5

I am about to have a telephone interview for a junior software developer position. When learning more about the company I have noticed that their website has been compromised or, simply put, hacked (the hacker left an unambiguous signature).

It is not necessarily obvious that the security breach has occurred - there is no flashing red banner "hacked" that you cannot miss - but after using the website you cannot really miss that (some of the links lead to the hacker's signature).

I do not know if I should mention it during the interview. My fear is that if I do not, then they might think that I did not really look at their website or if I looked I have a poor perception of what is going on.

If it is a good idea to mention it, how should I do it? If I just say something like "I know that your website has been compromised", I fear that the situation might be awkward, they might be like "Yes, so what now?", they might have an impression that I am just babbling random things to impress them.

Lastly, is it a bad sign that they have been hacked and perhaps should I reject a job if I am offered it? I would expect that security breaches happen and you cannot make a sound judgement based on this fact alone. I would believe it is more about how they approach the reality of being hacked. So perhaps I should ask about their policy? But is it not improper?

EDIT

As for the company and the job profile: they are both pretty much full-stack.

Also, to add more considerations, there is a problem of company-public benefit. Not informing them might pose a certain market risk to them, on the other hand perhaps public should see with their own eyes that they cannot secure their website?

Improve this question
3
  • What sector is the company in and is your profile web-oriented or not?
    – Lilienthal ♦
    Feb 3, 2017 at 9:46
  • 2
    You're damned if you do, damned if you don't. I would tell them, just not during the interview. Find another appropriate time and place to do it. If there is not appropriate time and place, then perhaps it is not your place to tell them.
    – Teacher KSHuang
    Feb 3, 2017 at 9:51
  • 4
    There's a bit of a difference between a non committal "something looks a bit odd on your website" and "omg you've been haxxxed". Presentation is all and the first is easier to hedge out of if you're wrong.
    – Nathan Cooper
    Feb 3, 2017 at 10:03

4 Answers 4

Reset to default
4

if I do not, then they might think that I did not really look at their website or if I looked I have a poor perception of what is going on.

Why is that? Weren't they looking at their website? The people supposed to look after it? I don't think that would be the case, but, from a game-theoretic perspective, not mentioning it at all is your safest bet.

You shouldn't tell them bluntly they've been defaced because It's alarmist and you'll lose face if you're wrong. If you're absolutely certain this merits their attention, you can present the facts as you see them, and let them come to the conclusion they might have had a breach.

Even so, you might be accused of being the hacker, or the guy interviewing you might be the one who made the site in the first place, and take it as an affront.

My advice is this: don't tell them anything during the interview.

Make an anonymous account instead, through Tor if necessary, and let them know anonymously. This mustn't come back to you in any way. Look up the Wikipedia article on responsible disclosure.

Good luck

Improve this answer
7

Personally, I would tell them the next time I talk to them - preferably before the interview.

If you have a contact at the company, you could notify them that you have evidence that their website has bee hacked.

Waiting until the interview could be viewed as you displaying a lack of urgency.

Improve this answer
1
  • I would tell them, but waiting to talk to someone technical makes the most sense, and it still should not be the first topic of discussion. I did this during the tail end of a technical interview; brought it up as an aside to whom I judged the most security-aware, with humility, along the lines of "I'm not sure if this is an issue," (I knew it was) "but I found what looks like it might be a vulnerability" (major) "and was wondering if you could pass this information along to whomever might find it useful?" (gave documentation of problem, how I stumbled upon it, and how to fix it.) got the job.
    – CodeShane
    Aug 5, 2020 at 6:12
2

Don't tell them in the interview. No matter how they handle it, no good can come out of making their mistake visible. Tell them only if and when they hire you.

Because if they don't hire you... why help them on your own dime? They are paying people for it (and they decided that's not you), so let those people do their respective jobs.

If you want to be "the good guy" you can still send them an email after they rejected you and let their people sort it out.

Improve this answer
4
  • 3
    why help them on your own dime? It costs the OP nothing (evidence found during research phase of interview) and it's the right thing to do, regardless of whether they extend a job offer or not.
    – rath
    Feb 3, 2017 at 10:04
  • @rath I think you really underestimate the time it takes to write a good and professional incident report. And he won't be paid for it. He will invest the time (lets say 20-30 minutes if he wants to look professional and not like a kiddy or douchebag) and get nothing in return. It only costs him nothing if his time is worth nothing.
    – nvoigt
    Feb 3, 2017 at 10:06
  • 1
    Wasn't thinking of a full report but something along the lines of Hey I found X and I think it means Y. Regards, AnonymousOnTheInternet. Since your name won't be attached to it there's no need to be formal. I agree with you otherwise.
    – rath
    Feb 3, 2017 at 10:12
  • 1
    @rath Then you have to go through the hassle of opening an anonymous account. It's not much, but it's something. I did not say don't do it. I'm just saying make sure it's worth the time spent.
    – nvoigt
    Feb 3, 2017 at 10:17
2

Depends on who you are talking to, if you're talking to some non-tech HR person I probably wouldn't bother at that point, but when you are talking to some technical person that might understand the issue then I probably would mention it. I would mention it in a humble way (in case I'm making a mistake) and make sure it is clear it was something I noticed during normal browsing of their website, basically. Be clear that you are not trying to show off or to brag, just bring it up as something you thought they might want to know.

Either, they learn that you are somewhat responsible and competent on IT security.

If they ignore the info, then you know THEY lack responsibility and competence of IT security but shouldn't cause much harm to you.

If they take offense, or think that you hacked the site, screw them.

Improve this answer

You must log in to answer this question.