A few weeks ago, I had an interview with a CTO of a totally legit company. It was weird because he had disabled the camera, and the person had a strong accent. But everything else sounded like a normal screening interview, and the person definitely knew what he was talking about. At the end of the interview, he explained to me that during the technical interview I would need to make some modifications to their project (it's an OSS product), so he asked me to clone the repo and check the setup.

Later, the HR person said the CTO got sick, so the interview would be postponed. But a few days later, the HR profile was deleted from LinkedIn. It was super weird, but it didn't trigger my suspicion until I saw this post on HackNews. I checked, and the repo I was cloning and running during the interview had a malware payload.

P.S. I think it was a targeted attack because in the past I maintained a very popular NPM package with 43+M weekly downloads. That's my only explanation for why someone would carry out such a sophisticated social-engineering attack against me.

P.P.S. It's great that I have 2FA everywhere, and I always publish NPM packages manually without using tokens. But I need to wipe my laptop and reinstall everything.

Going to need containerised vscode in this world.

Just give me the specification and I will build it end to end myself.

If you’re serious you would consider it. If you don’t - I dodged a bullet.

If you consider that people are using LLMs for code generation pretty much exclusively now this should be possible with any stack.

Though other stuff on your system might be less preventative, and that could run stuff in the repo folder. And I kinda wish git would force review of hooks and executable config everywhere before they're run - I would absolutely enable that, security is sometimes a bit annoying and that's inescapable.

I checked other similar threads on HN, but they don't mention an actual Google Meet call with a scammer.

> I maintained a very popular NPM package with 43+M weekly downloads

makes sense why they targetted you, good that you have 2FA enabled.

Glad the scumbags didn’t get anything but your time.

Seems like this is becoming a recurring theme, similar story was on the front page last month.

https://news.ycombinator.com/item?id=48546294

If the victim is deep enough to check hook's content, it's unlikely they will just stop here losing suspicion. I'm sure most devs wouldn't think that doing `git commit` can be malicious (git security oversight?).

Executing downloaded code without prior review always is these days, regardless of the tool that does it.

Maybe they don't want to give any identifying info to the domain registrar? Or just minimizing their online presence?

http://www.catb.org/jargon/html/H/hacker.html

> 1. A person who enjoys exploring the details of programmable systems and how to stretch their capabilities, as opposed to most users, who prefer to learn only the minimum necessary. RFC1392, the Internet Users' Glossary, usefully amplifies this as: A person who delights in having an intimate understanding of the internal workings of a system, computers and computer networks in particular.

> 2. One who programs enthusiastically (even obsessively) or who enjoys programming rather than just theorizing about programming.

they added this back in 2023 (https://news.linkedin.com/2023/april/linkedin-s-new-verifica...), but very less people actually bother to verify with their email, so not having it doesn't always mean it's illegitimate.

I would imagine a lot of what went on then, is going on now with all the AI jobs and demand for people who have even a cursory knowledge of LLM's and automation.

It doesn't. VSCode dev replied here on it here: https://news.ycombinator.com/item?id=46719712.

But, I don't think anybody pays attention to the workspace trust. When ".vscode" has launch commands, it should rather say, "Trusting this workspace runs the following command on your behalf" or something similar.

  > "I will probably not use vs code at all for untrusted repos now"

Unrelated to this git pre commit hook attack but yeah

Looks like these folks really did their homework.

It's nasty, but I have to respect their skills. I'll bet it works, quite often.

I suspect it's clever, experienced, engineers, leveraging LLMs.

I stopped being surprised by new stuff I learn about an OS I've been using for 25+ and 10+ as my daily whip and just enjoy the discovery-buzz

these take-home interview nightmare stories are so common ... I'd hate to see a bad actor take advantage by offering a "service" to unsuspecting and underinformed folks like ... erm ... me

I'm not talking about switching to cold contacting companies as a job hunting strategy. I'm saying if you get a suspicious outreach from a rando on linked in on behalf of a company THEN you only continue if you can reach out to the same person via official company channels.

actual first party recruiter’s linkedin inbox is unusable full of candidates trying to take initiative, and there is no way to reach anyone from the company from the outside cold specifically to avoid that exact thing

Give defenders a better shot…

Clearly, judging by recent openai news, sandboxes are not unbreakable, but at least there's nothing worth stealing and you throw it away afterward.

should i remove it?

there is no place for fun, whimsy, moods, or personalization on the web. sorry.

