alt Hacker NewsNorth Korean fake job interview led to $6.3B Binance heist
Comments
Doing ANYTHING on a work issued laptop outside of your role is such a dumb idea for a litany of obvious reasons that I'm genuinely shocked people do it. Let alone participate in interviews for other companies on it.
Pretty funny that tech makes candidates jump through all sorts of automated, inhumane loops to even advance to talking to a real human in the hiring process.
And now you get results like this.
I was #opentowork on LinkedIn and got approached multiple times with fake companies and interviews. LinkedIn is not doing enough to combat this.
I even create a 1 man company for my consulting services and I receive ads about how people at my company saved me a spot on an online game.
LinkedIn is partially responsible for their neglect here.
No one wants to talk about the "internal AI Tool" being used to elevate to not 1 but 2 DevOps engineers?
> use of an internal AI tool as a springboard. The attacker leveraged the compromised computer of engineer B and used an internal AI tool to gain control over the Wallet DevOps Engineer A and another Wallet Software Engineer C. The attacker soon discovered Wallet DevOps Engineer A had a container deployment permission token on his computer.
With the AI craze going on recently I've worked at multiple companies where an internal AI tool was vibecoded and I've always been worried about the security implications.
It is crazy that this Engineer A fell for this malware ad (how do people still fall for these & how does Google still get away with serving malware like that):
https://isc.sans.edu/diary/32942
It is kind of weird that they mention it though, if they replaced the devices and rotated credentials? Just to later mention that an "internal AI tool" was used to steal that Engineer As credentials again?
And also, what are those "obfuscation techniques"? It looks very straight forward, replacing the pyenv, there's nothing much obfuscated in it? Except for putting it in a different folder.
Someone tried to hack my computer with a fake job interview once. I believe it was a real person because there wasn't much latency.
They tried to get me to git clone a repo, presumably to get me to install malicious npm dependencies.
I refused, then they wanted me to download Claude Code but I told them I already had Claude Code harness installed on my machine... But they said I should install a different version of it; they sent me a link... The landing page was the same kind of design as Anthropic uses but I didn't recognise the URL. I stopped the interview right there.
I actually got contacted by North Koreans posing as Japanese VC looking to partner in the Nordics. I have an agent that scans my emails and does the inverse filtering, suggests when I should take a look. This is because I get insane amount of cold inbound. But it also flags suspicious emails and uses network tools to find out info about the sender. It flagged that one as a NK account (I later confirmed it was already flagged on the watch list in various reddit channels). Everyone should be arming themselves with email filtering agents now. What I’m worried about is grandmas and grandpas and general ppl that are behind the tech curve.
Anec-data - as an interviewer, last year, I had my first sketchy, perhaps 'North Korean', candidate.
The name on the CV, was, for the sake of privacy, Michael Smith, from Australia, and ticked the right boxes.
We'd expect a fluent, Aussie-accented English speaker. Instead, we had a candidate with a webcam that wouldn't work (weird!!), with clearly accented English of a East-Asian background. I suppose there's a vanishing chance they really were Mike Smith of Adelaide or wherever, but we couldn't take that chance. We tried rescheduling, but tumbleweeds...
How did this get pumped by a brand new account so quickly, when there were already multiple submissions?
https://news.ycombinator.com/item?id=50353818 https://news.ycombinator.com/item?id=50357080
These North Koreans are crafty… even getting US citizens to host laptop farms in their house for remote working.
https://www.justice.gov/opa/pr/arizona-woman-sentenced-17m-i...
This article tells me that even if there were no north korean hackers, an engineer within the company had access to move billions of dollars in funds.
That is a huge red flag, and reflects on binance internal security. I would be wary of dealing with this company,
I like that the article referred to the hackers as miscreants. I don't see that word used very often. "Then, on October 20, the miscreants used the compromised computer and an internal AI tool to gain access to the computers of wallet DevOps engineer A and another wallet software developer, Engineer C."
The way I read the Binance post[0] is that the first mistake was "Engineer A from Wallet DevOps" clicking on a malicious Google ad[1]. If Google didn't provide that attack vector, maybe this wouldn't have happened that time.
[0] https://www.binance.com/en/blog/community/322915344375956676...
No single person, especially an engineer, should have the ability to transfer funds. That's nuts and it says a lot about the security posture of that company.
Imagine being able to steal billions in crypto from your work laptop and using same laptop to run code sent to you by another company. I wish I had their problems.
“shared a social media account with him, including personal photos and videos posted on the platform, in order to build trust" -- I wonder if these were real photos and videos, or AI fakes. It's crazy how many fake profiles Instagram pushes into my feed lately, and how many people probably don't even realize they're fake.
> Binance’s endpoint security tools did not immediately detect the malware.
Yes of course they didn't. The whole "endpoint security" industry is a scam. They're attempting to (or attempting to appear to) solve an impossible problem. All they do is install spyware and backdoors, reducing security rather than enhancing it.
Why did the employee have direct access to $6.3 billion in customer funds?
I'm just a simple programmer from the Santa Cruz Mountains but how is it possible to withdraw that much money without scrutiny? I mean if I go to my bank and want to my hypothetical millions in cash they'll say "It'll take us awhile to collect that much cash and meanwhile the government requires us to ask you a few questions about what you're doing..."
