The best exploit of the year came with a payslip
A guest piece for The Exploit Society by Ben Jones, Practice Lead, Cyber Security at Coder Trove.
Victor asked me to write something for The Exploit Society, and I said yes before he finished the sentence. We've worked together on some complex gigs together and he is my go to partner in complex testing and the thing I noticed early on is how he thinks. He doesn't take a system's word for anything. He'll pull the firmware off a device before he believes the datasheet. He's pretty good at it.....
So I want to borrow that habit and point it at something most companies never think to test. Who they hire.
The NZ case
Last month New Zealand's NCSC published a case that should have rattled every hiring manager in this part of the world. A large Kiwi business took on a remote IT contractor. He was a North Korean operative using a fake identity and a New Zealand address.
A local had been recruited to take delivery of the company laptop and keep it switched on. When the contract ended, he claimed to have commercially sensitive data and wanted to be paid to keep it quiet.
There was no exploit and no phishing email. The company posted him a laptop and gave him a login.
When I read that, I thought about every scope Victor and I have worked to. I can't remember one that included the hiring process.
What the crews actually do
I've spent the last few weeks in Recorded Future's research on this, and what got me is how ordinary it is. One cluster they track, PurpleDelta, ran at least 22 fake personas and applied to more than 1,100 companies, with SEEK among the job sites. Each persona had its own ChatGPT set up to answer as that person. In interviews, operators pasted the questions into ChatGPT and read the answer back. Even when the answer was wrong, the cheek!
That detail made me laugh, then it made me uncomfortable. We see it. At Coder Trove we interview remote engineers every week for our team in Vietnam, and well before the NZ case broke we were catching candidates reading answers off a second screen. Most of them are just people trying to game an interview. The technique is the same so Zero Trust has taken on a new meaning for us in this past 12 months.
Closer to home, Huntress found three staff at an Australian healthcare organisation who turned out to be North Koreans posing as Chinese nationals. DFAT has also made it clear that keeping one on the payroll may count as a sanctions breach. So this lands on the CFO's desk now too.
The laptop
This is the bit I think Victor's readers will enjoy. The laptop lands at a house in the suburbs. Someone plugs it in behind an IP KVM or installs AnyDesk, and the person doing the work is in another country. Your MDM sees a contractor working from home.
That's a hardware problem as much as a people problem, and it's testable. Would your EDR flag a KVM sitting between the keyboard and the screen? Would your helpdesk send a replacement laptop to a "family member" at a new address if the story was good enough? I'd bet most wouldn't catch either. I'd love to watch Exploit run that test.
Who owns this?
I studied psychology before I got into security, and I keep coming back to the org chart. The engineering lead checks whether someone can code. HR checks the paperwork. Nobody checks that the person on the call is the person on the passport, and nobody checks again once they're in.
And once they're in, they have your repos and your cloud keys. That's a supply chain breach with a payslip attached.
We changed how we hire at Coder Trove. As much as we can is done in person. Our remote interviews have a few tricks in them that I'm not going to put on the internet. Once someone's on the team we treat them the way we'd treat a third-party library: least privilege, and we keep checking.
We hire offshore and we'll keep doing it. We just don't trust anyone by default, including the people we pay.
My ask
If you're scoping a red team for next year, put hiring in scope. Send a fake candidate through your own process and see how far they get. Have someone test laptop provisioning the way they'd test a login page. Somebody will have to own the findings on Monday morning. Better that than finding out from an extortion email.
I've been working through all of this with the Recorded Future team, and we're talking it through openly on 27 October if you want more.
Stay curious and stay frosty- be like Victor!
About the author
Ben Jones leads the cyber security practice at Coder Trove, a Sydney technology consultancy delivering enterprise systems, custom software and cyber security services since 2010. A former managing director of Continuum Cyber and co-founder of Jumpstart Security, he has served on the board of the Cybersecurity Advisors Network (CyAN). Connect with Ben on LinkedIn.
Sources
Published by Exploit Security in The Exploit Society. Ben Jones on why the hiring process belongs in a red team scope, and how a contractor, a laptop and a login can be the whole breach.
Writers do not work here. The topics are theirs.
Can a hire be the exploit? Yes. He points to a New Zealand NCSC case in which a large business took on a remote IT contractor who was a North Korean operative using a fake identity. There was no phishing email. The company posted him a laptop and gave him a login.
Why does this reach the CFO? Huntress found staff at an Australian healthcare organisation who were North Koreans posing as Chinese nationals, and DFAT has said keeping one on the payroll may count as a sanctions breach. He argues the fix is the same as for a third-party library: least privilege, and keep checking.
Who published this? Exploit Security, a CREST-approved offensive security practice in Sydney offering penetration testing services and offensive security consultancy. The author is Ben Jones, Practice Lead, Cyber Security at Coder Trove.
Comments