We identified a North Korean hacker who tried to get a job

Last company that hired me did everything remotely. This was in a company that only hired people living in countries where it had offices and no b2b contract so there are a number of things that needed to be local: - local ID or work permit - physical address in the country - bank account in same country - social security number

Stuff can be forged but that needs local spy level of skills to make it work.

They were also hiring a company specialized in background checks, I literally had to fill up a form with the 14 places I had been living in all my life with dates of entry and exit, super annpying given the UI was slow as hell and that I had low recollection of addresses and date of my early years, I had to ask my parents. I may have been able to cheat probably but I didn't try.

I am also seeking a new position and I have realized that most b2b / work from anywhere jobs you could apply for were for cryptocurrencied / blockchain related companies so they surely make it easier for malicious remote applicants. I think it means they are kind of desperate / have difficulty to find talents. In other areas most companies only hire people who live in same juridiction they have an office and hr department.

Yes, my fully remote company has been hiring for the past 3 months, I've conducted at least 70 first-round interviews, and we hire without in-person meetings.

If your position is remote, and the coat of every in person interview includes two way flights, per diem and a hotel room, it's very tempting to skip the in person step, especially if you expect to fail a lot of in person candidates. Imagine paying that much when your interview to offer rate is 25%, and offer to hire is 50%. That $8k $10k extra per hire, on top of the normal cost of the funnel

I did not get hired without in-person interview, but a number of my team members (certainly people I interviewed and recommended for hire) did.

10 years ago all interviews were in person. With the pandemic they all went 100% remote. We proved that 100% remote positions can work and so there is temptation to continue doing 100% remote interviews for people that will be working remote anyway.

Though we have been burned by someone we believe (but cannot prove) was 100% remote and working two jobs at the same time (they were laid off in a recent downsizing before we could get enough evidence, but they didn't seem as productive as we would expect). So I expect even if you apply for a 100% remote position you will need to do one round of interviews onsite. (though who knows if this will protect us)

Yes, I am in a hybrid role, went through 5 interviews and several more check-ins, and the first time anyone saw me in person was on the first day when I picked up my laptop at the local office (which wasn't even required, I had the option of having it shipped at my home address)

All interview processes I've went through have indeed been 100% remote. When considering this, you should keep in mind the amount of developers that aren't earning top 1% incomes or being offered stock in companies. Things are probably a lot more casual than you may be used to.

Do you want the industry to go back to only hiring from the top ~20 schools and by word-of-mouth networking? Coz that's the only viable alternative to the current interview process.

If you think this is going to lead to better treatment of candidates in the industry then i got really bad news for you

Hate to say it but jobs are commodities for the employee too. Why would it be any different the other way around?

So many roles are basically interchangeable and I’ll choose whichever one looks best on my resume or gives me some other tangible benefit. And I am prepared to bounce as soon as my vesting schedule drops. We all game this system too.

The days of us loyally working at any firm for 20 years, singing the corporate cheer songs and retiring with a pension are stuff of a different age.

> My favorite interview question, because we've interviewed quite a few of these folks, is something to the effect of 'How fat is Kim Jong Un?' They terminate the call instantly

I'm sure there were a lot of false positives with that question.

If I was not reading HN and a few other sources I would likely hang up the phone too.

Thinking that it couldn't be a real job,... some phishing scam or hoax, asking ridiculous questions like that.

Depending on the job, it is quite likely the real talent would not be able to take the interview seriously after hearing suck a question.

Seriously weird times...

> How fat is Kim Jong Un

Ha if I got asked that during an interview, I'd think either I went to the wrong interview or the interview is a red flag.

Hired left and right != interviewed left and right != interviewed quite a few at Crowdstrike.

Maybe you’re contributing to the narrative with the posts like above. It’ll certainly drive engagement.

Don't you have to ask for ID at the end anyway? So the only question is avoiding behavior that makes it look like you're a fake job listing harvesting PII or something.

Is the issue skilled candidates that are misrepresenting where they live, unqualified candidates with fake resumes trying to land the position anyway, or something else?

What have you tried?

If they trip enough red flags and it's an international issue, you could just be up front that you're suspicious (including why) and ask them to go outside and take a video of themselves in front of wherever they live. Then you check it against street view, scrutinize the vegetation, that sort of thing. Require the rest of the interview process to be via video call with a wide view of the room to ensure it's the same person. That solution is respectful of their time since it's quick and easy for them. They also presumably already shared their address with you so it's not particularly invasive.

> We post a role, get 500 applicants, and nearly all of them are not legitimate. They all look amazing, really great resume, impressive LinkedIn, etc... but when you dig a little deeper, it's not that hard to find a bunch of red flags (LinkedIn profile create < 3 months ago, VOIP number, using VPN to submit job application, etc). You really have to know what signs to look for. They're very convincing fakes.

To me, what you call "red flags" rather looks like a description of often outstanding programmers who are quite privacy-conscious (think into the direction of "somewhat cypherpunky").

