Pretty funny that tech makes candidates jump through all sorts of automated, inhumane loops to even advance to talking to a real human in the hiring process.
I remember in the mid-90s going to an interview in Manhattan - pre-Internet. Someone met me and led me to a table and said, "Here's where you're going to take your test." I said, "I don't take tests." She said "Everyone that comes in takes the test". I said, "Well, that's no longer true because I came in and I'm leaving without taking the test"
While I love the "edgy-ness" of this, I remember doing something like this around 2013 in Manhattan and kind of enjoyed it. They had me go into a room, and gave me a paper with an open ended question: it was something along the lines of, write as much detail as I could about what happens when a user visits a URL in a web browser. E.g. explain as much as I know about TCP, HTTP requests, web servers, etc. I think I touched on how Cookies worked as well.
No AI, no leet code, just old fashioned gauging someone's experience and communication skills.
I'm fine with technical interviews that are "test-like", with questions and answers and discussion and with an engineer who is my technical equal. But this was not that.
The more inhumane the screener the worse the job in my experience.
Had one recently that waived me thru and then sent me straight to talking to senior management/stakeholders/etc but literally no one on the team itself.
Couldn’t get a straight answer as to what team does, what role is for, real day to day I’d be walking.
Only clear thing was scale of architectural mess stemming from a political mess… and not a lot of interest in changing it.
They wanted a seasoned tech body to throw into the grinder 12-15hr days to replace the last one. No thanks.
Back in 1989 that was a rare skill. Many of the engineers who had experience were working on government projects. I mean TCP barely had congestion control at that point, it was very early days.
I forget. I used to use emacs but very superficially; when I started the job a literal greybeard UNIX admin shook his head and took me under his wing to teach me vim, which I used for a long time before switching back to emacs (and learning the elisp underpinnings of it)
"Usually we don't hire people from high school, but you had Common Lisp in your CV, so the engineers said to take you anyway." 2010, still simpler times.
I have never had the opportunity to ask this as an interview question. I'm secretly hoping that the first time I do so, somebody will lead off with "So, let's skip past the discussion of free will that might occur when considering how the user decides to visit the website, and instead start at the motor cortex..."
I'd also love a deep dive into the keyboard microcontroller that ends with the key press leaving over USB , and never even considers the main CPU.
Honestly, even the facetious answers to this have the potential to be incredibly interesting. Reality just has a ton of depth.
I honestly don't know what's so wrong about taking a test for a job, unless the job already requires some kind of certifications/licenses. I, personally, wish that my doctors and lawyers have passed some tests.
> I honestly don't know what's so wrong about taking a test for a job, unless the job already requires some kind of certifications/licenses.
You already have a degree from some university, and you already worked in software development for quite some time. So it's very annoying to do some test over and over again for every job application.
> You already have a degree from some university, and you already worked in software development for quite some time
Yep. Now substitute doctors/lawyers/accountants/civil engineers into the equation and see how you feel about it.
Surely they don't take a test for every client, but I'd consider the interview process more like a "workaround" for the lack of standardized tests for software engineers instead of the lack of respect.
They don’t take a test for every client. But they do get regularly monitored for their competency and instead of being fired when they fail, they have their professional license revoked.
Maybe IT professionals should be held to the same rigour. There’s a lot of deadweight in the profession that get paid too much and moan too loudly despite having a cushty job in a field they’re barely competent in.
> You already have a degree from some university, and you already worked in software development for quite some time. So it's very annoying to do some test over and over again for every job application.
Ok, but there's no uniform grading in school or employment. We all know people who managed to get through university without learning anything and manage to hold a job in software development without knowing or doing anything. It'd be nice if a degree and a job history guaranteed competence, but it doesn't.
Lots of professions can bring a portfolio and/or a sample of their work, but most software developers can't because the work is often propriatary and a trade secret, and anyway would need a lot of specific setup to operate.
I've only taken test tests for government jobs, and they were laughably outdated; approximately nobody knew how much space was on a 5 1/4" floppy in 1998 when I took the test, but they were asking about 8" floppies, and I assume they still are, because the test had to go through some process and doing a new test would be expensive. But yeah, I expect a company to validate that I can both describe solutions to problems and turn that description into code.
Hey, one day the fate of the company is going to hinge on getting an accurate estimate of how many ping pong balls can fit into a 747, and they'll be glad that they asked the right brainteasers.
I had one recently that was like.. I'd be better at this test if I knew less / was less experienced.
An hour to implement a toy version of a component which, the last time I did it "in real life" blew everyone away that I had a prototype ready in 1 day. That real life prototype went through weeks and weeks of iteration before it was even useful, and everyone was happy with that. But yeah that's something to time box to 1 hour in an interview environment.
So turns into an exercise of - which of the 100 pitfalls/nuances do they want me to pretend don't exist in order to complete it in 1 hour. Opinions vary!
There were multiple questions of this form.
One could pass this test blindly as a new grad not knowing the 100 pitfalls of actually building one in real life.
It's also for liability. If someone comes in with the intention of suing them, they can point to the test and have objective evidence that the rejection was not based on race or gender. It also allows them to gather data after the employee gets established and succeeds or fails.
Also in the mid 90s, you actually had to be smart to work in this field. There was no stack overflow or reddit to search. And CS programs were nascent.
Companies certainly have taken it too far, but I don't blame them for some usage of standard tests.
> Why would you refuse that, when applying to a job?
Not the OP, but from a certain point on (I'd say 3-5 years into one's career, I'd say maybe even earlier) school-type tests become quite ridiculous, as in real-life programming/development has nothing to do with how people are graded in school.
If by "nothing to do with" you mean "uncorrelated", then this is very trivial and empirically untrue. There are a lot of tests that correlate with peer and manager-rated performance in software development (and many other roles).
Even the dumbest most ad hoc unrelated tests will have nonzero correlations, and the well-studied principled ones much more so.
The better argument is that tests are high effort and can feel demeaning. But it's not productive to pretend they don't work.
This has not been my experience. Granted, I’ve never worked for a FAANG-like company, but in my 20 years of writing code for a living I’ve seen a lot more unknown unknowns in my day-to-day work compared to what school had prepared me to handle.
Security aside, this is the real (and very sad) take away here. People are so desperate for an organic interview that they end up neglecting common sense. Employers will complain to no end about not finding qualified candidates or dealing with scam candidates, but they're ultimately responsible for perpetuating this predicament to begin with. They're constantly stretching what they can greedily get out of you; whether it's during the hiring phase or while being employed.
I remember doing 6 hours of interviews once for a company, getting to the final stage and they wouldn't budge on $5,000 for a figure they initially accepted but reneged because the manager hiring me would be paid less than me. It was so petty. I turned it down back then, but I'm not sure I would in this market. I'd probably take it and job search while I'm working there like this guy did at Binance.
LinkedIn is a wasteland. Guarantee Microsoft leadership forgets it exists or that they own it. The sooner we stop giving it misplaced respect the sooner it can be replaced by something better.
Agreed, LinkedIn makes it very easy to spoof your credentials. There was a fake profile posing as a recruiter from my company trying to phish people for a long time, we reported it 100x and nothing happened. Finally ran into a guy at a party who worked for LinkedIn and convinced him to flag it internally, lol
What do you all do to detect if a recruiter or company reaching out to you is real or not? So much is remote now, and somebody could ai-generate a fake company and linkedin presence to make their scams more effective
Probably. I have seen many colleagues across the cubicle aisles spending their time on things completely unrelated to their work. I would be baffled to hear that you have not had similar experiences.
As a hiring manager, do you hold that behavior against candidates for positions where poor security practices could become a major liability for your company?
Blame the lowest guy on the totem pole and not his garbage leadership with a terrible approach to securing the company's vaults. Wow. This industry eats its own or throws them under the bus -- anything but criticize its terrible leaders. What a shitshow.
Not as easy as that, these can be real people with genuine businesses across the other side of the world, which sounds like what happened here. They only have to seem friendly and genuine before asking you to perform a coding test or whatever.
Unfortunately:
1) The dev downloaded it onto a work laptop which was really poor behaviour
2) It sounds like the developer environment was very open instead of segmented. Common but an easy control to use in a high-risk environment.
3) Sounds like a lack of any elevation process e.g. if a developer needed to access a wallet, it very much should sound an alarm/require explicit permission etc.
Zoom exploits could have done this without downloads. I don't interview on a computer with sensitive data, it's usually a throwaway. I sometimes get judged for doing the interview on a Chromebook or an old Mac and I hope that interviewers understand why I choose to do it this way.
Doing ANYTHING on a work issued laptop outside of your role is such a dumb idea for a litany of obvious reasons that I'm genuinely shocked people do it. Let alone participate in interviews for other companies on it.
well if they don't manage it via some kind of MDM software, that would mean the employee is responsible for security on his own - at which point he might as well use his private laptop for work stuff.
The BIOS/firmware would have to be locked down and disallow USB/etc. booting, I don't think that's normally covered by MDM? Does UEFI even expose an ability to control that via software?
In my last job we used Zoom for interviews. The link we sent would work in any web browser, but if the candidate was signed into a Zoom account on their computer we'd be able to see it. I'd say >70% of them were on their company account.
Even worse when you have to do stuff like screenshare or coding. I've had candidates share their screen and have obvious proprietary material in open windows. I've seen countless email inboxes and calendars. I've seen candidates do coding exercises using internal IDEs, dev environments and dev tools. I've had them talk – fully unprompted – about internal tech and unreleased projects. And I'm talking about Google, Meta, Amazon, Coinbase, Uber.
At this point I'm convinced that a large chunk of tech interviews are happening just to extract insider info from employees.
How does that prevent you from using your personal laptop for a job interview?
It would never occur to me to use an employer's hardware for such a purpose. It seems absurdly lazy, but I know that not everyone's life works like mine, so I would like to understand why this would be a real problem for people.
I had a really bad meeting one day that became the straw that broke the camel's back. When I went back to my desk, I saw an interesting job posting. I immediately fired up the company's copy of Word to draft up a resume, and used the company computer to send the email from my personal account. Less than a month later, I was working for the new company. It was done intentionally. I almost sent the resume via company email, but I really wanted to ensure I could access any response.
If you work from the office, and they have tight security, they might frown upon bringing personal devices to connect to the internal network.
Also, some people might not have dev environments set up on their personal devices. Heck, a lot of people only use the internet through their smartphone, when they're not at work.
My employer allows personal computing equipment at work, but has a separate, completely isolated network they connect to. You're never allowed to connect them to the company network.
> It would never occur to me to use an employer's hardware for such a purpose
That's a very uncommon mindset and worldview.
For 99% of people, the default would be "I'm going to join this Zoom meeting from the laptop I use all day long to join Zoom meetings, and I'm going to code using the laptop I use all day long to code".
Lots of people have their work tools setup on their work computer, but not on their personal computer. Their personal laptop might be relatively underpowered and struggle to run all the required software efficiently during an interview. The issue becomes even more significant as more of the tools used require an account - you don't want your interview performance to suffer because you're using an unfamiliar tool or service, so you just use the ones you're used to using every day.
What I'm seeing here is that Binance has the IT culture of a SV start-up when it should have the IT culture of a bank. Sounds to me like a thug with a $10 wrench could've been just as effective.
> Lots of people have their work tools setup on their work computer, but not on their personal computer...you don't want your interview performance to suffer because you're using an unfamiliar tool or service...
I struggle to come up of even the most absurd interview scenario where the tool makes the difference especially in our field where if a FOSS tool is not standard, then there's a sufficiently powerful free tier (eg., Sublime, IntelliJ). Heck most remote interviews, they take you out of your tools completely and ask you to code on some shared browser-based editor.
> That's a very uncommon mindset and worldview.
