Top
Best
New

Posted by smalltech 4 days ago

North Korean fake job interview led to $6.3B Binance heist(www.theregister.com)
656 points | 384 commentspage 5
butterNaN 2 days ago|
How does an "Internal AI tool" on A's computer compromise B and C's computers?
toss1 4 days ago||
>> "...and is working with law enforcement, blockchain intel firms, and security researchers to trace and freeze the assets. The crypto exchange has also hired independent cybersecurity experts to conduct a cybersecurity review of the incident, and recommend additional protective measures."

>> trace and freeze the assets

It has gotten to the point where the advertised permanence of cryptocoin transactions is a serous national security threat, literally funneling $6+billion to a nation-state whose publicly avowed statements is to destroy the US to fund its nuclear weapons program.

The party is ending. The house lights are flashing. Crypto will either become controlled so illegitimate transactions will be roll-back-able (presumably with proper court or NatSec orders), or it will be banned.

travisfromusa 4 days ago|
This is already a reality. USDT, USDC, and many other smart contracts allow for the freezing of funds worldwide. Arbitrum rolls back its chain whenever it wants. State-sponsored Twitter influencers like Taylor Monahan (tayvano_), Zachary Wolk (ZachXBT), and Nick Bax (bax1337), falsely flagged as independent, publicly appeal to Thorchain (the only decentralized swap protocol between various native on-chain assets) to integrate transaction screening directly into the node consensus. EU has made accepting Monero illegal starting in 2027, among many other measures. Western governments have already succeeded in making crypto very controllable.
toss1 3 days ago||
Exactly.

I expect this trend will continue to the point where the original feature of transactions absolutely untouchable or un-blockable by the state will be gone with the exception of trivial deep underground cryptochains.

ChrisArchitect 4 days ago||
[dupe] https://news.ycombinator.com/item?id=50353818
steveBK123 4 days ago||
Pretty funny that tech makes candidates jump through all sorts of automated, inhumane loops to even advance to talking to a real human in the hiring process.

And now you get results like this.

intrasight 4 days ago||
I remember in the mid-90s going to an interview in Manhattan - pre-Internet. Someone met me and led me to a table and said, "Here's where you're going to take your test." I said, "I don't take tests." She said "Everyone that comes in takes the test". I said, "Well, that's no longer true because I came in and I'm leaving without taking the test"
progforlyfe 4 days ago|||
While I love the "edgy-ness" of this, I remember doing something like this around 2013 in Manhattan and kind of enjoyed it. They had me go into a room, and gave me a paper with an open ended question: it was something along the lines of, write as much detail as I could about what happens when a user visits a URL in a web browser. E.g. explain as much as I know about TCP, HTTP requests, web servers, etc. I think I touched on how Cookies worked as well.

No AI, no leet code, just old fashioned gauging someone's experience and communication skills.

intrasight 4 days ago|||
My first job interview in 1989 after college:

Them: "Do you know TCP/IP?". Me: "Yes". Them: "you're hired"

Job at the Westinghouse instrumenting nuclear power plants. Simpler times then.

jandrese 3 days ago|||
Back in 1989 that was a rare skill. Many of the engineers who had experience were working on government projects. I mean TCP barely had congestion control at that point, it was very early days.
sigttou 3 days ago||||
"Usually we don't hire people from high school, but you had Common Lisp in your CV, so the engineers said to take you anyway." 2010, still simpler times.
vconnor 3 days ago||||
Same for me in 2006 as a junior Linux sysadmin:

“What does ifconfig do? What does it mean to mount a disk? What editor do you use? You’re hired.”

None of that culture fit nonsense.

Tyr42 3 days ago||
Did you say vim or emacs? Might have been culture for afterall.
vconnor 3 days ago||
I forget. I used to use emacs but very superficially; when I started the job a literal greybeard UNIX admin shook his head and took me under his wing to teach me vim, which I used for a long time before switching back to emacs (and learning the elisp underpinnings of it)
selicos 3 days ago|||
Do you know DNS? How does an HTTPs/SSL handshake work? Man this kid is good hire him. - 2015 era job interview
mrheosuper 3 days ago||
Have you finished 3 months Javascript bootcamp ? you're hired - 2019 era.
intrasight 4 days ago||||
I'm fine with technical interviews that are "test-like", with questions and answers and discussion and with an engineer who is my technical equal. But this was not that.
steveBK123 4 days ago||
The more inhumane the screener the worse the job in my experience.

Had one recently that waived me thru and then sent me straight to talking to senior management/stakeholders/etc but literally no one on the team itself.

Couldn’t get a straight answer as to what team does, what role is for, real day to day I’d be walking.

Only clear thing was scale of architectural mess stemming from a political mess… and not a lot of interest in changing it.

