In short, I just received a nice proposal to work on a new contract, the potential customer sent me a "document" with the project specs which turned out to be a password-protected compressed file with some pictures and a ".exe" file inside.
I submitted the executable to virustotal which reports this as a trojan (https://www.virustotal.com/gui/file/088e2dabf218024d30e6899152b6a031dc30ae6f7d516492cb797292d6255d27/detection), seems like this takes screenshots and steals browser data which can be used for other purposes later.
Anyway, be cautious with proposals you receive.
I guess the scammer assumed as a contractor, you may have access to other customer systems they could exploit.
The internet be crazy, ya'll.
[0] https://www.theblock.co/post/156038/how-a-fake-job-offer-too...
[0] https://www.coingecko.com/en/coins/axie-infinity [1]https://www.washingtonpost.com/technology/2022/04/14/us-link...
No normal business operates like this, and if they do, you don't want to work for them.
Microsoft in their wisdom have decided Windows users never need to see file extensions by default, so after unzipping the user would just double click an innocuous file with an MS Word icon. And maybe press OK on a prompt they've been trained to press OK on.
And with tech challenges being so common, perhaps all it takes is a typo in some manifest to download a malicious package in a sneaky way.
If it's an internal tool they've built, either make up a story about how you're temporarily on a machine where you can't install new software, or do it in a sandbox.
I'm not going to just blindly follow an executable download link in any circumstances. It's the same as if my bank calls me out of the blue and wants to confirm who I am with personal details, I'll look up their number online and call them back that way before proceeding. (Hasn't happened in a long time, but I do remember having to do that with a legitimate bank call ~15 years ago, when they called me and asked for my mother's maiden name before proceeding.)
Nope. That's a nonstarter.
For us old timers this was pretty much an e-mail every other day sort of thing. I remember putting up a website for contact work and getting spam virus crap within weeks from just automated bots.
On top of that, I wouldn’t even open a compressed file from someone unless I had a previous relationship with them, and even then I still would scan it since their computer could be compromised. I don’t care if it’s a contract offer, from my attorney or the president of the United States.
As for emails about contract jobs, even 15+ years ago these could be very targeted, specifying your company/resume etc. Now it will be getting even worse with chatGPT to write these emails in far less time and far more convincingly from non-native speakers.
Also note, unzipping files to look into them isn't automatically safe either... there are plenty of older CVEs where zip software had vulnerabilities allowing code execution, and a zero day is always possible. That's on top of the fact that zips can conceal file types of other software that might also have current CVEs.
Short story, and this should be followed by everyone in the tech community, never ever open attachments from anyone you don't know, and treat all attachments from people you do know as requiring scanning first. Not doing so puts your coworkers and your customers at risk. If you're accepting proposals for contract work, your process should always require one-on-one communication prior to accepting any attachments.
Deleted Comment
It depends.
Is this an .exe file in an email attachment? Then usually no.
Is this a github project which asks you to “curl totallysafe.com | sh”? Then often yes.
I only run random bash scripts from the internet with sudo permissions
There was some story I read years ago about how terrorists (I think it was) could have their plot foiled 99% of the time but they only needed to be successful once. Whereas their targets need to be successful 100% of the time. (I wish I could remember where I heard that)…anyways, this applies to IT security too.
The IRA statement following the bombing was: "Thatcher will now realise that Britain cannot occupy our country and torture our prisoners and shoot our people in their own streets and get away with it. Today we were unlucky, but remember we only have to be lucky once. You will have to be lucky always. Give Ireland peace and there will be no more war."
You probably heard it from multiple sources since it is a cliche used in all types of security fields. Kind of like how 'if you are getting something of value for free you are the product not the client' is for web-services people.
This is true, but an IT security team also has a huge number of opportunities to detect an intruder.
If the defender has just one security vulnerability, the intruder can get in -- and the defender typically won't know about the security vulnerability ahead of time. If the intruder is noisy just once, the defender can catch them -- and the intruder typically won't know what's being listened to or even what systems/credentials are real.
Right now I'm SRE in FAANG and the deal is quite sweet: we get paid for non-business hours, we are oncall only during daytime, I can exchange my oncall compensation for extra holiday. We also have enough time to fix recurring issues, remove noise, etc. But: I would never do unpaid oncall again. I would also think twice (or thrice) before agreeing for night shifts. As it turns out putting out fires at 3 AM can burn out entire team pretty fast.
AWS has a terrible reputation for exactly this.
I do find it sad that there is no general requirement to pay employees to be on call.
So as a contractor you need to make sure that there is an extra provisioning in there AND that the rules which govern on call are extremely clear. Like what about you going on vacation? Sick? Grandma dying?
I worked for multiple big US tech companies (both FAANG and non-FAANG) and all of them had oncall as a part of software engineering job.
Supporting the services you are developing feels like natural part of the job. And when I had a lot of tickets at night I was able to fix the issues and make oncall shifts better.
It wasn't always seen as a "natural part of the job". Time was when most companies had a dedicated team of support engineers, who worked in 8-hour shifts, and provided support round the clock. Developers also got to spend the occasional week or month in support. Eventually, a CEO (who I will not name) figured that they could save costs if they got rid of support, and got the dev engineers to do it instead - and sold it as a "natural part of the job" - which kool-aid almost everybody has drunk by now. Which is how devs now burn their weekends, nights, and health being on-call without a choice. I've seen on-call responsibilities pretty much involve being available 24x7 for a week, once every two months. It's not right, it's not natural, and it's a result of CEO penny-pinching. That's just it.
Paying fairly your employees for providing the support outside business hours also feels like natural part of the job. Unfortunately, surprisingly few companies do this.
If there were site related issues, that was usually the role of dev ops team to handle. That could then get triaged to a quality assurance team, eventually bug tickets could get created. Then during our normal office hours we could assign a normal software engineer to look at them.
Even the concept of being on-call physically makes me nauseous.
Sometimes, it feels like we're in the middle disillusionment era of the internet and tech, where all the hope and positive potential of the new medium has now given way to just previous crappy life problems taking it over, only magnified.
Influencers celebrate and encourage this stuff, because everyone older than you is just selfish and deserves to be scammed. Great role models. Being in my stepdaughter's life has been like watching the development of the human incarnation of the Fraud Examiners' Manual. She used to be listed as a beneficiary of my life insurance policy. At this point the only (and I mean only) chapters she hasn't attempted are the ones requiring abuse of one's own assets or credentials (kickbacks, arson, etc.), which are impossible schemes to execute when you've earned neither.
The mental health awareness stuff has scaled with it too. It used to be you moved to the big city for work, and when it got to be too much to handle you'd migrate out to the suburbs or country. But the internet made it so big-city, in-your-face hustle culture follows us literally everywhere. Everyone is out to fuck you. There's no peace or escape from the madness anymore. No wonder everyone has anxiety.