I'm calling HN SV start-up bias. Outside of the startup software eng'g industry, a lot of people exercise very good separation between work tools and personal tools. I know a lawyer, _who's the head of his own law firm,_ bring his personal laptop to the office just so he could purchase tickets during office hours.
I think this is also down to a few factors:
- SWEs are typically issued high-end machines in contrast to other professions whose standard issue is still 4GB (or 8GB, if you're lucky) RAM. For those professions buying a better personal laptop is a low bar to clear.
- SWEs are more efficient when they have admin access to their own machines. Though it begs the question that maybe some inefficiency would've been an acceptable tradeoff to $6.3B.
- SWE is one of the professions on the poster for the "Get paid good while working from Bali" lifestyle, wherein BYOD is implied, especially if you are freelancing.
> I struggle to come up of even the most absurd interview scenario where the tool makes the difference
I had an interview recently where I'd initially planned to use my own machine, then gave up and just used my work computer.
I'm used to the whiteboarding/UML/flowchart software I use at work, so I either needed to pay for a personal subscription so I could use it in the interview or be forced to use some other software I'm not familiar with. I also didn't have a personal paid AI code tool, so again either pay for a personal one or just use the work Claude account. Also the webcam on my work laptop is substantially nicer than my personal laptop.
Also, critically, it doesn't matter. If IT or my manager had pinged me to ask "Did you do an interview at noon yesterday?" I would have said yes and then the only follow-up would have been them asking if it was a random thing or if I was actively looking.
I think IT (and I guess, lawyers) are probably the only people who care much about separating work and personal devices, just because they're prone to being aware of how much surveillance of the device can be happening. People in marketing/sales/whatever back office stuff will be logged into their personal Facebook, Netflix, iMessages, Email and bank and never consider that their keystrokes are being logged and screenshots are being taken.
IT is aware of surveillance. Lawyers have a legal responsibility to take all reasonable steps to safeguard confidential client information. A lawyer misusing a work device is probably roughly equivalent to a healthcare worker doing the same.
Common or uncommon, its extremely unprofessional. You know when you are dealing with a kid or with professional who actually wants to get hired and has some manners.
Sharing other's company secrets by mistake, using other company's resources in ways that are definitely forbidden - is this a person you really want to hire since they will behave the same in your company? Is this a person you want to give trust with some internals?
In market with 100s or applicants thats enough to disqualify anybody who actually needs an interview or two to get hired.
Maybe this is just an agree to disagree moment, but literally no one I know would consider this unprofessional at all.
I've been in management for the past decade and interviewed a few hundred candidates in that time. Never once did I ask or care who owned the laptop they were using.
And similarly, if someone on my team used their work laptop for an interview, I wouldn't care at all.
I have never hidden the fact from any of my management in any of my companies that I interview with other companies on a semi-regular basis.
It reminds them that while I am a replaceable cog in their machine, I am also a cog that other machines would like to install given the right opportunity. And I am always aware of my current market value.
Being an engineer I am surprised, but for normal staff its very common to not have a personal laptop. The most common request from layoffs or firings in my company has been a request to keep their company laptop
I've worked at a few companies where they'd offer to sell, for a nominal amount, the work-laptops to ex-staff.
I know the last time I left my job I was given the opportunity to buy an M1 mac with 16Gb of RAM for €100, so of course I did.
(Though I also paid €500 to keep the phone they'd bought for me, which was perhaps not such a good deal, it was convienent and I do like the phone, but I'd have been happy to have a random cheap android phone, I have no specific requirements beyond "small enough to fit inside a sporran"!)
For my most recent job (Staff/Principal SWE) I interviewed at four companies, each with four rounds of interviews (usual variations on 30m recruiter screen, 45m-60m tech discussion or coding exercise, 60m-90m tech deep dive, 30m-45m final wrap up with hiring manager). All over the course of about 3 weeks. It was about 16 hours in total.
No chance you can do that on "sick days", fake doctor/dentist appointments, or other such scheming. Taking many half days of personal leave just isn't workable either. You're not in full control of the scheduling to make different companies interview you one after each other on the same day, or take the same time between rounds. Some could have been scheduled in lunch breaks but not all of it.
Most people I've worked with would just schedule some "focus time" and were either WFH or headed off to a quiet part of the office or a nearby co-working space. Personal laptops are easier to use offsite obviously.
> Taking many half days of personal leave just isn't workable either.
Why it isn't? A genuine question, I presume this is more typical US culture or dare I say workaholism and various self-pressures to maintain some public office image?
I recently took quite a few half days off to manage workers doing bigger reconstruction in our apartment. Sometimes full day. Then smashed a week of vacation in Sardinia in between. Everybody understood whats happening, nobody cared since many went through similar exercise before.
Your time is your time, if you actually let it happen. Or you can spend your life living with servile attitude, nobody will thank you though.
Because my personal leave is time I want to spend with my family. I would have had to have taken about 4 days worth of leave (8 half days) to cover these interviews and that's 4 days a year less I get to spend with my wife and kids.
(UK based so not US culture, and not workaholism or image.)
> I interviewed at four companies, each with four rounds of interviews (usual variations on 30m recruiter screen, 45m-60m tech discussion or coding exercise, 60m-90m tech deep dive, 30m-45m final wrap up with hiring manager). All over the course of about 3 weeks. It was about 16 hours in total.
Fake interviews also use social engineering tricking people to accept interview requests at short notice, so that they maximize the chances they'll be connected from work.
This is more of an amusing story, but it kind of fits ...
I have a relative who started (what has become) a successful winery.
During the first few years he worked on the winery on nights/weekends, but he kept his day-job as a finance guy at a relatively large company.
He told me he had to give a presentation at the company one day, plugged his laptop into the conference room projector and up popped a spreadsheet of wine-making measurements (pH, temperature, % alcohol, etc.). He said everyone in the room laughed.
Anecdotally, I've also seen the same thing, and _done_ the same thing (on the zoom accounts). A previous companies policy allowed for zoom logins on non-corp devices so that you could take a late call from home. The only thing I _ever_ use zoom for is work or interviews, so it's not like I'm going to log out after?
They did. They provided work phones and laptops to anyone who wanted/needed them, and had travel laptops for people who needed them occasionally. But if you have one call at 7pm in a year, being able to go home and cook, eat, and take the call without any real hassle is a nice thing.
Totally this, I've had a company drill down some asterisk specifics which seemed single focused, I rarely share details of projects or infra so that didn't go far.
I get enough calls asking what security appliances we use, most are probably sales, but heck no should you answer this... It's obvious many people do though.
Yeah, I almost suspect a lot of these cases are BYOD (like the above commenter who said 70% of the Zoom interviews he hosted showed the candidate using their current company's Zoom account). I just can't imagine there are that many people dumb enough to interview on a "work computer" otherwise. In the world of small or less tech savvy companies, BYOD is pretty common.
Around 2005, my employer at the time did a refresh of our it equipment, replacing all the cheap stuff we had been acquired with. They asked everyone to say if they need a laptop, as desktops were the default at the time. I said I didn't, and was surprised when he turned out that almost everyone else said they did. Most of them didn't really need one, and presumably were planning to use them for personal stuff.
The company was a bit salty about this as laptops are more expensive, but they got them. And of course the company befitted, as that was the end of a clear separation between work and home. You have your laptop, you can answer email and attend meetings with people in other time zones. Before, it was easy; work stuff stayed on work computers and those didn't leave the office when you went home.
Unless all your colleagues militantly refuse to answer, there can still be social pressure. Probably the best case is if your laws mandate overtime pay. But I'd be interested to know if there are stats about which laws are effective.
Not much around here, while it is tolerated for accessing something over the Web, the cyber security trainings explicitly mention being a possible way for job termination when something goes wrong, after installing anything not cleared by IT.
But if he'd done the interview on his personal laptop then he would have had his personal crypto wallet drained instead, seems like he came out ahead this way.
We are talking about highly educated people who work in software development (i.e. can assumed to have some minimum viable knowledge about computers), and not about the dumbest imaginable users.
There’re plenty of dumb people with a PhD. I’ve done three semesters of calculus and advanced physics for my BSc in engineering. Looking back, there wasn’t all that much to develop my critical thinking. Like, you can solve the problems and still say the stupidest shit.
It wasn’t until my PhD when I took an elective in Argumentation theory that I learned about constructing a good argument. And I only learned about fallacies somewhere on the internet.
> Don't be too proud of this technological terror you've constructed.
-Darth Vader.
Being able to make React components does not require you to be smarter than the average person.
You also have multiple types of intelligence. I worked with a brilliant intern once. The kid was over 100k in student loan debt and didn’t know the loans can’t get discharged.
The bar for disability for the Dept of Education is far lower than the bar to qualify for Social Security Disability. A simple letter from a doctor is all you need to discharge the student loans (plus living 3 years under the poverty limit).
It's an anecdote, but one of my coworkers has Steam installed on his MacBook (of all computers). He is a data scientist. Technically, we're only allowed to install software from an approved list maintained by the IT security team. They clearly aren't enforcing that policy, though.
> SWE's are the worst about security, I swear most are worse than the average person when it comes to security practices.
My experience is completely different: many software developers are rather paranoid with respect to security, and have quite a good (though far from expert-level) knowledge about security. It's rather that many software developers are quite hostile to security practices that are mostly "security theater" and obstructs them in doing their work.
It is one thing to do personal things on a work laptop, it is another all together to give your children free reign. Are there no penal measures taken to deter this anymore?
Working in a financial institution, I was surprised they could do all this. Our work laptops are so locked down (sometimes maybe too locked down) that we'd never be able to download a random .exe
I think Binance needs to start having IT Security like a bank as well.
Usually it starts with a locked down laptop, then request after request, you get more rights, even admin on the laptop because otherwise you can't do anything as a software developer.
Banks, at least in the U.S., are highly regulated and this would be very abnormal and subject to regulatory non-compliance, especially when the bank crosses into “big bank” territory. This stuff is regularly audited internally and externally.
Our (state) agency uses separate computer accounts for regular use and admin use. The admin account has neither network nor email access in order to prevent using the admin account on a regular basis. With state government agencies continually attacked with ransomware, we aren't as bondage and discipline as banks (which I have done before) or DOE (which was very severely extremely locked down and I was not connected to classified stuffs).
I have not needed admin credentials for regular development purposes since VB6 (which I was using until 2013). VB6 and ActiveX dlls required read/write access to the registry all the time.
Even if you do need admin for a developer laptop, that has no bearing on the PAW you use to authorize deployments and otherwise interact with production systems. Assuming your employer is even a quarter competent (i.e., not Binance).
It does boggle my mind as well. I’ve only ever worked in high security industries as a developer, and I’ve never had admin access unless I was on hardware deployment. Limited user accounts, Firewall blocks, Active Directory audits, and full file system and network log audits are the name of the game where I have been. Anything external gets flagged quickly by automation and anything severe gets an immediate phone call. Falling for a pen tester phishing more than once, getting your laptop stolen, and so on can get you on the poor performer list. It just seems obvious for critical domains.
> I think Binance needs to start having IT Security like a bank as well.
I don't disagree but note that apparently a bank in France, Credit Mutuel (and it's Fortuneo online arm), just got robbed of hundreds of millions of EUR: hackers who have beforehand created accounts on Kraken (a cryptocurrencies exchange) and who then wired millions to different accounts, bought cryptocurrencies, and withdraw the crypto.
But the hack was really stealing hundreds of millions from the bank.
Banks were never "safe" from fraud or theft, even before cryptocurrency existed. The key point was that customer accounts were segregated, and any customer losses were fully insured.
I've worked for a couple companies whose stance on me having a linux work laptop was "fine, but you have to support yourself".
So despite it being a "company" computer I personally installed the blank SSD and installed Arch on it and did not install any company spyware.
