top | item 37940713

How not to hire a North Korean plant posing as a techie

154 points| DougEiffel | 2 years ago |theregister.com

127 comments

order

throw747488|2 years ago

Here is my opinion as someone who worked with alongside North Koreans (textile factory) and visited NK. I am from East Europe and have 10 years in IT.

- NK secret service (or whatever you call it) is more sophisticated than this. They will act as proper company from Turkey, India, China or even EU countries...

- if you actually manage to get some North Korean who escaped to West, they are 10x more dedicated than anyone else. China, or South Korea (usual target countries) do not offer many opportunities, they need money for relatives.

- NK secret services do not attack west infrastructure, or steal info from small fish. They are too small to do that! Most money is from drugs and guns.

- if you hire US only, you eliminate 99.99% of issues. US borders are not ideal, but they do repeal unwanted Asians.

Edit: * stitching, working with cloth, it was textile factory in East Europe

mariojv|2 years ago

Out of curiosity, how would a North Korean who escaped to the West even get money to relatives still there?

Pigalowda|2 years ago

This is a guide for online platforms, such as upwork

Run_DOS_Run|2 years ago

>Evading in-person meetings or requests for drug tests.

I am surprised about the request for drug tests. Is this common in the US?

Except for high-security jobs, which are never possible remotely anyway, I have never heard of a client or employer asking for a drug test. If I got a request for a drug test, I would quit immediately. Even if I am sure it is negative, my private life is my business. Any attempt to control my private life I see as a personal attack.

Modified3019|2 years ago

In the US it’s fairly common policy to have when the employee could present a liability issue, such as driving a company provided vehicle, or operating heavy/dangerous equipment. Drug tests are a “cover our ass” measure and also make getting rid of “that fucking guy” easier.

In practice it varies heavily on how it’s implemented, generally a company isn’t really keen to spend the money and time on that shit until after they’ve been burned by incidents.

- Could be once on hiring, then only if you really fuck up. This is what my company does.

- Could be “random” testing that just so happens to “randomly” catch the obvious fuckwit who walked in after driving to work while probably blitzed and now wants to hop in a sprayer.

- Could be genuinely random testing.

I work in Agriculture, and my company provides me a work pickup truck (funny enough, my ATV in the back is my actual “work” vehicle if you consider time spent driving) along with fuel, which I can make reasonable personal use of. The tradeoff is they demand the ability to get notified of tickets/points added on my license, and if I start repeatedly getting speeding tickets and ignore the “hey, stop that shit” talk they give me, they’ll ultimately rescind the free vehicle they’ve provided me. Getting a DUI would very likely result in immediate termination. Which I consider fair enough

If I worked a desk job and don’t have a situation where altered states of mind would present a massive danger to myself, others, and company equipment, then yeah drug tests can fuck right off.

ornornor|2 years ago

My first “real” job demanded a background check where they could “interview my neighbors to get a sense of my character” and other egregious things. I tried many times to get in touch with the background check provider’s (backcheck in Canada) privacy team, never ever got to a human or anyone to return my voicemails.

The employer was completely incredulous I would refuse to submit to the background check and thought I had stuff to hide. I was laid off in short order. I do t regret anything, this was invasive and unnecessary. I’ve never had to do a background check again beyond providing an extract of my police file that says I have no convictions.

maximinus_thrax|2 years ago

> Except for high-security jobs, which are never possible remotely anyway, I have never heard of a client or employer asking for a drug test.

Some companies have contracts with the Federal Government and even if you won't be working on those projects or won't have to get the security clearance, there are certain clauses in the contracts which requires the company to not have employees drink at work, to drug test employees and other stuff like that.

I once was asked to do a drug test as the offer was contingent on the drug test to clear because of this kind of contract. I rejected the offer from other reasons, but the recruiter told me we can schedule the drug test weeks in advance, to make sure 'everything is out of your system, just in case'. It was a urine test, and I got the feeling that the company was trying to make sure the test was going to clear regardless of my lifestyle outside of work, no questions asked.

Also, the recruiter told me it was a one-time thing for me and other 'general purpose' employees, but persons directly involved in the whole security clearance government stuff were subject to random testing.

drivers99|2 years ago

When I started each of my last 2 jobs, I had to take a drug test. They are both US Fortune 500 companies. They are just normal computer operations type jobs.

The previous company won their case in Colorado Supreme Court to fire someone using medical marijuana even while off-duty.[0]

Additionally, even though we passed a law (constitutional amendment) allowing recreational use in Colorado, employers are still allowed to test and fire you for it.

