed laptop with a clean OS install.
Absolutely. Yet as a hiring manager, I see it all the time.
As a hiring manager, do you hold that behavior against candidates for positions where poor security practices could become a major liability for your company?
[dupe] https://news.ycombinator.com/item?id=50353818
Zoom exploits could have done this without downloads. I don't interview on a computer with sensitive data, it's usually a throwaway. I sometimes get judged for doing the interview on a Chromebook or an old Mac and I hope that interviewers understand why I choose to do it this way.
What are these zoom exploits?
A lot of detail on what Engineer A, B and C did. But this would've been prevented if Engineer A didn't have "a container deployment permission token on his computer".
What the fuck? On a target as big as Binance? Every developer should be treated as a liability and never be able to deploy by themselves.
I love these guys!
It's strange companies haven't cracked something as basic as remote hiring checks yet.
There are tools available to stop AI screen recording tools, fake candidate tools yet many companies keep getting hit..
Not as easy as that, these can be real people with genuine businesses across the other side of the world, which sounds like what happened here. They only have to seem friendly and genuine before asking you to perform a coding test or whatever.
Unfortunately:
1) The dev downloaded it onto a work laptop which was really poor behaviour
2) It sounds like the developer environment was very open instead of segmented. Common but an easy control to use in a high-risk environment.
3) Sounds like a lack of any elevation process e.g. if a developer needed to access a wallet, it very much should sound an alarm/require explicit permission etc.
But it is easy to be wise in hindsight.
It seems in this case really poor behaviour and practices, I can imagine some security engineer shouting I told you so pretty loudly.
On the other end, when doing interviews I suspect 40-50% of candidates use AI assistant tools (might be skewed in tech).
I do miss seeing someone's camera feed break or AI tool break down mid interview.
I think we need to implement a new handshake protocol for job interviews.
Both candidate and recruiter have to call Kim Jong Un a big fat tosser (other swearwords are available) on a recorded video before the interview continues.
https://www.youtube.com/watch?v=g7v2clX8ynE