I was perfectly comfortable also having Steam installed so I could entertain myself on the plane on business trips. I knew everything installed and spyware wasn't on the list.
When I work at companies that have MDM set up on my computer, I don't do that.
Sure, but that's not really going to protect you. Could easily be that you are the interviewer and the interviewee asks you to click on sketchy link, or it could easily just be a call with a fake supplier or sales representative. It maybe makes it a little bit harder, but there's still many ways for social engineering to land something on work computers.
Yes, but are the companies clear enough and paying enough so that people would never use their work computers for personal matters?
I have a personal desktop because I grew up with video games and a desktop was always a personal investment. I never had a personal laptop, I cannot justify the cost (not a trivial expense, even if my work title is extremely fancy it does not pay on par), so if I would be traveling I would have to take the only laptop I have with me - the work laptop. Well, I managed to never use it, I don't take it with me, but there is a lot of effort in that.
In such a company I would give employees 2 laptops and 2 phones, one set for work only, one set for personal use only, then I would fire on the spot anyone mixing the usage. That would be a start in a longer journey of protecting the company.
Some workers can't afford personal laptops. There was a layoff announced today where company told workers to keep their company issued computers. Imagine that.
Often this is solely fault of employers not paying their workers enough.
I would like to see stats on ownership of private computer. In my circle of friends it’s getting rare, only gamers keep theirs. Smartphones have gotten so insanely expensive, who wants to buy a private computer additionally…
It is crazy that this Engineer A fell for this malware ad (how do people still fall for these & how does Google still get away with serving malware like that):
It is kind of weird that they mention it though, if they replaced the devices and rotated credentials? Just to later mention that an "internal AI tool" was used to steal that Engineer As credentials again?
And also, what are those "obfuscation techniques"? It looks very straight forward, replacing the pyenv, there's nothing much obfuscated in it? Except for putting it in a different folder.
For people who were newly nervous about clicking an unfamiliar link, this is a blog post describing the initial intrusion - the attackers paid for an ad on Google Search mimicking the homebrew website, which tells you to install it through a script. It's something you might have copied directly into the terminal before.
This is Binance/CZ's version of the story, but no one really knows the truth.
They have a massive incentive to invent a story to cover up the incident. I'm not saying it's a cover-up, but the motive is definitely there.
North Korea has denied responsibility, whereas they usually own up to their actions.
Disregarding that, it just doesn't make sense for their internal security to be so lax.
I've worked at big companies but with AUM lower than Binance, a lot of control and safeguards are in place to prevent one "rogue" employee from stealing everything.
It's pretty much impossible for a company like Binance to not have implemented such things. I do not buy it.
The lawsuits are coming, and the systems have logs. There is no incentive to lie about technical details that will come out in discovery in due course.
Don't forget that logs can be faked unless they are obtained directly by law enforcement forensic teams. In the case of Binance EU, their parent company is an offshore entity outside the direct reach of US and EU authorities. Consequently, anything Binance says or presents will most probably be taken as-is by western courts.
Another important note is that Binance has a strong incentive to cover up certain details, given that the company itself is anything but transparent. They also control CoinMarketCap, where they promote only projects that serve their own interests, while rejecting legitimate projects due to Binance's conflicts of interest. Several public reports and data document these practices.
I actually got contacted by North Koreans posing as Japanese VC looking to partner in the Nordics. I have an agent that scans my emails and does the inverse filtering, suggests when I should take a look. This is because I get insane amount of cold inbound. But it also flags suspicious emails and uses network tools to find out info about the sender. It flagged that one as a NK account (I later confirmed it was already flagged on the watch list in various reddit channels). Everyone should be arming themselves with email filtering agents now. What I’m worried about is grandmas and grandpas and general ppl that are behind the tech curve.
It’s not the pc. It will be over the phone. They will call, use TTS with voice cloning to impersonate someone in their family, 5 seconds is all you need. Do a bank transfer to this address. Or click on this link we send you now over sms. You do a million of those.
I just have Codex hooked up to the email client plugin and an hourly scheduled task. Then I have a prompt for selecting the ones I should read and flagging the suspicious ones. The prompt is combined with memory since Codex now understands what is important to me. For suspicious research I have my own skills with a bunch of "usual" tools, dig, whois, openssl client, curl, virustotal, and web research across reddit and a few other sites.
You meet the other side now and then. In my days at the aerospace company, we got an applicant from Russia with really good credentials from the Moscow Institute of Mathematical Sciences. They were really good in person, too. But the decision was "they had to be a plant".
I used to go to parties at Hacker Dojo in the early days of AI. Google wasn't into AI yet and Hacker Dojo had classes, often attended by Google people. (I learned way too much about support vector machines, in a class taught by a guy from BlackRock.)
There were a lot of very good looking Chinese women at the parties who were very interested in what people were working on. They were very bright, understood the subject, and had business cards from small companies no one had heard of. Then one day they all disappeared and were not seen again. I regret not asking one how she liked working for the Third Department.
It's just a cherry on top of the existing hiring process in the IT. It wouldn't surprised that it will make things even worse - companies will be more scared to talk to anyone and good candidates will be scared to reply
What surprises me most about the Binance hacking story is that Binance employees seem to have used their work laptops for some "programming test" (whose purpose was - as we now know - spreading malware).
I mean: if you even consider leaving your current company, you better leave no traces of your plan on your work laptop: you either use a private laptop or, even better, some burner laptop/computer that you reset afterwards.
I have been getting these since early 2023, still, most of them are simple to spot, the other side typically has video turned off, asks a bit about your experience and just nods without digging, they are in a hurry to send you their coding challenge.
In one of these many calls I got to see the face from the other side but lasted a few seconds only. Then he claimed that internet was bad and suggested we continued without video.
In this case they claim it was a 2 rounds interview with video turned on to simulate a more normal recruiting process.
Of course all of us are prone to get caught with the shield off but what surprises me is that the targeted dev took the challenge in the device from work.
A lot of people are focusing on how irresponsible the engineer was about using the work computer. That's obviously an issue but the bigger failure mode to me is the Engineer C's container deployment token.
That's a huge red-flag. In a company of this size, the deployments should be via CI only. CI isn't just to increase the speed and reliability of deployments but also to provide a clean room to build the software! Even if it's a token that was copied and pasted temporarily, the systems in place should not have to require this type of 1. copy 2. paste 3. remember-to-delete the token from my PC.
Also, Binance should be paying for intrusion testing. Better to pay a trusted company to do this kind of thing instead of letting North Korea show you how it's done. I don't think this exact exploit path would have been found but I bet the intrusion testing would have figured out another way to use Engineer C's token.
It'll be hard to time a job opening receiving interviews to line up with intrusion tests in a way that people would not be on guard against it in a way not normal.
Which is also why we, collectively, as an industry needs to not put up with that. It's easy for me to say from the comfort of it not being my job on the line, that if this happens to anybody they should quit and then name and shame the company, but a competent security team is going to have the idea of doing a fake phishing interview and then not do it because of how morale destroying that would be. The security awareness team sending fake phishing emails are embarrassing enough.
I think it will remain uncommon. I agree it would be a good test, but companies and employees alike get very angry when pentesting gets too close to sensitive subjects.
Anyone who fell for it would not only get in trouble for poor security practice, they would reveal that they were job searching. That opens an entire can of worms that creates problems beyond the pentest. This also angers other employees who see it as a double-trap being sprung on employees.
Another major problem is that responsible employees who accept the fake interview but then use their personal laptop to do the interview will have their personal laptop compromised by the pentesters. Responsible testers will immediately abort, but some will try to use the personal laptop to pivot deeper which is a huge ick. It’s also really bad if the company is compromising personal laptops of people who are doing the right thing (switching to personal gear for interviews).
The pentesters wouldn't have to actually pwn a laptop, just getting the employee to download and run anything could go in a report without having the file actually be malicious.
What pentesters can do, should do, and often do is simply start the test from a workstation that is given to them - you assume a successful social engineering attack as the starting point, and test whether your process and technical controls can properly limit the impact of such a compromise without trying to replicate the actual social engineering step and the associated disruption to the targeted employees.
Taking over that first engineer's workstation shouldn't ever have resulted in $6.3B of damages. I would consider it reasonable if those privileges could be abused (by e.g. the same engineer intentionally) to cause $6.3M of damages and the rest would be mitigated or prevented; so for this incident we could say that 0.1% of the impact was caused by the initial compromise of that workstation and 99.9% of the losses were caused by all the other failures - so it's effective for any pentest to focus on the latter part, ignore the social engineering and phishing part (since you can't really eliminate it anyway - unlike many other flaws) and assume initial compromise as a starting point.
I think my security form said something along the lines of “using personal laptops to access company resources grants implicit permission for my company to audit my laptop.” It goes on to explain that if you don’t agree to it, simply use the company device only.
fake interviews might be excessive but lots of companies send tempting phishing emails as part of the secops, then both collect org-level stats and educate (or shame depending on your take) the employee for getting duped.
> responsible employees who accept the fake interview but then use their personal laptop to do the interview will have their personal laptop compromised by the pentesters.
If your laptop is successfully compromised by the pentesters then pretty much by definition you weren't being responsible. Though I agree that pentesters going after personal devices is ethically dubious.
Compromising employee personal devices is strictly out of scope for any security testing I've seen.
> Though I agree that pentesters going after personal devices is ethically dubious.
It's not just ethically dubious. It crosses a lot of legal boundaries. A company can consent to have their personal devices hacked. An employee doesn't automatically consent to let a company's contractors access their personal devices.
Sometimes called "Full Spectrum Attack Simulation" where initial entry can include physical access or spear phishing. They can span months in elapsed time (not effort) so as to be more realistic. However there are still ethical and safety constraints and even phishing may not be able to use the (effective) technique of stressing the recipient too much or of course blackmail or coercing. So I think fake interviews may not be allowed in many cases, to protect the employees.
Legality would be very jurisdiction dependent. It might be illegal in most developed Western countries, depending on the exact facts of the case. I suspect it wouldn't be illegal in China — unless the trick happened to hit a ranking Communist Party member.
And you never, ever, ever install software as part of the interview. Decline and hang up if they're asking you to install stuff. Visiting websites - maybe but even that unless it's a well known website I wouldn't go there but download and install stuff, hells no
Such toolchains are dumpster fires whose use invites supply chain attacks. They should never have gained mainstream acceptance and should never be run outside of a sandbox.
That said I wouldn't trust a compiler to be hardened against malicious input and anyway you presumably need to run the output so all of that should be happening in a hardened sandbox regardless.
Hmm like building an node project, actually any project can have a dependency on a made up libraries that does the exploitation or even the project itself as made infamous by chrome extensions
If you ever meet with Alibaba for any reason they'll ask you to download their conference software. Unfortunately most people in the China ecosystem don't have the guts to say no and will just gleefully install any .exe thrown at them.
> Even if it's a token that was copied and pasted temporarily, the systems in place should not have to require this type of 1. copy 2. paste 3. remember-to-delete the token from my PC.
One of the first things I did in my last job was shift processes like this off my team's computers, aside from the security ramifications all it takes is one dumb mistake, one up-arrow too many, one didn't-read-the-whole-line, and now you're doing something to production by accident!
No, rather a particular environment with monkey patched libraries, alias for various versions of compliers, and dozens of env variables that happen to work or not work well with the desired config.
No matter what you do, at some point you have some human performing some action which will, after N indirection layers, result in a change in prod, unless you have the mythical fully automated agentic software factory.
What sorts of processes related to secret storage were you able to shift off of team computers? From my perspective, if I need to get e.g. an API key from Twitter and put it into my prod environment, i have to be doing that with my computer somehow. There's still millions of different types of secrets that need meat puppets to shuffle them around.
