Fake recruiters infect developers through coding challenges

According to researchers at ReversingLabs, North Korean actors have used coding challenges in fake recruitment processes to infect developers looking for work. The actors posted seemingly genuine job adverts on platforms such as LinkedIn and Facebook, then asked candidates to complete coding tasks to demonstrate their skills. The incomplete repositories handed to candidates as a starting point contained malicious dependencies that compromised the workstation and gave the actors access to every secret stored on it.

What this means for your organisation

A developer looking for a new job tends to do so from the machine they already have, with access keys to your repositories, cloud environment and build chain sitting locally. The attack therefore reaches your organisation without passing through any of your own channels. That makes secrets on developer machines one of the most underrated points in the supply chain.

Berigo recommends

• Move access keys off developer machines and onto short-lived credentials issued on demand.
• Require unknown code to run in isolated environments such as a container or virtual machine, never directly on the workstation.
• Enable alerting when new package dependencies are pulled from sources outside your internal registry.
• Tell your developers plainly about this technique; it is a risk they can defeat themselves once they know it.

Source

• reversinglabs.com