What people said 24 voices · best of 35 · verbatim

• G

  A lot of people are focusing on how irresponsible the engineer was about using the work computer. That's obviously an issue but the bigger failure mode to me is the Engineer C's container deployment token.That's a huge red-flag. In a company of this size, the deployments should be via CI only. CI isn't just to increase the speed and reliability of…

  gandreaniHacker News3d agoview on Hacker News ↗
• J

  RE: https:// mastodon.social/@arstechnica/1 17559032067718623 (Not dinging Ars here! I love Ars.) Let me fix that for you: “Binance admits that a series of security lapses over a period of at least months led to the theft of billions (when measured as alleged value in units of real money) in crypto.”

  jon_alper@mastodon.onlineMastodon3d agoview on Mastodon ↗
• S

  It is crazy that this Engineer A fell for this malware ad (how do people still fall for these & how does Google still get away with serving malware like that):https://isc.sans.edu/diary/32942It is kind of weird that they mention it though, if they replaced the devices and rotated credentials? Just to later mention that an "internal AI tool" was…

  sva_Hacker News3d agoview on Hacker News ↗
• C

  No one wants to talk about the "internal AI Tool" being used to elevate to not 1 but 2 DevOps engineers?> use of an internal AI tool as a springboard. The attacker leveraged the compromised computer of engineer B and used an internal AI tool to gain control over the Wallet DevOps Engineer A and another Wallet Software Engineer C. The attacker soon…

  cwiggsHacker News3d agoview on Hacker News ↗
• A

  I actually got contacted by North Koreans posing as Japanese VC looking to partner in the Nordics. I have an agent that scans my emails and does the inverse filtering, suggests when I should take a look. This is because I get insane amount of cold inbound. But it also flags suspicious emails and uses network tools to find out info about the…

  armcatHacker News3d agoview on Hacker News ↗
• B

  The way I read the Binance post[0] is that the first mistake was "Engineer A from Wallet DevOps" clicking on a malicious Google ad[1]. If Google didn't provide that attack vector, maybe this wouldn't have happened that time.[0]

  barbazooHacker News3d agoview on Hacker News ↗
• D

  Anec-data - as an interviewer, last year, I had my first sketchy, perhaps 'North Korean', candidate.The name on the CV, was, for the sake of privacy, Michael Smith, from Australia, and ticked the right boxes.We'd expect a fluent, Aussie-accented English speaker. Instead, we had a candidate with a webcam that wouldn't work (weird!!), with clearly…

  DrBazzaHacker News3d agoview on Hacker News ↗
• S

  Someone tried to hack my computer with a fake job interview once. I believe it was a real person because there wasn't much latency.They tried to get me to git clone a repo, presumably to get me to install malicious npm dependencies.I refused, then they wanted me to download Claude Code but I told them I already had Claude Code harness installed on…

  socketclusterHacker News3d agoview on Hacker News ↗
• S

  So, North Korea is involved in hits not unlike some Russians do. But at the same time it may provide a cover for other state actors. May be unlikely in this case (I think the pattern here is making it indeed most likely that North Korea is responsible, it just fits so much; for similar reasons, it was very clear that Marsalek worked for the FSB…

  shevy-javaHacker News3d agoview on Hacker News ↗
• B

  > Even if it's a token that was copied and pasted temporarily, the systems in place should not have to require this type of 1. copy 2. paste 3. remember-to-delete the token from my PC.One of the first things I did in my last job was shift processes like this off my team's computers, aside from the security ramifications all it takes is one dumb…

  benoauHacker News3d agoview on Hacker News ↗
• Y

  The article says that a software engineer interviewed with the North Koreans and the NKs then gained access to engineer A's machine (which had the deployment token) and then finally pass that token to run on engineer C's machine (who apparently did deployments).That unlettered (npi) engineer who downloaded and ran the interview software on his or…

  yubblegumHacker News3d agoview on Hacker News ↗
• I

  Just want to highlight I came across one of these fake interviews last year and it unnerved me how close they came to succeed. I thought alot of about it and I realised they must have planned and been "coached" by a frontier LLM on how to go about social engineering me. This was a year ago! I can only shudder at their abilities now. It didnt work…

  ionwakeHacker News3d agoview on Hacker News ↗
• L

  I'm just a simple programmer from the Santa Cruz Mountains but how is it possible to withdraw that much money without scrutiny? I mean if I go to my bank and want to my hypothetical millions in cash they'll say "It'll take us awhile to collect that much cash and meanwhile the government requires us to ask you a few questions about what you're…

  labradorHacker News3d agoview on Hacker News ↗
• O

  How did this get pumped by a brand new account so quickly, when there were already multiple submissions?

  overcastHacker News3d agoview on Hacker News ↗
• S

  These North Koreans are crafty… even getting US citizens to host laptop farms in their house for remote working.

  slicktuxHacker News3d agoview on Hacker News ↗
• X

  I was #opentowork on LinkedIn and got approached multiple times with fake companies and interviews. LinkedIn is not doing enough to combat this.I even create a 1 man company for my consulting services and I receive ads about how people at my company saved me a spot on an online game.LinkedIn is partially responsible for their neglect here.

  xutopiaHacker News3d agoview on Hacker News ↗
• N

  Yes. The situation improves considerably if, when making server changes or retrieving data, programmers are required to enter a code generated from a hardware TOTP token isolated from both PCs and smartphones.Every service provider system should be designed with the assumption that programmers' PCs and smartphones may be compromised.

  Naru41Hacker News3d agoview on Hacker News ↗
• P

  “shared a social media account with him, including personal photos and videos posted on the platform, in order to build trust" -- I wonder if these were real photos and videos, or AI fakes. It's crazy how many fake profiles Instagram pushes into my feed lately, and how many people probably don't even realize they're fake.

  purplemantisHacker News3d agoview on Hacker News ↗
• K

  I like that the article referred to the hackers as miscreants. I don't see that word used very often. "Then, on October 20, the miscreants used the compromised computer and an internal AI tool to gain access to the computers of wallet DevOps engineer A and another wallet software developer, Engineer C."

  kyleblarsonHacker News3d agoview on Hacker News ↗
• 1

  The practice of installing software during a job interview should be forbidden by law.Some companies require you to install Windows remote administration tools (basically root kits) on your machine to check whether you are using search engines or AI. It is insane.

  129-1Hacker News3d agoview on Hacker News ↗
• 5

  Crack down on fake job postings. It might not have stopped this attack, but it would have made it a lot harder for it to hide among all the terrible postings desperate people spray-and-pray at because they wouldn't exist because they'd be illegal.

  59percentmoreHacker News3d agoview on Hacker News ↗
• R

  > Better to pay a trusted company to do this kind of thing instead of letting North Korea show you how it's done.but enterprises usually prefer the latter, I guess it's more convenient since it bypasses the bureaucratic processes?

  r_leeHacker News3d agoview on Hacker News ↗
• H

  Source posted earlier: "29 October Binance Security Incident: Initial Findings and Response Update"

  HelloUsernameHacker News3d agoview on Hacker News ↗
• H

  Binance is one big scam! They said they'd reimburse affected customers but I'm convinced they just took other customers crypto to fill those wallets. There's no way Binance could survive a $6 billion heist.

  hn_submitHacker News2d agoview on Hacker News ↗