Also Superman III, which predates it and presumably was well known to the writers. But I have an inkling the scheme and it's infamy go back much further. (Precious metal coin clipping/debasement?) It's one of those ethical questions, like a pauper stealing bread, or thought experiments, like "what if reality is just a dream" that many if not most people encounter during their formative years. Per usual, though, the chasm between theory and application (even just identifying real world potential when it matters) is the toughest one to cross.
Not just that! The EIP-7702 delegation to make the wallet into a smart contract bypassed all of the controls that they had in place on the signer. It's wild that they didn't have a system in place to stop it from signing that transaction type.
From my rough understanding, this seems like the main exploit. It seems like the machine with access to the wallet key was presented with a crazy EIP-7702 transaction and signed it (which effectively owned its wallet in a single transaction)[1]. Without knowing their security model, it seems like biggest trust boundary should be between that signing machine and everything else.
[1] The fact that the needed to sign 50 of these transactions to solve a race condition seems like an implementation detail
In Ethereum it would be implemented by linking your account to smart contract code, then throwing away your private key so you can only make transactions through the smart contract. The approval of linking to smart contract code is exactly what they signed here - only it wasn't a multisig smart contract, it was something malicious.
If they did and didn't account for a simple scenario like this happening and built in roadblocks and friction to prevent it from happening? Then it would stand to reason their entire EIS team should be fired.
The fact nobody thought of this is pretty staggering.
What if I plant a hook on the engineer’s laptop that will slightly modify their commits in such a way that eventually I smuggle malicious code over? First, exfiltrate the code over to me, learn from previous commits, start poisoning. Stamped by the CI, no less. In the days of slop PRs thousands of lines each shouldn’t be even too hard.
The point is that at some point you do need to open the door and let the code in.
100% this. I can deploy to our sandbox environment directly, but only our CI/CD has the permissions to build/deploy to our master environment. And the stuff I work on is 1000x less impactful than $billions in crypto!
I don't even leave deploy tokens on my laptop for personal side projects. It isn't difficult to setup CI deploys, if nothing else the extra upfront cost let's me be lazy and have a consistent deploy pipeline.
The article says that a software engineer interviewed with the North Koreans and the NKs then gained access to engineer A's machine (which had the deployment token) and then finally passed that token to run on engineer C's machine (who apparently did deployments). They knew of the team makeup from their first (caught) attempt.
That unlettered (npi) engineer who downloaded and ran the interview software on his or her machine is what the human weak link here. Let's call them Engineer F. Seems like this person was specifically selected from the dev team.
I've had this happen a few times getting interview requests from Indian recruiting firms. It sounded familiar. You go through a screening, then get passed onto the "code challenge" part. You have to download a GitHub file and then work on it, check it back in and push it so they can examine what you did.
Twice I scanned the file after downloading it to a sandbox and twice it found malware that would've been installed.
While this is by far the worst case of this happening, I've read at least a half dozen other accounts of recruiting companies attempting to install malware through the same process. I'm not saying the person should have known, but it's scary this is becoming more and more common.
This person definitely should have known. You don't download and run arbitrary binaries outside of a VM. At this point you don't even compile code from an untrusted source. This is the power user equivalent of falling for a phishing email.
One of my favorite stories from a security talk was the speaker recounting the surrealism of (while doing a forensic investigation of a security incident) watching the attacker read your internal documentation to try to figure out how the hell anything works mid-attack, and running into all the same pitfalls as your new employees.
Yes. The situation improves considerably if, when making server changes or retrieving data, programmers are required to enter a code generated from a hardware TOTP token isolated from both PCs and smartphones.
Every service provider system should be designed with the assumption that programmers' PCs and smartphones may be compromised.
I think we need to implement a new handshake protocol for job interviews.
Both candidate and recruiter have to call Kim Jong Un a big fat tosser (other swearwords are available) on a recorded video before the interview continues.
It seems like these North Korean IT guys are actually pretty tech savvy and can actually do the job and work -- but they are doing recon at the same time with malicious intentions. An unskilled scammer would get caught every time and couldn't do the work.
I mean it would make sense to hire these NK guys to consult DevSec teams if it wasn't for the travel restrictions in NK -- sort of like how reformed black-hat hackers get legit jobs in the IT sec industry.
Founder of Callstrike here .. we build real time deepfake & voice impersonation attack simulation tools for a living so this is literally what I deal with every day.
The biggest irony is that we get at least a couple of signups every month from South Korea, Russia, India, Nigeria just to try getting access to our platform for running these attacks ..
Here is the most recent copy paste from a Calendly invite ..
>Invitee Email:
>ashley@cairnsovereign.net
>Invitee Time Zone:
>Central European Time
>Questions:
>Please share anything that will help prepare for our meeting.
>We are an MSP from the UK that is look for a deepfake platform to run campaigns for our clients. We typically use open source software but there is a gap in our portfolio for deepfake testing that we can't fill with our usual open source philosophy.
The company website https://www.cairnsovereign.net/ was registered just 2 days ago .. they have no linkedin presence, fake CEO and fake CTO and fake everything ..
I still accepted the invite and joined and the person has a strong northern british accent .. he askd me to let his AI bot join the call to take notes ... i refused .. to which he swore and said that if a meeting bot is not allowed .. then i dont want to talk and abruptly hung up ...
PS: if anyone wants to see .. this is what a real time voice impersonation call and real time deepfake faceswap .. looks like ..
My hunch is that this was partly an inside job. The "fake job interview" and "mistakenly downloaded trojaned homebrew" stories are to give plausible deniability. But they're not very plausible imho.
They are very plausible though. There are so many fake job interview scams right now thats its insane. I've personally come across multiple that ive noticed, who knows if there are any that I didnt.
A very recent one wanted me to download an executable which was to "stop me from cheating with AI", which was clearly fake. I've had plenty of interviews where I was expected to clone, fix, and run a repo, which as far as I can tell, all were from legitimate companies. An illegitimate company could easy do the same process with malware.
No one wants to talk about the "internal AI Tool" being used to elevate to not 1 but 2 DevOps engineers?
> use of an internal AI tool as a springboard. The attacker leveraged the compromised computer of engineer B and used an internal AI tool to gain control over the Wallet DevOps Engineer A and another Wallet Software Engineer C. The attacker soon discovered Wallet DevOps Engineer A had a container deployment permission token on his computer.
With the AI craze going on recently I've worked at multiple companies where an internal AI tool was vibecoded and I've always been worried about the security implications.
A lot of detail on what Engineer A, B and C did. But this would've been prevented if Engineer A didn't have "a container deployment permission token on his computer".
What the fuck? On a target as big as Binance? Every developer should be treated as a liability and never be able to deploy by themselves.
This was a big time process failure -- almost every company I worked for you have to authenticate with SSO and MFA and never have static credentials for important services like Github, Google cloud, etc. They don't seem to have least-privilege in place and if they did are not consistent about applying the policy to everyone.
I wouldn't be surprised if the guys they compromised were high-level staff engineers with the keys to the kingdom so to speak so they found a loophole. Security is hard because the attack only needs one chance to get it right -- and defense needs to get it right every single time.
If she hadn't done it on her work laptop, her personal would have been pwned anyway. It's not clear to me how to protect oneself while also looking for work.
…what? That’s not how this works. You don’t get to misuse company resources for the purpose of transferring the risks associated with your personal activities from yourself to your employer.
>> "...and is working with law enforcement, blockchain intel firms, and security researchers to trace and freeze the assets. The crypto exchange has also hired independent cybersecurity experts to conduct a cybersecurity review of the incident, and recommend additional protective measures."
>> trace and freeze the assets
It has gotten to the point where the advertised permanence of cryptocoin transactions is a serous national security threat, literally funneling $6+billion to a nation-state whose publicly avowed statements is to destroy the US to fund its nuclear weapons program.
The party is ending. The house lights are flashing. Crypto will either become controlled so illegitimate transactions will be roll-back-able (presumably with proper court or NatSec orders), or it will be banned.
This is already a reality. USDT, USDC, and many other smart contracts allow for the freezing of funds worldwide. Arbitrum rolls back its chain whenever it wants. State-sponsored Twitter influencers like Taylor Monahan (tayvano_), Zachary Wolk (ZachXBT), and Nick Bax (bax1337), falsely flagged as independent, publicly appeal to Thorchain (the only decentralized swap protocol between various native on-chain assets) to integrate transaction screening directly into the node consensus. EU has made accepting Monero illegal starting in 2027, among many other measures. Western governments have already succeeded in making crypto very controllable.
I expect this trend will continue to the point where the original feature of transactions absolutely untouchable or un-blockable by the state will be gone with the exception of trivial deep underground cryptochains.
Anec-data - as an interviewer, last year, I had my first sketchy, perhaps 'North Korean', candidate.
The name on the CV, was, for the sake of privacy, Michael Smith, from Australia, and ticked the right boxes.
We'd expect a fluent, Aussie-accented English speaker. Instead, we had a candidate with a webcam that wouldn't work (weird!!), with clearly accented English of a East-Asian background. I suppose there's a vanishing chance they really were Mike Smith of Adelaide or wherever, but we couldn't take that chance. We tried rescheduling, but tumbleweeds...
I'm waiting for companies to start running remote screens like "OK, in this exercise, we need you to write a program that efficiently generates insults about Kim Jong Un."
Haha I had the exact same interview experience, the candidate was named Connor Wood, from Austin, TX. I actually told them we couldn't continue the interview unless they turned on their webcam. Cut to a meek east asian man in a dimly lit room. Are you sure you're the Connor Wood that played on the UT Austin Lacrosse team?? LOL I don't know how they expected that ruse to work.
TBH if they paid me €2 million I'd easily play the role of being a trustworthy white guy on fake interviews. And I'm sure that others would be convinced to do the same thing for much less.
I’m sure there were other signs of sketchiness, but in case you weren’t aware there actually IS a sizable Chinese population in Australia (esp Melbourne)
So you expect people's names to match your expectations based on their experience and reject those who do not fit the stereotypes? Likely to be discriminatory. Lots of people (including myself) have European names and are not white, do we just get ruled out?
Imagine being able to steal billions in crypto from your work laptop and using same laptop to run code sent to you by another company. I wish I had their problems.
The practice of installing software during a job interview should be forbidden by law.
Some companies require you to install Windows remote administration tools (basically root kits) on your machine to check whether you are using search engines or AI. It is insane.
Where do these people find jobs so secure that they wouldn’t bat an eye at interviewing for another job in a context where their current employer can watch them do so?
Even if you don’t understand the security concerns of running some 3rd party’s scripts on a work device, more pedestrian situational awareness should have prevented such a wild misjudgment?
People are talk about all the security aspects of this which are all valid. But what I saw here is that Binance is running a sweatshop here. So even someone holding secret for billions is actively looking for potential role from a Noname company.
It's getting really confusing with these online job offers, including interviews and assignments. Various people are pretending to be recruiters. I've basically stopped answering phone calls, and everything goes to voicemail unless the caller is in my contacts. But that is hard to do if you are looking for a job. Honestly, if you are the target of this type of campaign, as described in this article, there is probably a good chance you will get compromised, even if you are normally careful.
> Binance’s endpoint security tools did not immediately detect the malware.
Yes of course they didn't. The whole "endpoint security" industry is a scam. They're attempting to (or attempting to appear to) solve an impossible problem. All they do is install spyware and backdoors, reducing security rather than enhancing it.
The way I read the Binance post[0] is that the first mistake was "Engineer A from Wallet DevOps" clicking on a malicious Google ad[1]. If Google didn't provide that attack vector, maybe this wouldn't have happened that time.
Yeah, lots of good conversation on steps to take. One thing I never see mentioned is who should review and test them. Especially for a financial company, it seems they have no IT compliance/audit functions. Even at many big companies it seems IT control creation, maintenance, and testing is largely ignored or just put onto the people implementing and performing the control - a huge conflict of interest. Control analyst posting are something like 1 to 10K when measured against dev postings. Really telling when it comes to what companies actually care about...
