North Korea makes finding a gig even harder by attacking candidates and employers

Palo Alto Networks' Unit 42 has detailed a pair of job market hacking schemes linked to state-sponsored actors in North Korea: one in which the threat actors pose as job seekers, the other as would-be employers. One of the schemes, named Contagious Interview, sees threat actors pose as potential employers to lure software …

[An_Old_Dog]

How Many Gullible Programmers *ARE* There in the Wild?

Interviewer: I'd like you to review some code. Drop to a terminal, make a fresh directory, cd to it, then git clone this: https://github.com/mrmapledonutscorp/...

Any_Non-Gullible_Programmer: Sure, just let me fire up a fresh virtual machine ...

[JamesTGrant]

Re: How Many Gullible Programmers *ARE* There in the Wild?

My guess is this would work 9/10 times.

Interviewee wants to please, and do things quickly.

A simple git clone into a ‘all my favourite things’ workspace would be fine - it’s just text init…

That’s often the tactic in social engineering, the first step is low risk and establishes trust and compliance.

I assume they have an extension that’s compromised, or their next instruction is ‘give this buddah privileges and open this in a web browser’…

I wonder how many of the dodgy applicants end up applying for the dodgy job posts - like that comedy where everyone in a terrorist organisation was an undercover agent but all from different agencies.

[druck]

Re: How Many Gullible Programmers *ARE* There in the Wild?

The git clone should be OK, but don't do a make without checking the makefile carefully. Better still have a sandboxed VM ready for any interview tasks.

[elsergiovolador]

Re: How Many Gullible Programmers *ARE* There in the Wild?

Any remotely serious programmer:

Interviewer: I'd like you to review some code.

Candidate: Charge for this service is £150 per hour + VAT. Do you want to proceed?

[JimmyPage]

How come we never hear stories

Of non-gullible hackers using this trick to backload some malware up to our Norky chums ?

What do you mean "what do I think we've been doing for years ?" ?

[Anonymous Coward]

Typo alert

"role sin" should be "roles in". A spelling checker would not pick this up because the typo version is still valid words. Or do we need some puns about sinful roles?