Remix.run Logo
▲ AlexITC 2 hours ago

I have saw companies doing social engineering as part of their intrution testing, I imagine fake interviews are (or will become) part of these.

▲Aurornis 2 hours ago | parent | next [-]

I think it will remain uncommon. I agree it would be a good test, but companies and employees alike get very angry when pentesting gets too close to sensitive subjects.

Anyone who fell for it would not only get in trouble for poor security practice, they would reveal that they were job searching. That opens an entire can of worms that creates problems beyond the pentest. This also angers other employees who see it as a double-trap being sprung on employees.

Another major problem is that responsible employees who accept the fake interview but then use their personal laptop to do the interview will have their personal laptop compromised by the pentesters. Responsible testers will immediately abort, but some will try to use the personal laptop to pivot deeper which is a huge ick. It’s also really bad if the company is compromising personal laptops of people who are doing the right thing (switching to personal gear for interviews).

▲quaffcode an hour ago | parent [-]

The pentesters wouldn't have to actually pwn a laptop, just getting the employee to download and run anything could go in a report without having the file actually be malicious.

▲NikolaNovak 26 minutes ago | parent [-]

Would they have legal right to do that, out of curiosity?

Hired oentest has company permission to do stuff on company property. I do not imagine they have right to do so to personal property.

▲manphone 19 minutes ago | parent [-]

Absolutely not. There is literally no framework, which would give you the right to exploit an employee’s personal laptop, that’s just cyber crime.

▲thomc 2 hours ago | parent | prev | next [-]

Sometimes called "Full Spectrum Attack Simulation" where initial entry can include physical access or spear phishing. They can span months in elapsed time (not effort) so as to be more realistic. However there are still ethical and safety constraints and even phishing may not be able to use the (effective) technique of stressing the recipient too much or of course blackmail or coercing. So I think fake interviews may not be allowed in many cases, to protect the employees.

▲shepherdjerred an hour ago | parent | prev | next [-]

Is that even legal? Wouldn’t a fake job interview be, in a sense, tricking you into taking time off and working without pay?

▲nradov 22 minutes ago | parent [-]

Legality would be very jurisdiction dependent. It might be illegal in most developed Western countries, depending on the exact facts of the case. I suspect it wouldn't be illegal in China — unless the trick happened to hit a ranking Communist Party member.

▲dylan604 2 hours ago | parent | prev | next [-]

It'll be hard to time a job opening receiving interviews to line up with intrusion tests in a way that people would not be on guard against it in a way not normal.

▲philipwhiuk 2 hours ago | parent | prev [-]

Fake interviews would be a huge time sink and probably piss off your staff.

▲hirako2000 2 hours ago | parent [-]

They don't have to respond. It gives employers an even stronger signal they should be kept right?

▲Aurornis 2 hours ago | parent [-]

Using pentesting to also test employee loyalty is a great way to get the entire company to hate working there.

▲optimalsolver an hour ago | parent [-]

Which is why it's going to happen.