After reading this story I understood that a lot of pieces had to come together to make the plan work. It was a huge long shot from the start and that makes me wonder how many times they must have tried this in the past? To make long shots like this work they must have tried relentlessly; they would've tried hundreds of thousands of developers before this
I suspect we'll look back on "Nork" as a derogatory racial term that didn't need to be used here. Just call them the attackers, or by their group name, or whatever.
I remember that when I was a student everyone called Mathematical Analysis "anal" and then there's one guy whose Facebook profile pic was from a church and he said "the correct shortened term is MA".
No single person, especially an engineer, should have the ability to transfer funds. That's nuts and it says a lot about the security posture of that company.
Obligatory and should be obvious: a threat model that allows a single compromised laptop to result in a $6.3B loss is fundamentally flawed. Analyze the specific way that the laptop was compromised all you want, the fault here is entirely with the Binance security culture that allows such a gaping hole to exist in the first place.
I hope that Binance understands this and spends less time worrying about how the laptop was compromised and more time securing their systems under the very basic assumption that laptops will be compromised.
Recently, I was designing a technical test for a candidate and I thought about putting some prompt injection to try to see if the candidate used an agent and be part of a cybersecurity tests. I didn't do it because it felt unethical, but turns out you don't even need the prompt injection part.
There is no evidence given that North Korea did this.
"TRM attributes this attack to TraderTraitor, North Korea’s premier hacking unit. We base this assessment on robust on and off-chain intelligence sources. The FBI named the same group as responsible for the USD 1.5 billion Bybit hack in February 2025. Several features of this attack match earlier North Korea-linked heists, including the Bybit hack and the KelpDAO hack in April 2026: small Tornado Cash withdrawals funding an operator wallet, staging that began well before the theft, and signatures obtained in advance then executed in one burst. The laundering observed so far, built on large swaps through market makers and lending protocols, differs from the bridge-heavy pattern that followed Bybit. TRM will share further findings as the investigation develops."
This is simply an assertion that an official enemy did something we don't like. It could just as well be a CIA money laundering scheme. This would make more sense, given the wider deployment of US cyber weapons and assets as well as the desire of North Korea not to provoke American aggression which previously murdered about 20% of their population.
It is widely known America has cyberweapons deployed around the globe. It is likely trivial for them to fake a trail of evidence from the DPRK.
North Korea's open hostility to Western systems combined with its highly proficient human capital creates a bizarre situation where a formidable state-level actor is waging unrelenting warfare against private companies that operate in the Western-led global economic system, and due to the nature of the internet and North Korea's nuclear deterrent, there is no way to force that actor to stop.
This is insane. The first engineer ran some curl bash, which gave the hackers access to his Slack, and then they set up an interview for him at a fake company and during that interview, they convinced an engineer to download and install some code they had written? This is just clown world.
Crack down on fake job postings. It might not have stopped this attack, but it would have made it a lot harder for it to hide among all the terrible postings desperate people spray-and-pray at because they wouldn't exist because they'd be illegal.
I like that the article referred to the hackers as miscreants. I don't see that word used very often. "Then, on October 20, the miscreants used the compromised computer and an internal AI tool to gain access to the computers of wallet DevOps engineer A and another wallet software developer, Engineer C."
Just want to highlight I came across one of these fake interviews last year and it unnerved me how close they came to succeed. I thought alot of about it and I realised they must have planned and been "coached" by a frontier LLM on how to go about social engineering me. This was a year ago! I can only shudder at their abilities now. It didnt work, but it was the closest attempt I'd ever witnessed.
“shared a social media account with him, including personal photos and videos posted on the platform, in order to build trust" -- I wonder if these were real photos and videos, or AI fakes. It's crazy how many fake profiles Instagram pushes into my feed lately, and how many people probably don't even realize they're fake.
A common method is just taking somebody else's publically posted photos, with light editing on top. I imagine you can take them from sources that can't be reverse searched easily, like Facebook groups, or these days probably as frames from tiktoks, etc. That is to say, for some things, you don't really need GenAI.
Binance bugs us all the time to confirm everything before making a $5 payment. Why don't they enforce higher security steps in their own wallets? Also, how can AI access Google Authenticator?
How love how in face of such sophistication and planning from the North Korean hackers, most of the comments are along the lines of “so dumb, I would never have fallen for it.”
Someone tried to hack my computer with a fake job interview once. I believe it was a real person because there wasn't much latency.
They tried to get me to git clone a repo, presumably to get me to install malicious npm dependencies.
I refused, then they wanted me to download Claude Code but I told them I already had Claude Code harness installed on my machine... But they said I should install a different version of it; they sent me a link... The landing page was the same kind of design as Anthropic uses but I didn't recognise the URL. I stopped the interview right there.
So, North Korea is involved in hits not unlike some Russians do. But at the same time it may provide a cover for other state actors. May be unlikely in this case (I think the pattern here is making it indeed most likely that North Korea is responsible, it just fits so much; for similar reasons, it was very clear that Marsalek worked for the FSB and stole a lot of money from europeans https://en.wikipedia.org/wiki/Jan_Marsalek), but it should be kept in mind.
I'm just a simple programmer from the Santa Cruz Mountains but how is it possible to withdraw that much money without scrutiny? I mean if I go to my bank and want to my hypothetical millions in cash they'll say "It'll take us awhile to collect that much cash and meanwhile the government requires us to ask you a few questions about what you're doing..."
steveBK123 | 21 hours ago
And now you get results like this.
intrasight | 21 hours ago
Horffupolde | 21 hours ago
xyzsparetimexyz | 21 hours ago
progforlyfe | 20 hours ago
No AI, no leet code, just old fashioned gauging someone's experience and communication skills.
nzjrs | 20 hours ago
intrasight | 20 hours ago
steveBK123 | 19 hours ago
Had one recently that waived me thru and then sent me straight to talking to senior management/stakeholders/etc but literally no one on the team itself.
Couldn’t get a straight answer as to what team does, what role is for, real day to day I’d be walking.
Only clear thing was scale of architectural mess stemming from a political mess… and not a lot of interest in changing it.
They wanted a seasoned tech body to throw into the grinder 12-15hr days to replace the last one. No thanks.
intrasight | 19 hours ago
Them: "Do you know TCP/IP?". Me: "Yes". Them: "you're hired"
Job at the Westinghouse instrumenting nuclear power plants. Simpler times then.
jandrese | 15 hours ago
vconnor | 14 hours ago
“What does ifconfig do? What does it mean to mount a disk? What editor do you use? You’re hired.”
None of that culture fit nonsense.
Tyr42 | 14 hours ago
vconnor | 7 hours ago
selicos | 12 hours ago
mrheosuper | 9 hours ago
sigttou | 5 hours ago
_whiteCaps_ | 18 hours ago
camtarn | 15 hours ago
I'd also love a deep dive into the keyboard microcontroller that ends with the key press leaving over USB , and never even considers the main CPU.
Honestly, even the facetious answers to this have the potential to be incredibly interesting. Reality just has a ton of depth.
gilrain | 20 hours ago
hnlmorg | 20 hours ago
raincole | 20 hours ago
aleph_minus_one | 20 hours ago
You already have a degree from some university, and you already worked in software development for quite some time. So it's very annoying to do some test over and over again for every job application.
raincole | 19 hours ago
Yep. Now substitute doctors/lawyers/accountants/civil engineers into the equation and see how you feel about it.
Surely they don't take a test for every client, but I'd consider the interview process more like a "workaround" for the lack of standardized tests for software engineers instead of the lack of respect.
hnlmorg | 16 hours ago
Maybe IT professionals should be held to the same rigour. There’s a lot of deadweight in the profession that get paid too much and moan too loudly despite having a cushty job in a field they’re barely competent in.
toast0 | 18 hours ago
Ok, but there's no uniform grading in school or employment. We all know people who managed to get through university without learning anything and manage to hold a job in software development without knowing or doing anything. It'd be nice if a degree and a job history guaranteed competence, but it doesn't.
Lots of professions can bring a portfolio and/or a sample of their work, but most software developers can't because the work is often propriatary and a trade secret, and anyway would need a lot of specific setup to operate.
I've only taken test tests for government jobs, and they were laughably outdated; approximately nobody knew how much space was on a 5 1/4" floppy in 1998 when I took the test, but they were asking about 8" floppies, and I assume they still are, because the test had to go through some process and doing a new test would be expensive. But yeah, I expect a company to validate that I can both describe solutions to problems and turn that description into code.
steveBK123 | 19 hours ago
At worst it’s the biggest hardos on the team writing a bunch of brain teasers and gotchas as a hazing ritual.
sgerenser | 19 hours ago
steveBK123 | 17 hours ago
An hour to implement a toy version of a component which, the last time I did it "in real life" blew everyone away that I had a prototype ready in 1 day. That real life prototype went through weeks and weeks of iteration before it was even useful, and everyone was happy with that. But yeah that's something to time box to 1 hour in an interview environment.
So turns into an exercise of - which of the 100 pitfalls/nuances do they want me to pretend don't exist in order to complete it in 1 hour. Opinions vary!
There were multiple questions of this form.
One could pass this test blindly as a new grad not knowing the 100 pitfalls of actually building one in real life.
gosub100 | 20 hours ago
Also in the mid 90s, you actually had to be smart to work in this field. There was no stack overflow or reddit to search. And CS programs were nascent.
Companies certainly have taken it too far, but I don't blame them for some usage of standard tests.
hnlmorg | 16 hours ago
If you cannot explain why a successful candidate was chosen without bias, then you shouldn’t be interviewing candidates to begin with.
But it is always worth keeping a copy of your interview notes just in case the candidate asks for feedback.
bmacho | 20 hours ago
By 'test' you mean a school-type paper exam, questions and answers? (On unspecified topics.)
Why would you refuse that, when applying to a job?
paganel | 17 hours ago
Not the OP, but from a certain point on (I'd say 3-5 years into one's career, I'd say maybe even earlier) school-type tests become quite ridiculous, as in real-life programming/development has nothing to do with how people are graded in school.
howunfortunate | 15 hours ago
If by "nothing to do with" you mean "uncorrelated", then this is very trivial and empirically untrue. There are a lot of tests that correlate with peer and manager-rated performance in software development (and many other roles).
Even the dumbest most ad hoc unrelated tests will have nonzero correlations, and the well-studied principled ones much more so.
The better argument is that tests are high effort and can feel demeaning. But it's not productive to pretend they don't work.
paganel | 5 hours ago
autoexec | 17 hours ago
nutjob2 | 13 hours ago
fraywing | 19 hours ago
y-c-o-m-b | 16 hours ago
I remember doing 6 hours of interviews once for a company, getting to the final stage and they wouldn't budge on $5,000 for a figure they initially accepted but reneged because the manager hiring me would be paid less than me. It was so petty. I turned it down back then, but I'm not sure I would in this market. I'd probably take it and job search while I'm working there like this guy did at Binance.
xutopia | 21 hours ago
I even create a 1 man company for my consulting services and I receive ads about how people at my company saved me a spot on an online game.
LinkedIn is partially responsible for their neglect here.
phendrenad2 | 18 hours ago
ronsor | 13 hours ago
pants2 | 18 hours ago
barbariangrunge | 10 hours ago
mynegation | 21 hours ago
alostpuppy | 21 hours ago
cwnyth | 21 hours ago
lesuorac | 21 hours ago
jstanley | 20 hours ago
parthdesai | 21 hours ago
podocarp | 20 hours ago
kleiba2 | 20 hours ago
insane_dreamer | 20 hours ago
Jianghong94 | 21 hours ago
voakbasda | 21 hours ago
Jianghong94 | 21 hours ago
sidewndr46 | 21 hours ago
bell-cot | 21 hours ago
ludicrousdispla | 19 hours ago
asadotzler | 15 hours ago
james_marks | 21 hours ago
CommanderData | 21 hours ago
There are tools available to stop AI screen recording tools, fake candidate tools yet many companies keep getting hit..
lbriner | 21 hours ago
Unfortunately:
1) The dev downloaded it onto a work laptop which was really poor behaviour
2) It sounds like the developer environment was very open instead of segmented. Common but an easy control to use in a high-risk environment.
