Introduction
In today's IT job market, receiving an offer from a recruiter on LinkedIn is often seen as a blessing. However, what seems like a golden opportunity can quickly turn into a nightmare. With the rise of sophisticated phishing techniques, it's crucial to remain vigilant.
How Does It Begin?
Imagine receiving an enticing offer: part-time remote work, attractive hourly pay, and most importantly, a perfect match with your previous experience. This is exactly what happened to a friend. The recruiter, claiming to represent a well-known company, offers an accelerated interview process with a coding test sent via LinkedIn message.
Warning Signs
Before you engage, here are some red flags to watch out for:
- The recruiter is not officially affiliated with the company on LinkedIn.
- No initial "Get to know you" call before receiving the coding test.
- The test is in a different programming language than you are skilled in.
- The code is hosted on Bitbucket, which is rather uncommon.
- The sender's email address is a @gmail.com instead of an official company email.
A Closer Look: The Second Stage Loader
The coding test consists of a TypeScript project with 180 files. This mix of dead and functional code seems harmless but hides calls to external endpoints like https://api.jsonbin.io. This kind of trap is meant to lure developers into letting their guard down.
The function initPriceConfig starts by downloading additional packages to inspect your system. Once executed, it can:
- Use
require('child_process')to execute system commands. - Use
require('fs')to read the file system. - Use
require('net')/require('https')to open a data exfiltration channel. - Directly read environment variables like
MONGO_URI,JWT_SECRET, etc.
Precautions for Next Time
- Always verify the recruiter's identity: Research on LinkedIn and other social networks to confirm their affiliation.
- Thoroughly examine the test code: Look for odd behaviors or calls to external endpoints.
- Use a secure environment: Run the code in a virtual machine or isolated system.
What Now?
If you find yourself in a situation where your system has been compromised, it's essential to:
- Immediately change all passwords associated with your professional and personal accounts.
- Alert the impersonated company so they can take appropriate action.
- Secure your environment by conducting a full system scan.
Conclusion
The landscape of tech job interviews is fraught with traps. As a professional, it's your responsibility to stay vigilant and adopt secure practices to protect yourself and your data.
Let's discuss your project in 15 minutes.