Wild, true story from the security awareness and training company KnowBe4 that details how they inadvertently hired a North Korean hacker who was posing as a Western tech worker.
Kudos to them for publishing this. If it can happen to a security awareness company, it can happen to anyone (full disclosure: they've been an advertiser on my site for ages).
https://blog.knowbe4.com/how-a-north-korean-fake-it-worker-tried-to-infiltrate-us
@feld @pete_wright That's interesting. A lot of times, the only way you'll know something is off is by talking to them, ideally over video so you can match a name with a face and see how they react to different things. I remember a while back reporting on the hack of the FBI's Infragard portal, the feds vetted and approved a fake application in the name of a CEO of a credit rating agency. But they never called the number in the application, even though the fraudster had submitted the CEO's real mobile number in his application!
https://krebsonsecurity.com/2022/12/fbis-vetted-info-sharing-network-infragard-hacked/
@briankrebs @feld @pete_wright
but here they say
> Our HR team conducted four video conference based interviews on separate occasions, confirming the individual matched the photo provided on their application.
So the photo was modified to match the real person? And that person was actually doing the coding? Or are they using some high quality deepfake for every video call? Because that means more video calls would still not solve it...
BrianKrebs
Pete Wright
feld
chebra