We identified a North Korean hacker who tried to get a job

Maybe you’re contributing to the narrative with the posts like above. It’ll certainly drive engagement.

I'm sure there were a lot of false positives with that question.

If I was not reading HN and a few other sources I would likely hang up the phone too.

Thinking that it couldn't be a real job,... some phishing scam or hoax, asking ridiculous questions like that.

Depending on the job, it is quite likely the real talent would not be able to take the interview seriously after hearing suck a question.

Seriously weird times...

Ha if I got asked that during an interview, I'd think either I went to the wrong interview or the interview is a red flag.

If the employer is satisfied with the employees output, who is being harmed?

Is the issue skilled candidates that are misrepresenting where they live, unqualified candidates with fake resumes trying to land the position anyway, or something else?

What have you tried?

If they trip enough red flags and it's an international issue, you could just be up front that you're suspicious (including why) and ask them to go outside and take a video of themselves in front of wherever they live. Then you check it against street view, scrutinize the vegetation, that sort of thing. Require the rest of the interview process to be via video call with a wide view of the room to ensure it's the same person. That solution is respectful of their time since it's quick and easy for them. They also presumably already shared their address with you so it's not particularly invasive.

To me, what you call "red flags" rather looks like a description of often outstanding programmers who are quite privacy-conscious (think into the direction of "somewhat cypherpunky").

If you assist NK, then you’re hurting crypto but you’re funding NK operations (e.g. NK soldiers assisting Russia against Ukraine).

"As a [role,gender,national ] posting from [country, city]..

[I agree with parent] *2 sentences .

[Actual opinion\story to push]

[Reminder on connting nationality/location ] "Thats my two Eurocents on that, take it or leave it ."

Its hyper fake, formulaic responses topic tugboats, but people go and engage in good faith all the time .

Though we have been burned by someone we believe (but cannot prove) was 100% remote and working two jobs at the same time (they were laid off in a recent downsizing before we could get enough evidence, but they didn't seem as productive as we would expect). So I expect even if you apply for a 100% remote position you will need to do one round of interviews onsite. (though who knows if this will protect us)

Stuff can be forged but that needs local spy level of skills to make it work.

They were also hiring a company specialized in background checks, I literally had to fill up a form with the 14 places I had been living in all my life with dates of entry and exit, super annpying given the UI was slow as hell and that I had low recollection of addresses and date of my early years, I had to ask my parents. I may have been able to cheat probably but I didn't try.

I am also seeking a new position and I have realized that most b2b / work from anywhere jobs you could apply for were for cryptocurrencied / blockchain related companies so they surely make it easier for malicious remote applicants. I think it means they are kind of desperate / have difficulty to find talents. In other areas most companies only hire people who live in same juridiction they have an office and hr department.

You're dating yourself with that question. (yes, and they have been for a while)

Yeah, absolutely. The company I work for is in a different country, seeing anyone else would require flying over there, I interviewed and got the job without meeting anyone in person.

Yes, I got multiple job offers like that back in 2022 at FAANG and similar places, and a lot of my friends who interviewed recently had plenty of processes that were fully remote as well. The first time I’ve actually met someone irl from the company I signed my offer with was at least a month after I already started working, and it was just an optional lunch meetup.

However, afaik, these days most serious companies like big tech or tech-centric finance (JS/Citadel/Jump/etc.) or top AI places (OpenAI/Anthropic/etc.) would have the final rounds in-person.

However, there was a background check done by third party agency. Basic check: criminal record, education and employment history (is it fake or real).

So many roles are basically interchangeable and I’ll choose whichever one looks best on my resume or gives me some other tangible benefit. And I am prepared to bounce as soon as my vesting schedule drops. We all game this system too.

The days of us loyally working at any firm for 20 years, singing the corporate cheer songs and retiring with a pension are stuff of a different age.

I can't see how the fake-candidate epidemic blows the hiring process up in anything but a candidate-hostile direction.

