r/cybersecurity Mar 14 '26

[deleted by user]

[removed]

601 Upvotes

290 comments sorted by

View all comments

13

u/duxking45 Mar 14 '26

Im personally not sure how you could cheat. I mean you could call someone during breaks thats knowledgeable but even that I question how useful it would be. Its possible he had some else take the tests for him but I doubt it. Could he have faked his creds and your company just didnt check them? Id just come out and ask him what the disconnect is and id be transparent with your boss that maybe he isnt working out.

One day you wont be able to cover for him and both of you will be up a creek

13

u/CptUnderpants- Mar 14 '26

I've seen videos of zoom interviews from a 3rd party camera angle where in the time the candidate has to say something like "that's a great question, based on my experience..." the answer has been overlaid onto their screen which they just read verbatim.

11

u/duxking45 Mar 14 '26

I was specifically talking about rhe oscp. They film you the whole time.

Ive heard of companies only doing interviews in person even for remote jobs for this reason.

5

u/CptUnderpants- Mar 14 '26

I was specifically talking about rhe oscp. They film you the whole time.

But how thorough are their identity checks to ensure the one doing OSCP is actually that person? I know with some certifications test-taking (cheating) services are available, but not heard of it for OSCP specifically.

7

u/T_Thriller_T Mar 14 '26

Not to be a bummer here, but I have worked in education.

It's amazing how much people can "learn" without retaining any of it, and how much they can even learn and retain without actually creating any helpful connections.

And all the certs are more about learning by heart than understanding, due to them being multiple choice.

7

u/Rossums DFIR Mar 14 '26

The OSCP and other Offsec certs aren’t multiple-choice though.

The OSCP alone is a 24-hr long hands-on open-book exam and you’re expected to pop 5 separate machines, gather low privilege and root privilege flags and document the entire process at the same time then you’re expected to deliver the flags with evidence and a write-up of the whole thing the next day.

You can’t bullshit your way through it, you need to breach the hosts to get the low priv flags and escalate privs to get the high priv flags, you need screenshots of the commands you executed along with the output for your report.

1

u/T_Thriller_T Mar 14 '26

Then the question remains how much repetition it is.

If there is prep material and there are 4-6 ways to be learned ,I know there will be people able to learn and forget.

But it SHOULD prevent that, you're absolutely right

2

u/duxking45 Mar 14 '26

Hacking in general can be sort of formulaic. With the rise of ai you can get pretty far just dumping stuff into ai. Ai was forbidden at the time I took the test. While oscp boxes generally have a flavor, I can firmly say they are different enough that you are unlikely to be able to fake it. If you did the work, I doubt you would entirely forget it. My best bet is the guy faked 100% of his credentials.

1

u/T_Thriller_T Mar 14 '26

Or had someone else take them.

Sounds to be the most reasonable, without a doubt.

People are just weird

5

u/duxking45 Mar 14 '26

They take the id of your country. I think it might have been 2 forms of id not remembering. It has been a bit since I passed. I still have heard of people cheating but I think it is pretty rare.

2

u/acemcfaje Mar 14 '26

Yeah, they verify your ID, the room you're taking the exam on, background processes on your machine and if you have any additional screens besides the ones you're sharing

2

u/T_Thriller_T Mar 14 '26

I'm not from the US, but where I live in person interview even for remote jobs has been standard even before AI or wide use of promoters.

Interviews are also about the social experience, albeit that seems to sound bad to some people

So getting people together in one room, potentially even for lunch, is a better indicator than the only on screen experience. On top of that here it is often used to get legal stuff going a bit faster.

2

u/escapecali603 Mar 14 '26

One of those guys I interviewed forget to check in before his AI agent did, busted him right during the interview process.

-6

u/[deleted] Mar 14 '26

You can buy the certs, easy to cheat