I have been getting these since early 2023, still, most of them are simple to spot, the other side typically has video turned off, asks a bit about your experience and just nods without digging, they are in a hurry to send you their coding challenge.
In one of these many calls I got to see the face from the other side but lasted a few seconds only. Then he claimed that internet was bad and suggested we continued without video.
In this case they claim it was a 2 rounds interview with video turned on to simulate a more normal recruiting process.
Of course all of us are prone to get caught with the shield off but what surprises me is that the targeted dev took the challenge in the device from work.
Source posted earlier: "29 October Binance Security Incident: Initial Findings and Response Update" https://news.ycombinator.com/item?id=50359377
Just want to highlight I came across one of these fake interviews last year and it unnerved me how close they came to succeed. I thought alot of about it and I realised they must have planned and been "coached" by a frontier LLM on how to go about social engineering me. This was a year ago! I can only shudder at their abilities now. It didnt work, but it was the closest attempt I'd ever witnessed.
Dont trust anything anymore.
It's getting really confusing with these online job offers, including interviews and assignments. Various people are pretending to be recruiters. I've basically stopped answering phone calls, and everything goes to voicemail unless the caller is in my contacts. But that is hard to do if you are looking for a job. Honestly, if you are the target of this type of campaign, as described in this article, there is probably a good chance you will get compromised, even if you are normally careful.
Running interview assignment on a work computer… tsk tsk
Crack down on fake job postings. It might not have stopped this attack, but it would have made it a lot harder for it to hide among all the terrible postings desperate people spray-and-pray at because they wouldn't exist because they'd be illegal.
Two factor authentication?
Binance bugs us all the time to confirm everything before making a $5 payment. Why don't they enforce higher security steps in their own wallets? Also, how can AI access Google Authenticator?
Further evidence that 1) recruiting is broken and 2) developers make great targets, and we need to respond accordingly.
The practice of installing software during a job interview should be forbidden by law.
Some companies require you to install Windows remote administration tools (basically root kits) on your machine to check whether you are using search engines or AI. It is insane.
Yeah, lots of good conversation on steps to take. One thing I never see mentioned is who should review and test them. Especially for a financial company, it seems they have no IT compliance/audit functions. Even at many big companies it seems IT control creation, maintenance, and testing is largely ignored or just put onto the people implementing and performing the control - a huge conflict of interest. Control analyst posting are something like 1 to 10K when measured against dev postings. Really telling when it comes to what companies actually care about...
It's just a cherry on top of the existing hiring process in the IT. It wouldn't surprised that it will make things even worse - companies will be more scared to talk to anyone and good candidates will be scared to reply
I suspect we'll look back on "Nork" as a derogatory racial term that didn't need to be used here. Just call them the attackers, or by their group name, or whatever.
Obligatory and should be obvious: a threat model that allows a single compromised laptop to result in a $6.3B loss is fundamentally flawed. Analyze the specific way that the laptop was compromised all you want, the fault here is entirely with the Binance security culture that allows such a gaping hole to exist in the first place.
I hope that Binance understands this and spends less time worrying about how the laptop was compromised and more time securing their systems under the very basic assumption that laptops will be compromised.
Recently, I was designing a technical test for a candidate and I thought about putting some prompt injection to try to see if the candidate used an agent and be part of a cybersecurity tests. I didn't do it because it felt unethical, but turns out you don't even need the prompt injection part.
How do these dumb people that have access to billions of funds fall to these fake interviews?
People are talk about all the security aspects of this which are all valid. But what I saw here is that Binance is running a sweatshop here. So even someone holding secret for billions is actively looking for potential role from a Noname company.
But did he pass the interview? I bet he got at least one Leetcode question.
Good thing they didn't get anything important.
These are simply malicious interviews, not fake. If your company is important enough, you've got one or two inside already.
I think we have reached peak whatever we're in. I think from here on out, things are gonna change.
Wow Binance and the workers really got done here like rookies, my goodness.
How is that much money not in a cold (offline) wallet?
This is the same approach as for the 2022 Axie Infinity hack
What surprises me most about the Binance hacking story is that Binance employees seem to have used their work laptops for some "programming test" (whose purpose was - as we now know - spreading malware).
I mean: if you even consider leaving your current company, you better leave no traces of your plan on your work laptop: you either use a private laptop or, even better, some burner laptop/computer that you reset afterwards.
So it ended up being the human flaw, once more.
Where do these people find jobs so secure that they wouldn’t bat an eye at interviewing for another job in a context where their current employer can watch them do so?
Even if you don’t understand the security concerns of running some 3rd party’s scripts on a work device, more pedestrian situational awareness should have prevented such a wild misjudgment?
Am I the only one baffled by the fact that the engineer uses a work PC for a personal job interview assignment?
A lot of people are focusing on how irresponsible the engineer was about using the work computer. That's obviously an issue but the bigger failure mode to me is the Engineer C's container deployment token.
That's a huge red-flag. In a company of this size, the deployments should be via CI only. CI isn't just to increase the speed and reliability of deployments but also to provide a clean room to build the software! Even if it's a token that was copied and pasted temporarily, the systems in place should not have to require this type of 1. copy 2. paste 3. remember-to-delete the token from my PC.
Also, Binance should be paying for intrusion testing. Better to pay a trusted company to do this kind of thing instead of letting North Korea show you how it's done. I don't think this exact exploit path would have been found but I bet the intrusion testing would have figured out another way to use Engineer C's token.