We’re launching Lyria 3.5 in Google Flow Music, with advances across musicality, lyrics, vocals, and creative control
deepmind.google·6d ago
AI Engineering
Hacker News·Jun 15·5 min read
A backdoor in a LinkedIn job offer
TL;DR
A recruiter sent a LinkedIn message requesting a code review of a GitHub repository, which raised suspicions. To investigate safely, a virtual private server (VPS) was used to analyze the code without risk.
✦ Why It Matters
Engineers must adopt secure practices when reviewing code from unknown sources to avoid malicious backdoors.
Key Takeaways
- Always verify the source of code before reviewing.
- Use isolated environments like VPS for code analysis.
- Look for suspicious patterns in code, especially in test files.
- Educate teams on the risks of external code reviews.
Full Summary
In a recent incident, a software engineer received a LinkedIn message from a recruiter at a crypto startup, asking for a review of a GitHub repository. The engineer felt uneasy and opted to use a throwaway virtual private server (VPS) to clone the repository and analyze it in a controlled environment.
Upon inspection, the code appeared to be a React frontend with a Node.js backend, but a closer look at the app/test/index.js file revealed a hidden backdoor. This backdoor was cleverly disguised as a test suite, which assembled a URL from various fragments.
The discovery underscores the risks associated with code reviews, especially when dealing with unknown sources. Engineers should be vigilant and employ secure methods when evaluating external codebases to prevent potential security breaches.