[0] https://ogletree.com/insights-resources/blog-posts/colorado-...

seanmcdirmid|2 years ago

Intel had me do a drug test just for an internship that I was almost going to take in 1996 or 97. I'm not sure if they still do that, I haven't had a drug test since getting my Chinese work visa (which required a drug and Aids test).

AnimalMuppet|2 years ago

High security jobs. Jobs in finance. Anything involving driving or operating machinery. Maybe customer-facing jobs. Basically anywhere where, if you're stoned, you could cause damage to the company.

ricardobayes|2 years ago

Companies have weird requests sometimes. A good decade ago or more, I was asked to sign a disclosure that I was not a member of a certain faith (that has/had anti-tech sentiment at the time). That would definitely not happen these days.

stronglikedan|2 years ago

My company drug tests everyone they hire, regardless of the position. They say it's for a discount on employment insurance, but I have not verified that. They only test once, on the start date. They'll only ever test again if you fuck up on the job and hurt someone, or yourself.

kube-system|2 years ago

> I am surprised about the request for drug tests. Is this common in the US?

For software jobs? No, they aren't very common. But they are not unheard of.

hugh-avherald|2 years ago

As part of the vetting procedure, my government job (not dealing with highly classified material) asked my former employers if they knew any of my sexual fetishes.

mnky9800n|2 years ago

I interviewed for a random postdoc in the USA and then they offered and they asked for drug test and I told them no I have body autonomy and you don't get to decide what I do with my body when I'm not at work. And from the mysterious aether a directive came suddenly that it wasn't required only recommended that I take a drug test.

ClumsyPilot|2 years ago

Seems like drug tests are just a strange tool of humiliation

pyuser583|2 years ago

Yes. Lots of jobs require drug tests. Used to be more common.

Many jobs give you lots of warning. So it isn’t so much “are you doing drugs” as “can you stop doing drugs.”

xeromal|2 years ago

The only time I was drug testing was when I was hired to work at a gas transmission pipeline company and I felt that was a totally reasonable request.

the_only_law|2 years ago

I had to do a drug test prior to my start date for an F500 some years ago, but never again afterwards.

fennecfoxy|2 years ago

>I would quit immediately

Not everyone has that privilege.

lolc|2 years ago

> Threats to release proprietary source codes if additional payments are not made;

This is "a sign"? In what company is that not grounds for immediate revocation of all access, termination?

naruhodo|2 years ago

> logging in from multiple IP addresses,

[x] Phone, laptop.

> working odd hours,

[x] Delayed sleep phase insomnia.

> Repeated requests for prepayment followed by “anger or aggression when the request is denied”;

[x] Previously ripped off by shitty employers.

> Evading in-person meetings or requests for drug tests;

[x] Social anxiety, medical cannabis user who is aware that even though legal (in AU) it is stigmatised.

> Having multiple online profiles for the same identity with different pictures, or online profiles with no picture.

[x] Average privacy enthusiast.

I await further instructions from Glorious Leader.

kube-system|2 years ago

This is why human judgement is significantly more nuanced than a pile of if statements.

axus|2 years ago

I'm amazed that the "alt-detection" problem from multiplayer games has become a business problem. I guess the US gov has been doing this for decades for security clearances, is there a commercial equivalent that works internationally?

And there's still the "man-in-the-middle" problem.

webdoodle|2 years ago

The U.S. Office of Personnel Management data breach in 2015 exposed the personnel files of anyone who had applied for a job with the U.S. federal government. It was blamed on China, and it may have been, but that isn't to say they didn't sell or trade the data to N.K. That data would be extremely useful in building fake profiles that pass inspection, as bundled with LinkedIn data it would show what profile ingredients get people hired.

BossingAround|2 years ago

> Evading in-person meetings or requests for drug tests

Why would they evade drug tests and meeting in person? Do the "techies" claim they are not Korean at all? Surely, a North Korean would pass as a South Korean to (at least) any non-Korean colleague?

some_random|2 years ago

Because they're slaves kept in dorms in various South East Asian countries that can't leave, their handler wouldn't allow to go to an in person meeting or take a drug test. They're also usually lying about the city and country they're working from.

kstrauser|2 years ago

In today’s game of “North Korean or Bay Area?”:

- North Korean: Uh-oh. I can’t physically do either of those.

- Bay Area: I’m not taking bus-to-BART-to-bus from Berkeley to the city for some meeting that could’ve been a Zoom. Drug test? Is there a minimum level I need to pass? Not doing it.

aaomidi|2 years ago

If someone is asking for my piss, it better be in a sexual context.