With the open hiring market becoming more inefficient, companies will move more towards hiring through networking and vetted sources (select college job boards etc.) rather than the open market. In situations where they evaluate candidates from open market listings, companies will now have invasive proof-of-identity red tape earlier and earlier in the funnel (for example, background checks prior to application rather than offer in places where that's legal). Plus, look forward to overly clever hiring panels introducing annoying "trap" questions and weird hoops like this article alluded to - I hope you're ready to review local restaurants and pick up random stuff in the room during your interview!

Sure there is. Randomly sample N, filter down to M, go through preliminary interview stages. Depending on how many that leaves you with rinse and repeat.

The important thing here isn't fairness from the perspective of the applicant. It's a process that works reliably for the company and doesn't unfairly waste applicant's time.

If the very first stage (application plus resume) is no longer a reliable signal then accept that fact and rework the process to match.

just spitballing but even if someone has a remote computer after getting hired, and is onboarded they should not have access to sensitive systems. So while you can't completely prevent the possibility of hiring a malicious actor security should not simply be on/off. The register article mentioned how after these devs were hired they were immediately able to kick off their plans. I think security is not structured properly if that is the case.

Is the subcontracted work not good enough? Well, then the problem is that the work is not good enough.

Is the person not contributing in other ways that you want them to contribute because they have other jobs? (eg. chat conversations, meetings, team building, etc.) Well, then the problem is that they aren't making those contributions.

Or is it just that you're paying them more than you would have to pay the subcontractors if you found and managed them yourself? Well, then you are totally free to skip the middleman and do that yourself. But there is, actually, value in finding and managing freelance work. I certainly don't want to do that myself! If someone is good at doing that, and the quality of the work they are managing is acceptable to me, then it seems like they might be earning their paycheck?

I do get that the dishonesty element is bad in and of itself, but I honestly wonder whether, if this is a problem a firm is having, they should consider hiring the work out to subcontractors, without any subterfuge.

Saddens me a bit. I like to trust hires and give them pretty wide access to everything. For my own company, I've so far only hired people I worked with in the past, but when hiring strangers remotely, I'll probably have to rethink my trust-first model.

Sure I guess someone could physically turned up to an office to collect a laptop, be onboarded, get ID checked, then dial in to a few hours of meetings a week, muddle through any questions, rely on the team back at base helping, turn up in person to team get togethers every few months and manage to bluff their way through. It's not unprecedented - Frank Abagnale was running that type of con decades ago, Russia had the "Illegals" program of deep cover spies.

That's not exactly low cost.

But yes, that directive to interview local candidates over zoom does seem very silly.

To write code (even with the benefit of AI) effectively you need a mental model of the systems you work with, reading the chatGPT response doesn't prove you have that.

The poster included a sneer about “work”. This is about something else.

At the same time, you are correct that it doesn't matter who is typing it. One of my favorite setups I've worked under is where throwing it over the fence is explicit - where a small team of employees each has their own small team of contractors. The management doesn't care who does what, as long as the work gets done, so we were free to parcel work out to our contractors as we saw fit, and that the institutional knowledge stayed baked into our heads.

Of course if they hire me as opposed to that person in India directly there is likely a reason they wanted someone in the US. Often those reasons are legal and somewhere a law is being broken.

Are you really going to do this for all candidates that make it to the final round of interview?

Are you also going to compensate the time for the candidate if he doesn't get selected?

Unless what you're proposing is more a formality, and that unless the person doesn't show up he's guaranteed to get the job.

Besides, you cannot have it both ways: either North Korean hackers are a "50ct army" or they are a credible threat. Most seem to be arguing they are a credible threat.

Also, he can always take the second option: "why are you asking about this in a job interview?", something many legitimate Korean candidates could ask.

I find some people's attitude to NK hackers slightly schizophrenic: either they are a credible threat or they are amateurs. Which one is it?

> Dissing Kim is something that is not currently widely permitted in NK

This wouldn't be "widely", this would be a specific interaction with a hostile foreigner for the purpose of infiltrating them. It's not the same as being allowed to say this to fellow North Koreans.

> Not saying no one from NK never will, but so far almost everyone will immediately stop the conversation at this point.

Legitimate candidates would at this point too, so as a tactic this is useless.

    > Name 5 restaurants not on Google maps in the town you live in".