Thank you for posting this. It definitely gives a lot of perspective about what is going on right now.

maybe leave the photo id ask for when there's suspicion only is fine

I’ve also seen some claim that they will do that and simply sub-contract the work out to cheaper labor

If the employer is satisfied with the employees output, who is being harmed?

I mean you see that here on HN right? People claiming that any arbitrary question is something they have no idea about, like the color of their front door.

“These people (crypto industry) are bad people so it is justified to ignore the rule of law when hurting them” is a classic bad take. What you can do is regulate crypto into oblivion and make people feel bad about working in crypto.

If you assist NK, then you’re hurting crypto but you’re funding NK operations (e.g. NK soldiers assisting Russia against Ukraine).

Beyond just the salary, once they have access to the corporate network they can execute other attacks to steal from company accounts and infiltrate connected business partners. Most organizations still have very weak protection against insider threats.

I have worked in places where this would work...all terrible places that usually had someone with a "maverick" view of how organizations worked derived from reading Warhammer books or something.

I can think of a few reasons, most obviously that it's a security nightmare - you've got a non-employee accessing and modifying your company's code and possibly having access to customer data. Some shops might not care about this, but it's ridiculously irresponsible in principle.

Because job interviews don't test real-world programming skills, which is a whole other issue.

I think the best interview question, and really the only one you need to determine technical ability is ask someone to describe a http request in as much detail as possible.

To write code (even with the benefit of AI) effectively you need a mental model of the systems you work with, reading the chatGPT response doesn't prove you have that.

The advantage of a larger pool of candidates is not mostly a financial benefit, IMO. The benefit is mostly the ability to hire from a larger pool of people especially with a specialized skillset, and also to have less of an echo chamber.

But yes, that directive to interview local candidates over zoom does seem very silly.

Only a) is valid, as you can fly candidates for interviews and have them go back to their home city to work remotely.

Nothing I guess? Except that they will continue to be vetted after being hired for the quality of their work.

just spitballing but even if someone has a remote computer after getting hired, and is onboarded they should not have access to sensitive systems. So while you can't completely prevent the possibility of hiring a malicious actor security should not simply be on/off. The register article mentioned how after these devs were hired they were immediately able to kick off their plans. I think security is not structured properly if that is the case.

It's hard. I mentioned in another comment I had a work colleague in 2006 who farmed out all his work. He was capable of doing the job, but it was simply more enjoyable for him to play video games all day while someone else did the work for 25% of his salary.

The thing I'm always curious about with this is: What is the actual bad thing happening here?

Is the subcontracted work not good enough? Well, then the problem is that the work is not good enough.

Is the person not contributing in other ways that you want them to contribute because they have other jobs? (eg. chat conversations, meetings, team building, etc.) Well, then the problem is that they aren't making those contributions.

Or is it just that you're paying them more than you would have to pay the subcontractors if you found and managed them yourself? Well, then you are totally free to skip the middleman and do that yourself. But there is, actually, value in finding and managing freelance work. I certainly don't want to do that myself! If someone is good at doing that, and the quality of the work they are managing is acceptable to me, then it seems like they might be earning their paycheck?

I do get that the dishonesty element is bad in and of itself, but I honestly wonder whether, if this is a problem a firm is having, they should consider hiring the work out to subcontractors, without any subterfuge.

Only if they are 100% fake as opposed to farming out work to someone else. I can turn up to an interview in person no problem. When hired I just have the person in India use my name/picture and do the work.

Of course if they hire me as opposed to that person in India directly there is likely a reason they wanted someone in the US. Often those reasons are legal and somewhere a law is being broken.

Easy, but expensive way.

Are you really going to do this for all candidates that make it to the final round of interview?

Are you also going to compensate the time for the candidate if he doesn't get selected?

Unless what you're proposing is more a formality, and that unless the person doesn't show up he's guaranteed to get the job.

I agree. It's kinda hard to pull this off. Just saying.

I find this answer highly implausible, not the least because maintaining cover doesn't count as dissing ("I infiltrated the org by telling them the lies they wanted to hear" is hacking 101). Also, North Koreans aren't dumb.

I find some people's attitude to NK hackers slightly schizophrenic: either they are a credible threat or they are amateurs. Which one is it?

> Dissing Kim is something that is not currently widely permitted in NK

This wouldn't be "widely", this would be a specific interaction with a hostile foreigner for the purpose of infiltrating them. It's not the same as being allowed to say this to fellow North Koreans.

> Not saying no one from NK never will, but so far almost everyone will immediately stop the conversation at this point.

Legitimate candidates would at this point too, so as a tactic this is useless.

If he's acting under NK command, this wouldn't be insulting, it's just doing a hacker's work.

Besides, you cannot have it both ways: either North Korean hackers are a "50ct army" or they are a credible threat. Most seem to be arguing they are a credible threat.

Also, he can always take the second option: "why are you asking about this in a job interview?", something many legitimate Korean candidates could ask.

    > Name 5 restaurants not on Google maps in the town you live in".