They wanted a seasoned tech body to throw into the grinder 12-15hr days to replace the last one. No thanks.

nzjrs 4 days ago||||
I did this as a test in 2018! Compares to the leetcode screens now, it was a dream
_whiteCaps_ 4 days ago|||
I love this test and will dive deep into switch debouncing on keyboards when they press the enter key.
camtarn 3 days ago||
I have never had the opportunity to ask this as an interview question. I'm secretly hoping that the first time I do so, somebody will lead off with "So, let's skip past the discussion of free will that might occur when considering how the user decides to visit the website, and instead start at the motor cortex..."

I'd also love a deep dive into the keyboard microcontroller that ends with the key press leaving over USB , and never even considers the main CPU.

Honestly, even the facetious answers to this have the potential to be incredibly interesting. Reality just has a ton of depth.

bmacho 4 days ago||||
I'm confused, I'm probably missing here something.

By 'test' you mean a school-type paper exam, questions and answers? (On unspecified topics.)

Why would you refuse that, when applying to a job?

paganel 3 days ago||
> Why would you refuse that, when applying to a job?

Not the OP, but from a certain point on (I'd say 3-5 years into one's career, I'd say maybe even earlier) school-type tests become quite ridiculous, as in real-life programming/development has nothing to do with how people are graded in school.

howunfortunate 3 days ago||
> nothing to do with how people are graded

If by "nothing to do with" you mean "uncorrelated", then this is very trivial and empirically untrue. There are a lot of tests that correlate with peer and manager-rated performance in software development (and many other roles).

Even the dumbest most ad hoc unrelated tests will have nonzero correlations, and the well-studied principled ones much more so.

The better argument is that tests are high effort and can feel demeaning. But it's not productive to pretend they don't work.

paganel 3 days ago||
This has not been my experience. Granted, I’ve never worked for a FAANG-like company, but in my 20 years of writing code for a living I’ve seen a lot more unknown unknowns in my day-to-day work compared to what school had prepared me to handle.
gosub100 4 days ago||||
It's also for liability. If someone comes in with the intention of suing them, they can point to the test and have objective evidence that the rejection was not based on race or gender. It also allows them to gather data after the employee gets established and succeeds or fails.

Also in the mid 90s, you actually had to be smart to work in this field. There was no stack overflow or reddit to search. And CS programs were nascent.

Companies certainly have taken it too far, but I don't blame them for some usage of standard tests.

hnlmorg 3 days ago||
As a hiring manager, I can assure you that’s not true.

If you cannot explain why a successful candidate was chosen without bias, then you shouldn’t be interviewing candidates to begin with.

But it is always worth keeping a copy of your interview notes just in case the candidate asks for feedback.

gilrain 4 days ago||||
Excellent choice! No amount of money feels as good as claiming the respect you deserve.
autoexec 4 days ago||||
That's how I react to companies wanting personality tests.
hnlmorg 4 days ago||||
And I bet you both came away from that interview feeling like you’d dodged a bullet. The interviewer just as much as yourself.
Horffupolde 4 days ago||||
Wow how tough.
nutjob2 3 days ago||||
How is mid 90's pre-internet?
raincole 4 days ago||||
I honestly don't know what's so wrong about taking a test for a job, unless the job already requires some kind of certifications/licenses. I, personally, wish that my doctors and lawyers have passed some tests.
steveBK123 4 days ago|||
More often than not the test is at best tangentially related to the role.

At worst it’s the biggest hardos on the team writing a bunch of brain teasers and gotchas as a hazing ritual.

sgerenser 4 days ago||
Hey, one day the fate of the company is going to hinge on getting an accurate estimate of how many ping pong balls can fit into a 747, and they'll be glad that they asked the right brainteasers.
steveBK123 4 days ago||
I had one recently that was like.. I'd be better at this test if I knew less / was less experienced.

An hour to implement a toy version of a component which, the last time I did it "in real life" blew everyone away that I had a prototype ready in 1 day. That real life prototype went through weeks and weeks of iteration before it was even useful, and everyone was happy with that. But yeah that's something to time box to 1 hour in an interview environment.

So turns into an exercise of - which of the 100 pitfalls/nuances do they want me to pretend don't exist in order to complete it in 1 hour. Opinions vary!

There were multiple questions of this form.

One could pass this test blindly as a new grad not knowing the 100 pitfalls of actually building one in real life.

aleph_minus_one 4 days ago|||
> I honestly don't know what's so wrong about taking a test for a job, unless the job already requires some kind of certifications/licenses.

You already have a degree from some university, and you already worked in software development for quite some time. So it's very annoying to do some test over and over again for every job application.

toast0 4 days ago|||
> You already have a degree from some university, and you already worked in software development for quite some time. So it's very annoying to do some test over and over again for every job application.

Ok, but there's no uniform grading in school or employment. We all know people who managed to get through university without learning anything and manage to hold a job in software development without knowing or doing anything. It'd be nice if a degree and a job history guaranteed competence, but it doesn't.

