It's just a cherry on top of the existing hiring process in the IT. It wouldn't surprised that it will make things even worse - companies will be more scared to talk to anyone and good candidates will be scared to reply

My hunch is that this was partly an inside job. The "fake job interview" and "mistakenly downloaded trojaned homebrew" stories are to give plausible deniability. But they're not very plausible imho.

Two factor authentication?

Binance bugs us all the time to confirm everything before making a $5 payment. Why don't they enforce higher security steps in their own wallets? Also, how can AI access Google Authenticator?

Yeah, lots of good conversation on steps to take. One thing I never see mentioned is who should review and test them. Especially for a financial company, it seems they have no IT compliance/audit functions. Even at many big companies it seems IT control creation, maintenance, and testing is largely ignored or just put onto the people implementing and performing the control - a huge conflict of interest. Control analyst posting are something like 1 to 10K when measured against dev postings. Really telling when it comes to what companies actually care about...

I suspect we'll look back on "Nork" as a derogatory racial term that didn't need to be used here. Just call them the attackers, or by their group name, or whatever.

Obligatory and should be obvious: a threat model that allows a single compromised laptop to result in a $6.3B loss is fundamentally flawed. Analyze the specific way that the laptop was compromised all you want, the fault here is entirely with the Binance security culture that allows such a gaping hole to exist in the first place.

I hope that Binance understands this and spends less time worrying about how the laptop was compromised and more time securing their systems under the very basic assumption that laptops will be compromised.

North Korea's open hostility to Western systems combined with its highly proficient human capital creates a bizarre situation where a formidable state-level actor is waging unrelenting warfare against private companies that operate in the Western-led global economic system, and due to the nature of the internet and North Korea's nuclear deterrent, there is no way to force that actor to stop.

After reading this story I understood that a lot of pieces had to come together to make the plan work. It was a huge long shot from the start and that makes me wonder how many times they must have tried this in the past? To make long shots like this work they must have tried relentlessly; they would've tried hundreds of thousands of developers before this

Recently, I was designing a technical test for a candidate and I thought about putting some prompt injection to try to see if the candidate used an agent and be part of a cybersecurity tests. I didn't do it because it felt unethical, but turns out you don't even need the prompt injection part.

Zoom exploits could have done this without downloads. I don't interview on a computer with sensitive data, it's usually a throwaway. I sometimes get judged for doing the interview on a Chromebook or an old Mac and I hope that interviewers understand why I choose to do it this way.