Hacker News Reader

Comment by Scoundreller | Hacker News Reader

> got hacked over the "free wifi" provided in the HQ

elaborate?

Look it is probably nothing…but anyway, this is not the time nor place to name and shame, but more specifics.

So… Interviewer specifically asked me to bring my computer, after the initial intro they asked me to show some code I’d written. I said I’d just connect to my mobile hotspot. They looked shocked and said “I didn’t think you’d have a phone here” (it was an overseas fly out for the day), I said it’s fine, I always have a phone. And they insisted I instead connect to their office wifi.

It was the only wifi i used the whole time i was there.

Back in other country I saw my mail had another logged in session, and a private repo post install script had pulled a resource from my server, from an IP back in the country, and another random country.

Only way to access to private repo was SSH key (or GitHub credentials) Only way to access to Mail was MITM cloning session or access to device (more likely - I thought i would have noticed any MITM cert issues).

Incidentally, from the same country, this time another company, I had another fly out interview request a week later and this company also specifically asked me to bring my computer — when I asked if it would be ok if I wasn’t gonna bring my computer because I needed to get it fixed, they got back the next day and said oh, we have to cancel the interview because we it won’t be possible for us to proceed.

To proceed… with hacking?

Hahaha, who knows? I’m not expert enough to know what this all means. Maybe it’s nothing. It’s probably nothing.

please name and shame, at least the country.

Not the time or the place. It would be misinterpreted. I don't want it to misrepresent the place.

Or at least which country?

Like i said man. No. Hope you can respect that.

I don't want to be responsible for misrepresenting a country, and I think it's prudent to keep the protection of privacy there until it's definitively proven with evidence.

Good call.

That's my M.O.

I take it a bit further. I won't go into pissing matches. If folks wanna fight, I'm not the guy to do it.

My general stance is, if it's complimentary/good, I don't worry too much about getting specific. If not, I keep it vague (which sometimes pisses people off, but life is not fair).

I generally don't name my former employers, just to keep their name out of venues where someone else with a grudge could throw poo (see "Apple" -not a former employer of mine).

Me too man. I don’t like saying negative stuff about people, especially unprovoked (is not a counter). Feels like a grave responsibility. Always been that way! I love complimenting people.

I’m not sure if it’s connected but in the general sphere of things, maybe one downside I’ve noticed in my life is i can be a bit slow to notice when someone or something isn’t good for me. Even if it’s obvious, to others, i always wanna see the good, sometimes i think I’m in denial willingly! Haha… So I have learned to become aware of such people and their behavior, pattern recognition.

I've learned to keep some relationships at arm's length.

It's a long story, but I have spent my entire adult life, dealing with some of the most dangerous, doesn't-play-well-with-others people on earth. I'm proud to call some of them friends, and have learned to politely avoid getting too entangled with the drama of others.

I've learned that I'm responsible for enforcing my own boundaries, and that I don't need to use nukes. Often a simple "No, I'm not going to do that, but I will do this..." is sufficient.

What exactly did you do over the wifi? How do you think they were able to access your private SSH key by simply having your laptop join their wifi? Did you leave the laptop unattended and unlocked?

They asked to view some private repo on GitHub, just whatever random file I chose to show them to see an example of some significant work.

> How do you think they were able to access your private SSH key by simply having your laptop join their wifi?

I don't know. I assume it's possible, I thought you could get hacked over open wifi? Anyway, but how would it be done do you think?

If it's only MITM then perhaps SSH keys were not compromised. But I didn't take that chance. I just changed everything.

> but how would it be done do you think?

That's what I'm trying to figure. Open wifi or not, your private ssh key shouldn't leave your pc when you're using it. Ditto for whatever sites you visit over HTTPS, the whole point of TLS is to avoid MITMing connections and extracting their contents.

I'd assumed that somehow connecting to or using their wifi got local privileges?

There's things like cellular modem exploits that bypass all the higher layers of the stack and get access to your cell phone at the base layer. I'm guessing similar stuff exists for wifi. Heck it could have even been a power cable I maybe mistakenly plugged in trusting it! I'm not an expert on any of this tho.

With the MITM I think you're right, I would have expected to see some cert issues. But I know I have seen GitHub MITM'ing before with a state issued MITM certificate (won't say where right now), tho I did notice that because there were connection issues and then I paid attention to the address bar.

