in your job interviews

Every time a developer participates in a job interview they must pass a technical testthe routine seems clear: demonstrate your programming skills and advance in the selection process. However, behind these common dynamics, there is a risk that many had not stopped to analyze: cyber attacks that take advantage of the context of these interviews with developers. to steal sensitive data.

Cybercriminals have perfected their techniques, using routine, seemingly legitimate personnel selection processes to deceive the most experts and access a bounty of data especially valuable.

Deception in the job offer. At this point, I believe that there is no one left who has not at some point received a call from InfoJobs, Indeed or any other supposed employment platform indicating that their resume had been chosen to fill a vacancy. Obviously, it’s a scam of which the platforms themselves they have disengaged.

This is what we could consider a “trawl fishing” in which the objective is to increase the possibilities of stealing data by increasing the database potential victims. However, the software developer David Dodda has alerted from your blog of a much more elaborate attack than the one he was about to be a victim of: a selective attack on computer experts camouflaged in the technical test of a job interview. As he tells it in the first person, “I was 30 seconds away from running malware on my machine.”

A semblance of normality. Dodda is a freelance programmer with several years of experience and received an unexpected offer on LinkedIn that offered him work part-time at a startup dedicated to software development. “It seemed legitimate. So I accepted the call,” said the developer. The company’s LinkedIn profile seemed legitimate, had previous publications, employees, recent activity and everything verifiable on the platform. The same was true with the person who had contacted him.

After scheduling the interview, his contact assigned him a technical test “to get ahead” before the interview. something routine for any developer, especially in processes where practical mastery is expected to be assessed before the interview with the recruiter. This apparent normality of the offer and the acceptance of the technical test reinforce the climate of trust, one of the most exploited elements in social engineering campaigns aimed at deceiving candidates.

Code hidden in plain sight. The technical material of the test also did not raise the developer’s suspicions. Before executing the code, he reviewed it in detail, correcting some defects in a test without major complications for an experienced programmer like him. However, just as he was about to run it, and almost out of professional habit, “I had one of those paranoid developer moments.” The expert decided to ask his AI Cursor assistant to review the code. The surprise was capital.

“Integrated between legitimate management functions, ready to run with full server privileges when accessing management routes,” is how the developer described the snippet. malware ready to run on your computer.

Free access to all your data. The first phase of the malware was designed to extract critical information: passwords, personal files, system credentials and access to cryptocurrency wallets.

But the scope of the attack went far beyond the victim’s personal data. According to a report From consulting firm Unit 42, developer teams host data from third-party servers and projects, which multiplies the value of the attack if the fraud is successful. In some cases analyzed, the malicious code used apparently legitimate code and Python backdoors, to ensure unrestricted remote access by the attacker.

Analysis of an attack on the elite. According what was published by Telefónica Tech, the main objective of these attacks is not to capture basic data from ordinary users, but rather to access high-value resources managed by active programmers. The deception is structured in several phases where elements such as urgency, psychological pressure and the trust generated in the selection process are exploited.

Technical tests, especially when required under time pressure, can lead candidates to skip security steps that they would normally execute in a more relaxed environment. This gives attackers a direct route to assets such as confidential documents, access to client servers and cryptocurrencies. According to the analyzes from Securonix, these methods have evolved since 2022 with targeted and persistent attacks on relevant targets in professional environments.

In Xataka | People couldn’t stop hacking virtual job interviews with AI. Solution: we want to meet you in person

Image | Unasplash (Joan Gamell)