by 2bluesc on 5/1/25, 2:53 PM with 290 comments
by donnachangstein on 5/1/25, 3:24 PM
On the surface it seems the "security" industry is lacking in the most basic of security processes when hiring.
I don't think I've ever worked anywhere that could accidentally hire a North Korean without uncovering it somewhere in the hiring process, and all my jobs have been especially uninteresting.
What bothers me more is there are talented people sitting on unemployment right now that can't find a job, yet fake people are getting hired left and right. Something in the industry as a whole is quite broken.
by Multiplayer on 5/1/25, 3:28 PM
I've been duped simply by hiring a great engineering candidate who then farmed out the actual work to remote workers in Pakistan and India. We caught on fairly quickly thanks to one of them forgetting to login to one of our backend systems via vpn a few times. No idea how many companies he was "working for" but I'd bet we were one of many.
Remote work has amazing upsides and tremendous security implications.
by stavros on 5/1/25, 3:27 PM
> our Red Team launched an investigation using Open-Source Intelligence gathering (OSINT) methods.
basically mean "some guys in the company googled him"?
by orbital-decay on 5/1/25, 4:11 PM
> Their resume was linked to a GitHub profile containing an email address exposed in a past data breach.
How is it an indicator of anything? Any actively used e-mail address that is older than a few years will be listed on haveibeenpwned.
by noitpmeder on 5/1/25, 3:47 PM
Before this interview, industry partners had tipped us off that North Korean hackers were actively applying for jobs at crypto companies.
We received a list of email addresses linked to the hacker group, and one of them matched the email the candidate used to apply to Kraken.
This single red flag should invalidate the candidate immediately, end of story.
by codecraze on 5/1/25, 6:08 PM
And at one point i was getting a lot of candidates with european names, no picture, good resume.
And when I met them over a call it was very strange: they were all asian(with really typical nordic names), they were like clones in the way they talked and answered questions exactly the same. They also claimed to be from Sweeden/Finland/Norway for most of them but yet they had a strong asian accent. Not nordic at all.
This was really fishy and since the fit wasn’t there I stopped the interview without thinking about it too much. but the more I think about it, the more i tend to lean on North Corean candidates.
by anonymousiam on 5/1/25, 4:09 PM
“Don’t trust, verify. This core crypto principle is more relevant than ever in the digital age. State-sponsored attacks aren’t just a crypto, or U.S. corporate, issue – they’re a global threat. Any individual or business handling value is a target, and resilience starts with operationally preparing to withstand these types of attacks.”
It's funny to see the CSO of a crypto firm say this. It's the opposite of the whole way crypto works. In crypto, the transaction is processed (trusted) if all the credentials and keys are correct, regardless of who's behind it.
by Dachande663 on 5/1/25, 3:23 PM
by ianhawes on 5/1/25, 4:26 PM
by rvz on 5/1/25, 3:11 PM
Now made even easier for fraudsters and including state actors thanks to Generative AI. Also:
> Generative AI is making deception easier, but isn’t foolproof. Attackers can trick parts of the hiring process, like a technical assessment, but genuine candidates will usually pass real-time, unprompted verification tests.
This is why Leetcode / Hackerrank and other (online assessments) OA in the technical interview is unfit for use in the age of AI.
> In the modern era, it’s an organizational mindset.
Security is a way of life for this company, but it would have easily fooled a less security-oriented company and it will just only get worse.
by rs186 on 5/1/25, 4:02 PM
I don't know, if I run into these questions in a job interview, especially with a small, less known company, I would be having serious questions about what this company is doing
by TheGCMadeMeDoIt on 5/1/25, 3:41 PM
They already knew the candidate's name, email, and GitHub were all part of past beaches. I could understand if they were fishing for more information to contribute to a shared list, but it seems like they knew virtually everything they needed to know.
Asking the candidate to justify the inconsistencies outright would've been just as helpful as the final interview IMO.
Is there something I'm missing there?
by iJohnDoe on 5/1/25, 4:18 PM
What happened to standard procedures? 1. Phone interview. 2. Video interview. 3. In-person interview. 4. Job offer and hired. Heck, even standard was 1. Phone interview. 2. In-person interview. 3. Job offer and hired.
> From the outset, something felt off about this candidate. During their initial call with our recruiter, they joined under a different name from the one on their resume...
by ThinkBeat on 5/1/25, 3:43 PM
Then they had a candidate who was trying to cheat the systemeat
How did they establish and verify that the candidate was North Korean? Are North Koreans the only ones who try to remote work byt lying about their whereabouts?
Not at all.
If you live in a country outside of the US and you see the money software poeple make in the US it is mighty tempting to land a gig.
The fact that the persdon made simple mistakes and needed to be coached does not sound like a North Korean state operation.
If someone had told them Russian hackers are trying to get jbos.
Would they have asummed the person was Russian?
by mystraline on 5/1/25, 3:34 PM
Whereas, I've been looking for quite a while, with very few bites. And nobody so far on HN Who's hiring responds, except for a place that seems to want 60h/week and pay for 40h/week.
