North Korean fake job interview led to $6.3B Binance heist

Re:North Korean fake job interview led to $6.3B Binance heist by FitchApps on Wednesday November 04, 2026 @01:28PM (#50369579)

And you never, ever, ever install software as part of the interview. Decline and hang up if they're asking you to install stuff. Visiting websites - maybe but even that unless it's a well known website I wouldn't go there but download and install stuff, hells no

[ Parent | on HN ]

Re:North Korean fake job interview led to $6.3B Binance heist by cldellow on Wednesday November 04, 2026 @02:33PM (#50370441)

"fork this repo and fix this bug" is a common job interview request, isn't it?

For many build chains, that involves implicitly installing software.

[ Parent | on HN ]

Re:North Korean fake job interview led to $6.3B Binance heist by fc417fc802 on Wednesday November 04, 2026 @06:17PM (#50372791)

Such toolchains are dumpster fires whose use invites supply chain attacks. They should never have gained mainstream acceptance and should never be run outside of a sandbox.

That said I wouldn't trust a compiler to be hardened against malicious input and anyway you presumably need to run the output so all of that should be happening in a hardened sandbox regardless.

[ Parent | on HN ]

Re:North Korean fake job interview led to $6.3B Binance heist by zaphirplane on Wednesday November 04, 2026 @04:01PM (#50371456)

[delayed]

[ Parent | on HN ]

Re:North Korean fake job interview led to $6.3B Binance heist by qurren on Wednesday November 04, 2026 @05:03PM (#50372173)

I fully agree with this.

If you ever meet with Alibaba for any reason they'll ask you to download their conference software. Unfortunately most people in the China ecosystem don't have the guts to say no and will just gleefully install any .exe thrown at them.

[ Parent | on HN ]