(no, at least not at the request of random internet stranger #10545346)

I joke, anyway, and bear the downvotes. Totally worth it.

Regardless, that's a pretty sneaky scam, and definitely something that caught out a ton of would be candidates in the past. What's more, the Visual Studio Code project mentioned in the article sounds even more horrifying. Like, the tool seriously lets you run custom code whenever someone opens your project? That feels like a really blatant malware vector that should probably have at least some sort of security mitigation...

It's also rather worrying how little these job sites are doing about scams like this too. I get it, it's perhaps a bit difficult to catch out all kinds of wrongdoing here. But you'd think it'd be simple enough to restrict accounts from claiming to be associated with a company or organisation if there's no proof they work there. At the moment, you can basically claim to work for any company you like, or that you have any type degree from any institution under the sun. If this was verified in any real way, and messages had a large warning at the top if the original claiming to be from an organisation wasn't confirmed to work there, a lot of scams would far more difficult to pull off.

Why not attack them through the C2 interface? That's where I'd expect them to slip up.

do you mean the machine which is connected through the victim's machine? if so, i should put this in a VM, run and see where it's sending/receiving requests from. i'll do that.

You can intentionally infect a machine with the malware but then watch the traffic between the victim node and the C2 server. If you get lucky, the C2 server assumes that the victim node is trusted and doesn't sanity check victim->server communication.

Note that this cranks up the danger quite a few notches, though it sounds like you know what you're doing.

Thankfully all my browsers are now configured to mute all sound from all sites until I grant express permission to play sound. Nips it in the bud, every time!

I declined, as diplomatically as I could. I should not have to spell out in precise detail how dangerous to me their proposal was. In the eyes of an adversary/APT predator: ignorant --> naive --> gullible --> prey --> profit. Rinse, repeat, scale up.

I'd need to see a number of red flags before interpreting a corporate laptop as an attack vector though.

And if it is an attack vector, hey, free laptop right? (OK, giving an adversary your home address is an issue, but not giving your employer your home address would be seen by the employer as an issue, so more of an impasse).

  git config --global core.hooksPath /dev/null

Discord communities I am in for programming are similar. People show up and within a few days either ask for a job or suggest cooperation. Sure, you could argue these Discord people may actually be out of a job (in this economy, very likely), but the volume and similarity of the messages say otherwise. You can also tell people show up in... _weird places_ to ask for jobs. An example being the Discord community for a not-really-used Python library with ~0 actual activity - either this person is very bad at finding good places to jobhunt or some attacker is just crawling a list of Discord communities and attacking them all.

It's a shame but there are a _lot_ of attacks that abuse our trust in each other nowadays. A good reminder to, like mom and dad said, never trust strangers on the internet

I was asked quickly about my experienced and he shared that I was a perfect fit, immediatelly I was asked for my github username, then, I was asked to share my screen, I ended the call to not waste more time but my guess is that I would be asked to do something with the project live.

I haven't dig into their malware approach (yet) but this pattern is too frequent to easily recognize it.

In my case it was a .vscode hook. Stay safe out there :)

  git config --global core.hooksPath /dev/null

  git config core.hooksPath "$PWD/.git/hooks"

> You don’t even have to run a git command, just opening this directory in VSCode is enough to get infected.

The old adage that Microslop and Security in the same sentence is a contradiction in terms still applies, now with a vengeance.

Never open 3rd-party stuff with VSCode.

until we do that, VSCode doesn't let us interact with the codebase, so we end up clicking that trust as soon as we open the directory and move on.

When VSCode detects launch commands in ".vscode", It should be rather explicit about running it, like "Trusting this workspace runs the following command on your behalf"

2. restrict outbound connections to known malicious IPs or domains.

3. run untrusted code/apps:

   - under a different user
   - or inside a sandbox
   - or in a VM

LOL, is that shit being worked on by former Outlook developers, bringing with them their zero click bags of tricks?

If you want to hire me, I do not want to see your code until I see money from you.

I do not want your code on my computer until there is a contract and quite a lot of money in my account. Even then, I'd prefer you to keep your code on your computers, which I will connect to.

For a "take-home interview"? You want me to work for you for free? Nah. Pay me.

I also try to talk to people at the company, but I mean employees I can verify independently, not whoever the recruiter puts in front of me. From the stories here, the person on the call can be the scammer, so a convincing conversation isn't proof on its own.

Wow.