Being genuine and truthful in the age of generative AI, LLMs, quiet quitting, /r/overemployed (on the sly working multiple 40h week jobs).... Being honest in this environment seems to be a losing endeavor.
by ninjazee124 on 5/1/25, 3:50 PM
by danielvf on 5/1/25, 3:45 PM
In the past, they just tried to break into bank computers, then into crypto company's computers. For the last two years, they've been working on getting people into crypto companies.
But now they appear to have enough people to spare than they also have groups working on "honest" employment as remote workers, who may not even have theft as the first thing on their mind.
Here's a federal case where a US woman was convicted of helping North Korea steal the identities of 70 people, and then remote in as them, to do remote work:
https://www.justice.gov/usao-dc/pr/arizona-woman-pleads-guil...
by fracus on 5/1/25, 6:46 PM
The article could have been this short.
This article also helps the Korean hackers by providing in depth commentary on how they were caught and how to improve.
by stackedinserter on 5/1/25, 4:07 PM
Actually, that's a job for counter-intelligence agencies (NSA? RCMP?), but I guess they will just laugh you call them.
by abhisek on 5/1/25, 5:07 PM
If its not insider access then might as well hack an OSS maintainer and publish malicious open source package that everyone depends on to reach your target organization.
by aussieguy1234 on 5/1/25, 4:18 PM
Use this to your advantage during the interview process to weed them out: https://news.ycombinator.com/item?id=43853382
by lmeyerov on 5/1/25, 4:13 PM
- online history was sparse and somewhat mismatching, and weird profile image reuse
- unexpectedly strong accent in calls, does not show video
- background reference checks a mess
by wslh on 5/1/25, 4:35 PM
If I were able to predict the future I would say that soon GitHub, GitLab and others will release inproved security sensors.
by s-mon on 5/1/25, 4:08 PM
by iagooar on 5/1/25, 7:41 PM
Sounds like you had to really push the boundaries of what is humanly possible to uncover this one.
by eunos on 5/1/25, 5:15 PM
How can Kraken found this out based only on Videocall?
by ecocentrik on 5/1/25, 4:08 PM
by sltr on 5/1/25, 3:35 PM
by nikcub on 5/1/25, 5:23 PM
by Jcampuzano2 on 5/1/25, 3:30 PM
I'm sure this wasn't a case of the most advanced/sophisticated attempt from North Korea and other bad actors, and probably just a case of them casting a wide net. But regardless based off of this writeup and the video shown dude should have never been given the time of day.
by g42gregory on 5/1/25, 7:02 PM
On a serious note, as a Kraken customer, I am very happy that they take security issues seriously. Reassuring.
by yieldcrv on 5/1/25, 3:54 PM
this is a tongue in cheek test in crypto circles for like a year now
by Geee on 5/1/25, 4:30 PM
by crorella on 5/1/25, 5:46 PM
by aryan14 on 5/1/25, 9:08 PM
by koliber on 5/1/25, 4:50 PM
https://koliber.com/articles/how-to-avoid-hiring-a-north-kor...
by Aloisius on 5/1/25, 6:38 PM
At a previous remote job for a financial institution, they required a full background check with fingerprinting, reference checking, past employment verification, drug testing and in-person verification of identity and employment authorization. This was done for everyone, not just people they found "suspicious."
Frankly, the laws against applicant discrimination also makes having different processes or demanding different information from candidates because of national origin/ancestry/accent/etc. legally questionable.
by Havoc on 5/1/25, 4:02 PM
by paradite on 5/1/25, 3:45 PM
by dabber21 on 5/1/25, 3:37 PM
by tke248 on 5/1/25, 8:42 PM
by sjs382 on 5/1/25, 8:35 PM
> Before this interview, industry partners had tipped us off that North Korean hackers were actively applying for jobs at crypto companies. We received a list of email addresses linked to the hacker group, and one of them matched the email the candidate used to apply to Kraken.
Unless you were working in conjunction with law enforcement (with some guarantee re: the security of customer assets), it should have ended there. Going further may have piqued your interest, but...
> Instead of tipping off the applicant, our security and recruitment teams strategically advanced them through our rigorous recruitment process – not to hire, but to study their approach.
... you likely gave them more actionable data than they gave you.
This behavior was reckless, amateurish and I'd be pulling out my assets right away if someone acting as a custodian to my finances acted like this.
by lawgimenez on 5/1/25, 4:52 PM
by ForOldHack on 5/1/25, 6:31 PM
by tough on 5/1/25, 5:31 PM
by wnevets on 5/1/25, 3:35 PM
by wakeywakeywakey on 5/1/25, 3:41 PM
by joejoo on 5/1/25, 3:50 PM
by notlive on 5/1/25, 3:42 PM
by seasluggy on 5/1/25, 4:56 PM
So basic HR processes?
by babuloseo on 5/1/25, 3:47 PM
by tsukikage on 5/1/25, 4:40 PM