3) Sounds like a lack of any elevation process e.g. if a developer needed to access a wallet, it very much should sound an alarm/require explicit permission etc.
But it is easy to be wise in hindsight.
CommanderData | 21 hours ago
On the other end, when doing interviews I suspect 40-50% of candidates use AI assistant tools (might be skewed in tech).
I do miss seeing someone's camera feed break or AI tool break down mid interview.
HelloUsername | 21 hours ago
cubefox | 21 hours ago
HelloUsername | 20 hours ago
They did, in their sentence "the incident report said".
kittikitti | 21 hours ago
oofbey | 20 hours ago
bilekas | 21 hours ago
jimmydoe | 21 hours ago
xyzsparetimexyz | 21 hours ago
ranger_danger | 20 hours ago
LunaSea | 20 hours ago
ranger_danger | 16 hours ago
littlecranky67 | 15 hours ago
ranger_danger | 15 hours ago
paxy | 21 hours ago
Even worse when you have to do stuff like screenshare or coding. I've had candidates share their screen and have obvious proprietary material in open windows. I've seen countless email inboxes and calendars. I've seen candidates do coding exercises using internal IDEs, dev environments and dev tools. I've had them talk – fully unprompted – about internal tech and unreleased projects. And I'm talking about Google, Meta, Amazon, Coinbase, Uber.
At this point I'm convinced that a large chunk of tech interviews are happening just to extract insider info from employees.
fusslo | 20 hours ago
Agingcoder | 20 hours ago
dkdbejwi383 | 20 hours ago
marssaxman | 20 hours ago
It would never occur to me to use an employer's hardware for such a purpose. It seems absurdly lazy, but I know that not everyone's life works like mine, so I would like to understand why this would be a real problem for people.
dylan604 | 20 hours ago
pcthrowaway | 18 hours ago
Also, some people might not have dev environments set up on their personal devices. Heck, a lot of people only use the internet through their smartphone, when they're not at work.
gorbachev | 12 hours ago
alyeska2 | 18 hours ago
That's a very uncommon mindset and worldview.
For 99% of people, the default would be "I'm going to join this Zoom meeting from the laptop I use all day long to join Zoom meetings, and I'm going to code using the laptop I use all day long to code".
Lots of people have their work tools setup on their work computer, but not on their personal computer. Their personal laptop might be relatively underpowered and struggle to run all the required software efficiently during an interview. The issue becomes even more significant as more of the tools used require an account - you don't want your interview performance to suffer because you're using an unfamiliar tool or service, so you just use the ones you're used to using every day.
JsonDemWitOster | 17 hours ago
> Lots of people have their work tools setup on their work computer, but not on their personal computer...you don't want your interview performance to suffer because you're using an unfamiliar tool or service...
I struggle to come up of even the most absurd interview scenario where the tool makes the difference especially in our field where if a FOSS tool is not standard, then there's a sufficiently powerful free tier (eg., Sublime, IntelliJ). Heck most remote interviews, they take you out of your tools completely and ask you to code on some shared browser-based editor.
> That's a very uncommon mindset and worldview.
I'm calling HN SV start-up bias. Outside of the startup software eng'g industry, a lot of people exercise very good separation between work tools and personal tools. I know a lawyer, _who's the head of his own law firm,_ bring his personal laptop to the office just so he could purchase tickets during office hours.
I think this is also down to a few factors:
- SWEs are typically issued high-end machines in contrast to other professions whose standard issue is still 4GB (or 8GB, if you're lucky) RAM. For those professions buying a better personal laptop is a low bar to clear.
- SWEs are more efficient when they have admin access to their own machines. Though it begs the question that maybe some inefficiency would've been an acceptable tradeoff to $6.3B.
- SWE is one of the professions on the poster for the "Get paid good while working from Bali" lifestyle, wherein BYOD is implied, especially if you are freelancing.
alyeska2 | 16 hours ago
I had an interview recently where I'd initially planned to use my own machine, then gave up and just used my work computer.
I'm used to the whiteboarding/UML/flowchart software I use at work, so I either needed to pay for a personal subscription so I could use it in the interview or be forced to use some other software I'm not familiar with. I also didn't have a personal paid AI code tool, so again either pay for a personal one or just use the work Claude account. Also the webcam on my work laptop is substantially nicer than my personal laptop.
Also, critically, it doesn't matter. If IT or my manager had pinged me to ask "Did you do an interview at noon yesterday?" I would have said yes and then the only follow-up would have been them asking if it was a random thing or if I was actively looking.
I think IT (and I guess, lawyers) are probably the only people who care much about separating work and personal devices, just because they're prone to being aware of how much surveillance of the device can be happening. People in marketing/sales/whatever back office stuff will be logged into their personal Facebook, Netflix, iMessages, Email and bank and never consider that their keystrokes are being logged and screenshots are being taken.
fc417fc802 | 12 hours ago
IT is aware of surveillance. Lawyers have a legal responsibility to take all reasonable steps to safeguard confidential client information. A lawyer misusing a work device is probably roughly equivalent to a healthcare worker doing the same.
kakacik | 13 hours ago
Sharing other's company secrets by mistake, using other company's resources in ways that are definitely forbidden - is this a person you really want to hire since they will behave the same in your company? Is this a person you want to give trust with some internals?
In market with 100s or applicants thats enough to disqualify anybody who actually needs an interview or two to get hired.
alyeska2 | 10 hours ago
I've been in management for the past decade and interviewed a few hundred candidates in that time. Never once did I ask or care who owned the laptop they were using.
And similarly, if someone on my team used their work laptop for an interview, I wouldn't care at all.
dylan604 | 20 hours ago
paxy | 20 hours ago
steelframe | 17 hours ago
It reminds them that while I am a replaceable cog in their machine, I am also a cog that other machines would like to install given the right opportunity. And I am always aware of my current market value.
duderific | 11 hours ago
cricketsandmops | 19 hours ago
varispeed | 18 hours ago
yieldcrv | 17 hours ago
they're not interested, they view it as a work tool and they always have one as they avoid gaps in their resume
no different than say, a work badge. you can buy an NFC enabled badge from ebay but you never will
rvba | 13 hours ago
potatototoo99 | 12 hours ago
yieldcrv | 11 hours ago
and you don't need all of that to do anything the professional world wants or requires
stevekemp | 17 hours ago
I know the last time I left my job I was given the opportunity to buy an M1 mac with 16Gb of RAM for €100, so of course I did.
(Though I also paid €500 to keep the phone they'd bought for me, which was perhaps not such a good deal, it was convienent and I do like the phone, but I'd have been happy to have a random cheap android phone, I have no specific requirements beyond "small enough to fit inside a sporran"!)
pjmlp | 19 hours ago
paxy | 19 hours ago
pjmlp | 19 hours ago
alexfoo | 18 hours ago
No chance you can do that on "sick days", fake doctor/dentist appointments, or other such scheming. Taking many half days of personal leave just isn't workable either. You're not in full control of the scheduling to make different companies interview you one after each other on the same day, or take the same time between rounds. Some could have been scheduled in lunch breaks but not all of it.
Most people I've worked with would just schedule some "focus time" and were either WFH or headed off to a quiet part of the office or a nearby co-working space. Personal laptops are easier to use offsite obviously.
pjmlp | 15 hours ago
For the ones I usually take, a few hours out from overtime budget is enough, or WFH days.
With 30 days holidays + overtime budget, taking a day off for an site interview, is manageable.
mrheosuper | 9 hours ago
pjmlp | 5 hours ago
kakacik | 13 hours ago
Why it isn't? A genuine question, I presume this is more typical US culture or dare I say workaholism and various self-pressures to maintain some public office image?
I recently took quite a few half days off to manage workers doing bigger reconstruction in our apartment. Sometimes full day. Then smashed a week of vacation in Sardinia in between. Everybody understood whats happening, nobody cared since many went through similar exercise before.
Your time is your time, if you actually let it happen. Or you can spend your life living with servile attitude, nobody will thank you though.
alexfoo | 12 hours ago
Because my personal leave is time I want to spend with my family. I would have had to have taken about 4 days worth of leave (8 half days) to cover these interviews and that's 4 days a year less I get to spend with my wife and kids.
(UK based so not US culture, and not workaholism or image.)
wolvesechoes | an hour ago
Programmers don't have any self-respect.
appreciatorBus | 17 hours ago
paganel | 17 hours ago
Because those half-days soon add up, in this market you don't apply just to one company.
gorbachev | 12 hours ago
ponector | 2 hours ago
firstplacelast | 14 hours ago
illiac786 | 14 hours ago
busyant | 17 hours ago
I have a relative who started (what has become) a successful winery.
During the first few years he worked on the winery on nights/weekends, but he kept his day-job as a finance guy at a relatively large company.
He told me he had to give a presentation at the company one day, plugged his laptop into the conference room projector and up popped a spreadsheet of wine-making measurements (pH, temperature, % alcohol, etc.). He said everyone in the room laughed.
maccard | 17 hours ago
mrheosuper | 9 hours ago
maccard | 3 hours ago
syshyk | 3 hours ago
I get enough calls asking what security appliances we use, most are probably sales, but heck no should you answer this... It's obvious many people do though.
HeavenFox | 20 hours ago
krautsauer | 20 hours ago
sgerenser | 19 hours ago
pjmlp | 19 hours ago
ajb | 19 hours ago
The company was a bit salty about this as laptops are more expensive, but they got them. And of course the company befitted, as that was the end of a clear separation between work and home. You have your laptop, you can answer email and attend meetings with people in other time zones. Before, it was easy; work stuff stayed on work computers and those didn't leave the office when you went home.
pjmlp | 19 hours ago
ajb | 16 hours ago
pjmlp | 15 hours ago
pjmlp | 19 hours ago
f6v | 17 hours ago
podocarp | 20 hours ago
jstanley | 20 hours ago
javier123454321 | 19 hours ago
samudrijan | 15 hours ago
999900000999 | 20 hours ago
At several companies I’ve seen folks run torrents to watch movies at work.
Once I was on a Zoom call, and I noticed music production software on my colleagues computer.
When I pointed it out, they responded with something like “ Ohh, my kids make music.”
Neat, I guess.
aleph_minus_one | 20 hours ago
We are talking about highly educated people who work in software development (i.e. can assumed to have some minimum viable knowledge about computers), and not about the dumbest imaginable users.
dylan604 | 20 hours ago
That's a bit of charity isn't it? Lot's of people in tech that really not that clever even if they are smart. Also, people in HR aren't as tech savvy.
aleph_minus_one | 19 hours ago
xhkkffbf | 19 hours ago
Do I need to go on?
f6v | 16 hours ago
It wasn’t until my PhD when I took an elective in Argumentation theory that I learned about constructing a good argument. And I only learned about fallacies somewhere on the internet.
* I have a PhD in STEM.
999900000999 | 20 hours ago
-Darth Vader.
Being able to make React components does not require you to be smarter than the average person.
You also have multiple types of intelligence. I worked with a brilliant intern once. The kid was over 100k in student loan debt and didn’t know the loans can’t get discharged.
draygonia | 19 hours ago
999900000999 | 18 hours ago
They can garnish Social Security if you default on Student Loans.
https://www.cbsnews.com/news/how-much-social-security-garnis...
draygonia | 14 hours ago
999900000999 | 14 hours ago
I’m not going to look it up, but at a certain point you’re judgement proof anyway.