It could have been that there were cert issues, I just wasn't paying attention to them, as it was an interview. That sounds plausible.

I guess the issue is there's all kinds of exploits and zero days that most regular people don't really know. Of course they could have combined it with a PDF exploit from something they emailed me. I don't know!

Did you find anything on this in the meantime, on theories on the different ways it could be possible? How would you rate your cybersecurity redteam/blueteam knowledge in this domain on a scale of 1 to 10 (10 being best)?

Some kind of unknown wifi attack seems the most plausible to extract the ssh key if you cofirm you haven't left the laptop unattended and everything else is reasonably secured.

Although you're certificate point did give me pause. Don't you have the private ssh key stored somewhere accessible from github? Like some kind of action or whatnot.

Also, is that key not password-protected? Did you ignore some SSH connection warnings and forwarded your agent?

I don't work in cybersecurity, so let's just say that my readteam knowledge is 1. I just try to understand how things work and protect my stuff as best I can. I'm just very surprised since your situation seems, on the surface at least, to fly in the face of what is commonly expected.

> Maybe it’s nothing. It’s probably nothing.

Yep, two different companies flying you out just to hack your shit. It's probably nothing. It makes me curious what you work with. Do you maintain commonly used open source software?

Well I mean, it's not like anyone told me they were hacking stuff. I'm probably just over reacting, or misreading it. Strictly speaking I think it's prudent to keep an open mind until it's definitively proven with evidence, but my current take is what I've said here.

This was at the point in time where I was developing BrowserBox and doing demos but had not released the code publicly.

The same adversary trying to hack twice with the same method is entirely plausible though.

On the other hand if they invited GP to their HQ, they'd have a lot to lose unless the companies were entirely fake.

This sounds to me like you connected to a network on your laptop and cloned an "internal" repo that downloaded something (no different to. Pip or Npm do the same thing.

And that your mail client saw a new IP and treated it as a new session? I think assuming you were hacked based on this is paranoid.

> To proceed… with hacking?

Or maybe, they didn't have a laptop for you to use (which is stupid, don't get me wrong) so they couldn't do the next stage unless you had a device. Given you had to use it for the first step, it doesn't seem unlikely.

If they wanted to "hack" you, they didn't need to fly you out, they just needed you to clone the repo and run the script.

Haha, yeah, I understand how you could have misread it like that, I'm sorry the original was not very clear!

Let me try again: then didn't ask me to clone any repos of theirs. They only asked me to show them my private repo on GitHub so they could see some significant work I had done. I just picked some random nothing file and they were satisfied. Then I saw that this private repo had been cloned after that trip. Normally you can't see clone IPs on GitHub but for my install process the npm "postinstall" script pulled something off my web server. Basically I had a line buried in one of the scripts referenced in the postinstall script:

  wget --header="Authorization: Bearer $MY_ACCESS_TOKEN" https://api.myserver.com/data

The only thing that ever pulled off that URL was that private repo postinstall script. After seeing my mail session at a random IP in that country, I thought oh that's probably me, but then I was already back home and I wondered why there was still a session there, so I then checked the logs of my server saw another IP from that country pulling that URL, from the day after I was there, when I hadn't made any servers there or run that script when there.

What you say about the laptop was what I originally thought: Why do they want me to bring a laptop? Do they seriously believe I don't have a computer? Hahaha

> If they wanted to "hack" you, they didn't need to fly you out, they just needed you to clone the repo and run the script.

I agree it sounds implausible, right? It's probs nothing. Likely I'm just misreading it.

I don't want to jump the gun and I think it's prudent to keep an open mind, I certainly don't want to spread a bs rumour, nor misrepresent a country with something had not been definitively proven with facts. That would totally lack integrity, be irresponsible, and would be undermining due process and ethics. It would also just be disgusting awful betrayal of everything good, so I don't want to jump the gun or name and shame.

I was invited and travelled to many countries for these types of interviews back in the day, all over the world: Europe, USA, Asia, even one in Africa. Definitely had some weird vibes at different places, but never had the same feeling of "hacked" as above.

But just wanted to clarify the facts. Does what I said make sense? Sorry it's late here.

Reply on news.ycombinator.com