Fake recruiter lured aerospace employee with trojanized coding challenge

https://www.theverge.com/22648265/apple-employee-privacy-icl...

Smarter decision is for the corp to just buy your device for you. Then it's a personal device, and at least in some cases I'm aware of, not a government record at least.

Very doable for a phone where your "work" is limited to messages, webmail and calls.

Some people only know how to code within the environment managed by their corporation. This is increasingly the case with folks that have only worked at Kubernetes shops.

Some particular quirk of autocompletion could become almost pure muscle memory, and if it's suddenly missing, you notice.

They already have working software development environments. It's a process that can be time-consuming and is done once in a blue moon (basically when you need to reimage the machine). In the meantime, all changes to your software dev environment are gradual, and your work-provided computer ends up being configured like a software development pet instead of cattle.

Moreso if your company adopted/enforces internal development tools.

Ask yourself this: how many times have you went through a complete OS reinstall and subsequently had to setup a working software dev environment? Is this something you have automated? Most people do not.

I guess this is because in college and my first few dev jobs used Macs. A nice side effect is my wife hasn’t had any tech support complaints since we switched, it has been great.

I’d still never use company hardware for personal stuff. I don’t even login to Spotify on the company laptop.

When you get a personal computer you do not need to set up all the things you need to do your work immediately, so you will do the setup of things as you need them.

thus if you get a new personal computer it might not be fully setup yet.

If you are of the age that you have kids you may not have time to do any sorts of personal projects, if so and you have an old personal computer it may not be up to date with what is needed for the coding project because you have not been doing a lot of stuff.

If you have kids or other problems your personal computer may end up broken or unusable and you might not have the money at the moment or the reason to buy a new one.

I expect there is a similar, but worse, problem growing with CoPilot and friends.

From my experience, onboarding at companies is a painful process due to internal software, specific setups for complex build processes and (frequently) permissions / annoying processes required for downloading and installing things. Those points are not applicable if you are using publicly available and well documented tools on your own machine.

It’s surprising how often this is ignored.

First, this is a coding challenge that the candidate is given before the technical interview that is well defined in the expectations and is small in scope. They are not expected to spend more than an hour or two on it and they send the recruiter (who is an internal recruiter) a link to their github repo with their completed project before the technical interview is even scheduled. Candidates would have several days and potentially even a week between when they finished the project and when we have the technical interview. The candidates are also told that their project will be gone over in the technical part of the interview. I understand that there are circumstances that would prevent the individual from getting an environment set up on a personal computer but if that is case then just stick with using the work computer.

Second, I never even indicated if the individual was hired or not but you made the assumption that we passed on the candidate. The fact that the candidate couldn't get the repl started was just a tidbit that stuck out to me and I made the comment to my coworker as it is odd to me that a candidate would use their work computer for a job search. We just went with the fact we couldn't use a repl and had the candidate just talk out loud with what he would change when we added different scenarios/requirements.

For what it's worth, the candidate was using a Mac for their personal laptop and so all they would have had to do is run the following in their terminal and it would have gotten them pretty close to being able to run the repl

brew install clojure/tools/clojure

I’m talking about a take home code challenge. It’s unreasonable to have someone to record a video that could last an hour or more. And I’m not gonna sit and watch that.

Disclaimer: layman's opinion, I only know what internet knows.

It's definitely much slower than the private sector, but if the agencies decide they have a use case, they'll throw money at it until it works in house.

Yep, two different companies flying you out just to hack your shit. It's probably nothing. It makes me curious what you work with. Do you maintain commonly used open source software?

And that your mail client saw a new IP and treated it as a new session? I think assuming you were hacked based on this is paranoid.

> To proceed… with hacking?

Or maybe, they didn't have a laptop for you to use (which is stupid, don't get me wrong) so they couldn't do the next stage unless you had a device. Given you had to use it for the first step, it doesn't seem unlikely.

If they wanted to "hack" you, they didn't need to fly you out, they just needed you to clone the repo and run the script.

Can it be bypassed? Yes.

Are the researchers whose entire company hinges on the correctness of their analysis doing their absolute best to attribute the attack to a threat actor? Yes.

So to your point, somebody could indeed reuse malware or attempt to replicate it. However, the researchers are likely analyzing the disassembly and bytecode, and replicating complex malware to perfectly imitate a known family of malware is exceptionally difficult and statistically very unlikely. This is how threat intel is able to make any sort of claim of attribution.