I suspect that many desperately poor can successfully dodge the garnishment.
koito17 | 20 hours ago
vkou | 19 hours ago
vkou | 19 hours ago
> dumbest imaginable users.
They are often one and the same.
pixl97 | 19 hours ago
"Need some new software" = "Download it from some random website"
"Software won't run" = "Turn off AV and get it everything permission"
"Still won't run" = "run as root"
aleph_minus_one | 19 hours ago
My experience is completely different: many software developers are rather paranoid with respect to security, and have quite a good (though far from expert-level) knowledge about security. It's rather that many software developers are quite hostile to security practices that are mostly "security theater" and obstructs them in doing their work.
The following Reddit post
> https://www.reddit.com/r/NonPoliticalTwitter/comments/1e8do2...
and the top answer
> https://www.reddit.com/r/NonPoliticalTwitter/comments/1e8do2...
describe the mindset that I observe rather well.
winstonwinston | 9 hours ago
justsomehnguy | 19 hours ago
No, 'people who work in software development' != 'highly educated people' and those both != 'understand how computers work'.
paxy | 17 hours ago
Plenty of software engineeers (and doctors, lawyers, scientists...) are geniuses in their field but have zero common sense.
GaryBluto | 19 hours ago
It is one thing to do personal things on a work laptop, it is another all together to give your children free reign. Are there no penal measures taken to deter this anymore?
debo_ | 18 hours ago
gadders | 20 hours ago
I think Binance needs to start having IT Security like a bank as well.
GoToRO | 20 hours ago
gadders | 19 hours ago
cityofdelusion | 19 hours ago
sitkack | 19 hours ago
lionkor | 3 hours ago
Tangurena2 | 18 hours ago
I have not needed admin credentials for regular development purposes since VB6 (which I was using until 2013). VB6 and ActiveX dlls required read/write access to the registry all the time.
MrMorden | 16 hours ago
Caloric3002Swed | 19 hours ago
cityofdelusion | 19 hours ago
plagiarist | 19 hours ago
TacticalCoder | 19 hours ago
I don't disagree but note that apparently a bank in France, Credit Mutuel (and it's Fortuneo online arm), just got robbed of hundreds of millions of EUR: hackers who have beforehand created accounts on Kraken (a cryptocurrencies exchange) and who then wired millions to different accounts, bought cryptocurrencies, and withdraw the crypto.
But the hack was really stealing hundreds of millions from the bank.
So not even banks are safe now.
nradov | 18 hours ago
AlexITC | 20 hours ago
I don't know how people are ok using their personal accounts on work-laptops full of spyware.
margalabargala | 19 hours ago
So despite it being a "company" computer I personally installed the blank SSD and installed Arch on it and did not install any company spyware.
I was perfectly comfortable also having Steam installed so I could entertain myself on the plane on business trips. I knew everything installed and spyware wasn't on the list.
When I work at companies that have MDM set up on my computer, I don't do that.
genidoi | 20 hours ago
dayvid | 20 hours ago
dewey | 19 hours ago
markus_zhang | 18 hours ago
AdrianB1 | 18 hours ago
I have a personal desktop because I grew up with video games and a desktop was always a personal investment. I never had a personal laptop, I cannot justify the cost (not a trivial expense, even if my work title is extremely fancy it does not pay on par), so if I would be traveling I would have to take the only laptop I have with me - the work laptop. Well, I managed to never use it, I don't take it with me, but there is a lot of effort in that.
In such a company I would give employees 2 laptops and 2 phones, one set for work only, one set for personal use only, then I would fire on the spot anyone mixing the usage. That would be a start in a longer journey of protecting the company.
aaaronic | 18 hours ago
I also refuse to install Intune or similar on my personal hardware. Keep work and personal like oil and water!
varispeed | 18 hours ago
Often this is solely fault of employers not paying their workers enough.
zerr | 17 hours ago
convict | 17 hours ago
illiac786 | 14 hours ago
AlwaysRock | 13 hours ago
paxy | 21 hours ago
Maken | 21 hours ago
sva_ | 20 hours ago
https://isc.sans.edu/diary/32942
It is kind of weird that they mention it though, if they replaced the devices and rotated credentials? Just to later mention that an "internal AI tool" was used to steal that Engineer As credentials again?
And also, what are those "obfuscation techniques"? It looks very straight forward, replacing the pyenv, there's nothing much obfuscated in it? Except for putting it in a different folder.
arm32 | 20 hours ago
rddbs | 14 hours ago
mapmeld | 13 hours ago
mrheosuper | 9 hours ago
BigTTYGothGF | 20 hours ago
ChrisArchitect | 20 hours ago
FLeXMurphy | 20 hours ago
moralestapia | 20 hours ago
They have a massive incentive to invent a story to cover up the incident. I'm not saying it's a cover-up, but the motive is definitely there.
North Korea has denied responsibility, whereas they usually own up to their actions.
Disregarding that, it just doesn't make sense for their internal security to be so lax.
I've worked at big companies but with AUM lower than Binance, a lot of control and safeguards are in place to prevent one "rogue" employee from stealing everything.
It's pretty much impossible for a company like Binance to not have implemented such things. I do not buy it.
odyssey7 | 19 hours ago
nullorempty | 18 hours ago
nullorempty | 18 hours ago
moralestapia | 18 hours ago
Google any of these names: Sam Bankman-Fried, Jordan Belfort, Elizabeth Holmes, Kenneth Lay, Bernie Madoff or Jeffrey Skilling.
Man, you're going to have fun reading about what they did!
travisfromusa | 18 hours ago
Another important note is that Binance has a strong incentive to cover up certain details, given that the company itself is anything but transparent. They also control CoinMarketCap, where they promote only projects that serve their own interests, while rejecting legitimate projects due to Binance's conflicts of interest. Several public reports and data document these practices.
nullorempty | 18 hours ago
armcat | 20 hours ago
randomNumber7 | 19 hours ago
sevmardi | 19 hours ago
armcat | 18 hours ago
Duwensatzaj | 18 hours ago
armcat | 16 hours ago
Animats | 16 hours ago
I used to go to parties at Hacker Dojo in the early days of AI. Google wasn't into AI yet and Hacker Dojo had classes, often attended by Google people. (I learned way too much about support vector machines, in a class taught by a guy from BlackRock.) There were a lot of very good looking Chinese women at the parties who were very interested in what people were working on. They were very bright, understood the subject, and had business cards from small companies no one had heard of. Then one day they all disappeared and were not seen again. I regret not asking one how she liked working for the Third Department.
gosen | 20 hours ago
aleph_minus_one | 20 hours ago
I mean: if you even consider leaving your current company, you better leave no traces of your plan on your work laptop: you either use a private laptop or, even better, some burner laptop/computer that you reset afterwards.
AlexITC | 20 hours ago
In one of these many calls I got to see the face from the other side but lasted a few seconds only. Then he claimed that internet was bad and suggested we continued without video.
In this case they claim it was a 2 rounds interview with video turned on to simulate a more normal recruiting process.
Of course all of us are prone to get caught with the shield off but what surprises me is that the targeted dev took the challenge in the device from work.
gandreani | 20 hours ago
That's a huge red-flag. In a company of this size, the deployments should be via CI only. CI isn't just to increase the speed and reliability of deployments but also to provide a clean room to build the software! Even if it's a token that was copied and pasted temporarily, the systems in place should not have to require this type of 1. copy 2. paste 3. remember-to-delete the token from my PC.
Also, Binance should be paying for intrusion testing. Better to pay a trusted company to do this kind of thing instead of letting North Korea show you how it's done. I don't think this exact exploit path would have been found but I bet the intrusion testing would have figured out another way to use Engineer C's token.
AlexITC | 20 hours ago
dylan604 | 20 hours ago
philipwhiuk | 20 hours ago
hirako2000 | 19 hours ago
Aurornis | 19 hours ago
optimalsolver | 19 hours ago
solyin | 16 hours ago
Which is also why we, collectively, as an industry needs to not put up with that. It's easy for me to say from the comfort of it not being my job on the line, that if this happens to anybody they should quit and then name and shame the company, but a competent security team is going to have the idea of doing a fake phishing interview and then not do it because of how morale destroying that would be. The security awareness team sending fake phishing emails are embarrassing enough.
Aurornis | 19 hours ago
Anyone who fell for it would not only get in trouble for poor security practice, they would reveal that they were job searching. That opens an entire can of worms that creates problems beyond the pentest. This also angers other employees who see it as a double-trap being sprung on employees.
Another major problem is that responsible employees who accept the fake interview but then use their personal laptop to do the interview will have their personal laptop compromised by the pentesters. Responsible testers will immediately abort, but some will try to use the personal laptop to pivot deeper which is a huge ick. It’s also really bad if the company is compromising personal laptops of people who are doing the right thing (switching to personal gear for interviews).
quaffcode | 19 hours ago
NikolaNovak | 18 hours ago
Hired oentest has company permission to do stuff on company property. I do not imagine they have right to do so to personal property.
manphone | 18 hours ago
realo | 17 hours ago
Game over.
PeterisP | 14 hours ago
Taking over that first engineer's workstation shouldn't ever have resulted in $6.3B of damages. I would consider it reasonable if those privileges could be abused (by e.g. the same engineer intentionally) to cause $6.3M of damages and the rest would be mitigated or prevented; so for this incident we could say that 0.1% of the impact was caused by the initial compromise of that workstation and 99.9% of the losses were caused by all the other failures - so it's effective for any pentest to focus on the latter part, ignore the social engineering and phishing part (since you can't really eliminate it anyway - unlike many other flaws) and assume initial compromise as a starting point.
manwe150 | 51 minutes ago
ShinyLeftPad | 17 hours ago
0cf8612b2e1e | 17 hours ago
ShinyLeftPad | 15 hours ago
skeeter2020 | 16 hours ago
fc417fc802 | 12 hours ago
If your laptop is successfully compromised by the pentesters then pretty much by definition you weren't being responsible. Though I agree that pentesters going after personal devices is ethically dubious.
Aurornis | 11 hours ago
> Though I agree that pentesters going after personal devices is ethically dubious.
It's not just ethically dubious. It crosses a lot of legal boundaries. A company can consent to have their personal devices hacked. An employee doesn't automatically consent to let a company's contractors access their personal devices.
thomc | 19 hours ago
shepherdjerred | 18 hours ago
nradov | 18 hours ago
phyzome | 13 hours ago
FitchApps | 17 hours ago
cldellow | 16 hours ago
For many build chains, that involves implicitly installing software.
fc417fc802 | 12 hours ago
That said I wouldn't trust a compiler to be hardened against malicious input and anyway you presumably need to run the output so all of that should be happening in a hardened sandbox regardless.
zaphirplane | 14 hours ago
qurren | 13 hours ago
If you ever meet with Alibaba for any reason they'll ask you to download their conference software. Unfortunately most people in the China ecosystem don't have the guts to say no and will just gleefully install any .exe thrown at them.
benoau | 20 hours ago
One of the first things I did in my last job was shift processes like this off my team's computers, aside from the security ramifications all it takes is one dumb mistake, one up-arrow too many, one didn't-read-the-whole-line, and now you're doing something to production by accident!
hirako2000 | 19 hours ago
It took a couple months to get the pipeline out of their laptop.
Worth it, yes, as we found interesting things in there which explained why they were so reluctant to deploy upgrades.
pjc50 | 19 hours ago
.. backdoors which enabled the dev to deploy exploits of their own which wouldn't be visible through CI?
hirako2000 | 17 hours ago
jacekm | 19 hours ago
steve1977 | 18 hours ago
rafabulsing | 8 hours ago
nightpool | 14 hours ago
nutjob2 | 13 hours ago
Sure, but those meat puppets shouldn't be developers, they should be administrators, using proper procedures.