Lots of professions can bring a portfolio and/or a sample of their work, but most software developers can't because the work is often propriatary and a trade secret, and anyway would need a lot of specific setup to operate.

I've only taken test tests for government jobs, and they were laughably outdated; approximately nobody knew how much space was on a 5 1/4" floppy in 1998 when I took the test, but they were asking about 8" floppies, and I assume they still are, because the test had to go through some process and doing a new test would be expensive. But yeah, I expect a company to validate that I can both describe solutions to problems and turn that description into code.

raincole 4 days ago|||
> You already have a degree from some university, and you already worked in software development for quite some time

Yep. Now substitute doctors/lawyers/accountants/civil engineers into the equation and see how you feel about it.

Surely they don't take a test for every client, but I'd consider the interview process more like a "workaround" for the lack of standardized tests for software engineers instead of the lack of respect.

hnlmorg 3 days ago||
They don’t take a test for every client. But they do get regularly monitored for their competency and instead of being fired when they fail, they have their professional license revoked.

Maybe IT professionals should be held to the same rigour. There’s a lot of deadweight in the profession that get paid too much and moan too loudly despite having a cushty job in a field they’re barely competent in.

xyzsparetimexyz 4 days ago|||
Haha owned
y-c-o-m-b 3 days ago|||
Security aside, this is the real (and very sad) take away here. People are so desperate for an organic interview that they end up neglecting common sense. Employers will complain to no end about not finding qualified candidates or dealing with scam candidates, but they're ultimately responsible for perpetuating this predicament to begin with. They're constantly stretching what they can greedily get out of you; whether it's during the hiring phase or while being employed.

I remember doing 6 hours of interviews once for a company, getting to the final stage and they wouldn't budge on $5,000 for a figure they initially accepted but reneged because the manager hiring me would be paid less than me. It was so petty. I turned it down back then, but I'm not sure I would in this market. I'd probably take it and job search while I'm working there like this guy did at Binance.

fraywing 4 days ago||
I know several companies that are pulling SecOps resources in to vet candidates now. It's rough out there.
sva_ 4 days ago||
It is crazy that this Engineer A fell for this malware ad (how do people still fall for these & how does Google still get away with serving malware like that):

https://isc.sans.edu/diary/32942

It is kind of weird that they mention it though, if they replaced the devices and rotated credentials? Just to later mention that an "internal AI tool" was used to steal that Engineer As credentials again?

And also, what are those "obfuscation techniques"? It looks very straight forward, replacing the pyenv, there's nothing much obfuscated in it? Except for putting it in a different folder.

mapmeld 3 days ago||
For people who were newly nervous about clicking an unfamiliar link, this is a blog post describing the initial intrusion - the attackers paid for an ad on Google Search mimicking the homebrew website, which tells you to install it through a script. It's something you might have copied directly into the terminal before.
rddbs 3 days ago|||
No, what would be crazy is to think that zero engineers would fall for this.
mrheosuper 3 days ago|||
NGL i can see 2 AM, caffeine-fueled version of me fails for this
alala-lala-lon 4 days ago|||
[dead]
arm32 4 days ago||
Let's not victim blame plz
ihsw 4 days ago||
[dead]
veltas 4 days ago||
Imagine being able to steal billions in crypto from your work laptop and using same laptop to run code sent to you by another company. I wish I had their problems.
mynegation 4 days ago||
Running interview assignment on a work computer… tsk tsk
insane_dreamer 4 days ago||
didn't specify the eng's role but oh the irony if the assignment was for a SecOps job :)
parthdesai 4 days ago|||
at the very least, run it inside a docker container (making sure of network and volumes i would say)
podocarp 4 days ago||
Hindsight is 20/20. Although why aren't assignments just a pdf
kleiba2 4 days ago||
"This code has multiple faults. Your task is to find and fix them all."
alostpuppy 4 days ago||
This is what I was trying to figure out. Did they think it was for an internal role or something?
cwnyth 4 days ago||
Some people just make really dumb decisions.
lesuorac 4 days ago||
Like giving people direct access to $6.3 billion?
jstanley 4 days ago|||
It was rather indirect access.
cwnyth 3 days ago|||
Multiple people, multiple dumb decisions.
vconnor 3 days ago||
How love how in face of such sophistication and planning from the North Korean hackers, most of the comments are along the lines of “so dumb, I would never have fallen for it.”

Somehow I really doubt it.

aleksandrm 4 days ago||
How do these dumb people that have access to billions of funds fall to these fake interviews?
philipwhiuk 4 days ago|
You don't know how deep the rabbit hole goes. Maybe the interviewer thinks they are hiring for a real job.
BigTTYGothGF 4 days ago|
Good thing they didn't get anything important.
More comments...