Drug tests are dehumanizing af. What I do outside my work hours is my own private time.

wizerdrobe|2 years ago

Pure speculation, but there is a large North Korean methamphetamine trade. Allegedly, per escapees, many North Koreans use meth for purposes of work enhancing stimulants and hunger suppression.

Perhaps these slaves are being doped up to focus on the work?

Cthulhu_|2 years ago

Yeah, plenty of people will adopt the persona of someone else just to get hired.

If you're a white person on a freelancer website, you may get approached by someone who wants to buy your account.

gumby|2 years ago

How do you do a drug test on a remote worker?

And why? If they can’t do the job you fire them.

flerchin|2 years ago

A lot of the advice seems to boil down to "don't hire remote freelancers."

Tangurena2|2 years ago

The NK workers tend to be locked up in dorms in different countries. They can't go to drug tests because their handlers won't let them. Likewise, they're not actually in the country they say they are in.

Additionally, drug testing locations examine government IDs all the time, so the NK workers are not likely to actually have one that matches the name they are working under. Otherwise, people who use illegal drugs could hire "clean" family or friends to give the hair/urine/blood required for the tests.

People who have escaped from Scientology report being treated similarly - guarded at all times when they leave their compounds, ID documents seized.

some_random|2 years ago

I don't know where you're seeing that, what advice here would make it hard or impossible to hire real remote freelancers other than maybe the in person meetings?

Tabular-Iceberg|2 years ago

Wouldn’t throwing tantrums and threatening to violate NDAs over petty cash just undermine their entire spying operation?

RIMR|2 years ago

It sounds to me like the US released a report about NK espionage operations, and then people "thought" (as the article phrases it) that NK operatives were everywhere, and now we have this article that just seems to tie the most obnoxious freelancer behavior to NK espionage, without any actual evidence.

ClumsyPilot|2 years ago

Yeah, this reads like blatant xenophobia.

ClumsyPilot|2 years ago

This reads like blatant fear mongering

> infiltrate organizations they work for to steal secrets

Do you worry about this as a random company? You are gonna steal source code for 4 out of 12 micro services required to run some random online shopping website, or a video game? what is North Korean gov. Going to do with it?

And if you give random people access to customer data, then it’s already being sold on the dark web.

> suspicious behavior such as working odd hours and inconsistencies in name spellings

every autistic or dyslexic or socially disfynctional techy is a spy now?

fennecfoxy|2 years ago

Fyi we don't live in a utopian all for one and one for all world, as unfortunate as that is.

RecycledEle|2 years ago

Q: What will they do with it?

A: Insert code for backdoors, then leverage those backdoors to hack defense systems and systems that can track where defense personnel and equipment are. Traffic cameras and delivery services come to mind.

mrweasel|2 years ago

The Danish government might want to read this, preferably before having any more North Koreans working on ships for the navy.

tokai|2 years ago

Nah that was a different grift. One where a contractor hires a NK subcontractor that employs slave labor.

fossislife|2 years ago

> Repeated requests for prepayment; anger or aggression when the request is denied.

Why would they ask for prepayment?

some_random|2 years ago

Because the longer they're working at a company the higher chance of being found out and terminated, the higher the chance of their accounts being frozen, and the lower the chance they actually are able to get money to their handlers.

FooBarBizBazz|2 years ago

"Don't let the hoodie fool you, that's Pinus densiflora."

clubm8|2 years ago

are black hoodies juche?

stuff4ben|2 years ago

Wish someone would honeypot them all then reverse infect their computers.

psd1|2 years ago

I've always assumed that we (the west) do.

Stuxnet, e.g.?

mike_hock|2 years ago

[deleted]

kortilla|2 years ago

It’s from South Korean authorities

eatonphil|2 years ago

The first half of the article was pretty general advice that didn't seem to me to have anything more specific with how to deal with North Koreans than how you'd deal with a fraudulent IT freelancer in general.

The second half though was explicitly calling out a country/group, not North Korea, but professors who have Chinese citizenship.

toss1|2 years ago

No, it is an entirely fact-based move to reduce the risk of empowering totalitarian regimes with advanced information technology and advanced weapons technology, including nuclear weapons.

Note that the warning comes from South Korea, so are they pushing a racial bias against themselves?

Yes it really sucks to have to endure racial biases, which are a fundamentally stupid way of dividing the world. But that does not mean that everything is an example of such bias.