Separation of powers seems so fundamental yet also so totally ignored these days.
panicinducer | 19 hours ago
ffsm8 | 18 hours ago
Quinner | 18 hours ago
long-time-first | 18 hours ago
jMyles | 18 hours ago
ForHackernews | 18 hours ago
PeeMcGee | 18 hours ago
neutronicus | 18 hours ago
wahern | 17 hours ago
vondur | 17 hours ago
wolfi1 | 15 hours ago
otterley | 13 hours ago
theoreticalmal | 7 hours ago
yobananaboy | 17 hours ago
tennysont | 14 hours ago
[1] The fact that the needed to sign 50 of these transactions to solve a race condition seems like an implementation detail
stogot | 11 hours ago
cowlevel | 10 hours ago
tennysont | 4 hours ago
SpaceNoodled | 16 hours ago
Animats | 16 hours ago
RHSeeger | 16 hours ago
wolfi1 | 15 hours ago
burningChrome | 16 hours ago
The fact nobody thought of this is pretty staggering.
littlecranky67 | 16 hours ago
Betelbuddy | 15 hours ago
stinkbeetle | 12 hours ago
lol that's the worst control I've ever heard.
melenaboija | 12 hours ago
theoreticalmal | 7 hours ago
fhn | 12 hours ago
WesolyKubeczek | 19 hours ago
The point is that at some point you do need to open the door and let the code in.
stickfigure | 18 hours ago
WesolyKubeczek | 15 hours ago
baal80spam | 14 hours ago
mianos | 14 hours ago
zaphirplane | 14 hours ago
zaphirplane | 14 hours ago
eptcyka | 19 hours ago
suzzer99 | 18 hours ago
jandrese | 15 hours ago
_heimdall | 17 hours ago
yubblegum | 16 hours ago
That unlettered (npi) engineer who downloaded and ran the interview software on his or her machine is what the human weak link here. Let's call them Engineer F. Seems like this person was specifically selected from the dev team.
burningChrome | 15 hours ago
Twice I scanned the file after downloading it to a sandbox and twice it found malware that would've been installed.
While this is by far the worst case of this happening, I've read at least a half dozen other accounts of recruiting companies attempting to install malware through the same process. I'm not saying the person should have known, but it's scary this is becoming more and more common.
fc417fc802 | 12 hours ago
This person definitely should have known. You don't download and run arbitrary binaries outside of a VM. At this point you don't even compile code from an untrusted source. This is the power user equivalent of falling for a phishing email.
saalweachter | 12 hours ago
rafabulsing | 8 hours ago
Naru41 | 11 hours ago
Every service provider system should be designed with the assumption that programmers' PCs and smartphones may be compromised.
r_lee | an hour ago
but enterprises usually prefer the latter, I guess it's more convenient since it bypasses the bureaucratic processes?
throwitaway222 | 20 hours ago
1970-01-01 | 20 hours ago
gadders | 20 hours ago
Both candidate and recruiter have to call Kim Jong Un a big fat tosser (other swearwords are available) on a recorded video before the interview continues.
https://www.youtube.com/watch?v=g7v2clX8ynE
lexarflash8g | 14 hours ago
I mean it would make sense to hire these NK guys to consult DevSec teams if it wasn't for the travel restrictions in NK -- sort of like how reformed black-hat hackers get legit jobs in the IT sec industry.
gyanchawdhary | 20 hours ago
The biggest irony is that we get at least a couple of signups every month from South Korea, Russia, India, Nigeria just to try getting access to our platform for running these attacks ..
Here is the most recent copy paste from a Calendly invite ..
>Invitee Email: >ashley@cairnsovereign.net
>Invitee Time Zone: >Central European Time
>Questions:
>Please share anything that will help prepare for our meeting.
>We are an MSP from the UK that is look for a deepfake platform to run campaigns for our clients. We typically use open source software but there is a gap in our portfolio for deepfake testing that we can't fill with our usual open source philosophy.
The company website https://www.cairnsovereign.net/ was registered just 2 days ago .. they have no linkedin presence, fake CEO and fake CTO and fake everything ..
I still accepted the invite and joined and the person has a strong northern british accent .. he askd me to let his AI bot join the call to take notes ... i refused .. to which he swore and said that if a meeting bot is not allowed .. then i dont want to talk and abruptly hung up ...
PS: if anyone wants to see .. this is what a real time voice impersonation call and real time deepfake faceswap .. looks like ..
https://www.callstrike.ai/deepfake-security-training
https://www.callstrike.ai/voice-phishing-simulator
aleksandrm | 20 hours ago
philipwhiuk | 19 hours ago
dboreham | 20 hours ago
xboxnolifes | 19 hours ago
A very recent one wanted me to download an executable which was to "stop me from cheating with AI", which was clearly fake. I've had plenty of interviews where I was expected to clone, fix, and run a repo, which as far as I can tell, all were from legitimate companies. An illegitimate company could easy do the same process with malware.
cwiggs | 19 hours ago
> use of an internal AI tool as a springboard. The attacker leveraged the compromised computer of engineer B and used an internal AI tool to gain control over the Wallet DevOps Engineer A and another Wallet Software Engineer C. The attacker soon discovered Wallet DevOps Engineer A had a container deployment permission token on his computer.
With the AI craze going on recently I've worked at multiple companies where an internal AI tool was vibecoded and I've always been worried about the security implications.
worksonmine | 19 hours ago
What the fuck? On a target as big as Binance? Every developer should be treated as a liability and never be able to deploy by themselves.
lexarflash8g | 14 hours ago
I wouldn't be surprised if the guys they compromised were high-level staff engineers with the keys to the kingdom so to speak so they found a loophole. Security is hard because the attack only needs one chance to get it right -- and defense needs to get it right every single time.
vrganj | 19 hours ago
https://www.bbc.com/audio/series/w27vqd03
(It's also on Spotify, Apple Podcasts etc)
flerchin | 19 hours ago
odyssey7 | 19 hours ago
flerchin | 18 hours ago
nurumaik | 19 hours ago
FatalLogic | 17 hours ago
toss1 | 19 hours ago
>> trace and freeze the assets
It has gotten to the point where the advertised permanence of cryptocoin transactions is a serous national security threat, literally funneling $6+billion to a nation-state whose publicly avowed statements is to destroy the US to fund its nuclear weapons program.
The party is ending. The house lights are flashing. Crypto will either become controlled so illegitimate transactions will be roll-back-able (presumably with proper court or NatSec orders), or it will be banned.
travisfromusa | 18 hours ago
toss1 | 12 hours ago
I expect this trend will continue to the point where the original feature of transactions absolutely untouchable or un-blockable by the state will be gone with the exception of trivial deep underground cryptochains.
DrBazza | 19 hours ago
The name on the CV, was, for the sake of privacy, Michael Smith, from Australia, and ticked the right boxes.
We'd expect a fluent, Aussie-accented English speaker. Instead, we had a candidate with a webcam that wouldn't work (weird!!), with clearly accented English of a East-Asian background. I suppose there's a vanishing chance they really were Mike Smith of Adelaide or wherever, but we couldn't take that chance. We tried rescheduling, but tumbleweeds...
debo_ | 18 hours ago
pants2 | 18 hours ago
anal_reactor | 12 hours ago
jedbrooke | 17 hours ago
graemep | 12 hours ago
veltas | 19 hours ago
129-1 | 19 hours ago
Some companies require you to install Windows remote administration tools (basically root kits) on your machine to check whether you are using search engines or AI. It is insane.
odyssey7 | 19 hours ago
Even if you don’t understand the security concerns of running some 3rd party’s scripts on a work device, more pedestrian situational awareness should have prevented such a wild misjudgment?
up2isomorphism | 19 hours ago
asadotzler | 19 hours ago
stefap2 | 19 hours ago
tasuki | 19 hours ago
Yes of course they didn't. The whole "endpoint security" industry is a scam. They're attempting to (or attempting to appear to) solve an impossible problem. All they do is install spyware and backdoors, reducing security rather than enhancing it.
barbazoo | 19 hours ago
[0] https://www.binance.com/en/blog/community/322915344375956676...
[1] https://isc.sans.edu/diary/32942
giantg2 | 18 hours ago
simianwords | 18 hours ago
anon84873628 | 18 hours ago
quaddoggy | 18 hours ago
anal_reactor | 12 hours ago
seki285 | 14 hours ago
samirillian | 12 hours ago
DonHopkins | 11 hours ago
inChargeOfIT | 18 hours ago
lern_too_spel | 18 hours ago
mike_bob | 18 hours ago
kfichter | 18 hours ago
I hope that Binance understands this and spends less time worrying about how the laptop was compromised and more time securing their systems under the very basic assumption that laptops will be compromised.
maeln | 18 hours ago
dust42 | 18 hours ago
tehjoker | 18 hours ago
"TRM attributes this attack to TraderTraitor, North Korea’s premier hacking unit. We base this assessment on robust on and off-chain intelligence sources. The FBI named the same group as responsible for the USD 1.5 billion Bybit hack in February 2025. Several features of this attack match earlier North Korea-linked heists, including the Bybit hack and the KelpDAO hack in April 2026: small Tornado Cash withdrawals funding an operator wallet, staging that began well before the theft, and signatures obtained in advance then executed in one burst. The laundering observed so far, built on large swaps through market makers and lending protocols, differs from the bridge-heavy pattern that followed Bybit. TRM will share further findings as the investigation develops."
https://www.trmlabs.com/resources/blog/north-korea-steals-us...
This is simply an assertion that an official enemy did something we don't like. It could just as well be a CIA money laundering scheme. This would make more sense, given the wider deployment of US cyber weapons and assets as well as the desire of North Korea not to provoke American aggression which previously murdered about 20% of their population.
It is widely known America has cyberweapons deployed around the globe. It is likely trivial for them to fake a trail of evidence from the DPRK.
ETH_start | 18 hours ago
sznio | 17 hours ago
TeriyakiBomb | 17 hours ago
bethekidyouwant | 17 hours ago
israrkhan | 17 hours ago
That is a huge red flag, and reflects on binance internal security. I would be wary of dealing with this company,
59percentmore | 17 hours ago
roggenilsson | 16 hours ago
kyleblarson | 16 hours ago
ionwake | 16 hours ago
Dont trust anything anymore.
100111011111 | 16 hours ago
purplemantis | 16 hours ago
xpct | 14 hours ago
leofree | 16 hours ago
slicktux | 15 hours ago
https://www.justice.gov/opa/pr/arizona-woman-sentenced-17m-i...
vmuhammadsaid20 | 15 hours ago
Kuyawa | 14 hours ago
Binance bugs us all the time to confirm everything before making a $5 payment. Why don't they enforce higher security steps in their own wallets? Also, how can AI access Google Authenticator?
vconnor | 14 hours ago
Somehow I really doubt it.
socketcluster | 14 hours ago
They tried to get me to git clone a repo, presumably to get me to install malicious npm dependencies.
I refused, then they wanted me to download Claude Code but I told them I already had Claude Code harness installed on my machine... But they said I should install a different version of it; they sent me a link... The landing page was the same kind of design as Anthropic uses but I didn't recognise the URL. I stopped the interview right there.
phyzome | 13 hours ago
shevy-java | 13 hours ago
overcast | 13 hours ago
https://news.ycombinator.com/item?id=50353818 https://news.ycombinator.com/item?id=50357080
puffybuf | 13 hours ago
labrador | 13 hours ago
selicos | 12 hours ago
This is what crypto is all about: decentralized tokens that require central management and control to be useful and prevent fraud.
yunnpp | 12 hours ago
herzigma | 12 hours ago
ejpir | 12 hours ago