Monster.com Malware Tags Another Site

bl8n8r writes "The first wave of problems for Monster.com came in the form of malware as recruiters cluelessly pointed trojaned Windows systems into Monster's database. The incident reportedly gleaned more than 1.6 million records from the job search site's database. The second incident followed two days later in the form of an infected Monster.com server pharming out malware by way of advertisements hosted on its websites. The latest incident now shows jobseekers using USAJobs are also at risk from the pharmed Monster trojan. The worst part is Monster.com seems to shrug it off with: 'As is the case with many companies that maintain large databases of information, Monster is from time to time subject to illegal attempts to extract information from its database. Despite ongoing analysis, the scope of this illegal activity is impossible to pinpoint.'"

NEVER use Windows as a server OS.

[Anonymous Coward]

If there's one thing we've been shown over and over and over and over and over and over again, it's that Windows is just not a suitable OS to use in a server environment.

The main problem is, as illustrated here, an insufficient level of security and quality. This isn't just a problem with the Windows itself. This is a problem with the other Microsoft products that are commonly used on Windows, including IIS and SQL Server. They're far too easily compromised, and fixes never come rapidly enough.

When high-quality products like Linux, Apache and PostgreSQL are available for free, there's really no reason to be using anything from Microsoft in a server environment. Hell, there are many reputable companies offering very affordable, and worthwhile, support for those products. And when the rare security issue does arise, a patch is usually available within the same day, if not within an hour or less.

Maybe someday IT managers and executives will realize that Windows is clearly not the optimal way to go. There are alternatives, and they are far better when it comes to security, quality, reliability, efficiency, and most importantly, cost.

Re:

[Anonymous Coward]

Don't forget Solaris! And for a really secure network, you can always use OpenBSD. Thanks to their strenuous security audits, the OpenBSD developers have put out a product that is rock-solid, and nearly impenetrable.

Like their homepage states, "Only two remote holes in the default install, in more than 10 years!" That's a pretty remarkable achievement, when you consider that OpenBSD is a full-blown UNIX-like system, including a very capable, multiplatform kernel, a wide array of libraries, a great number of

Re:

[account_deleted]

Comment removed based on user account deletion

Re:

[Arterion]

I don't know if it's true or not, but someone should reply with the facts if it's not. If it is true, I, too, wonder why he's modded troll. I was under the impression that IIS 6 and SQL Server 2005 were pretty good on the security front. Of course, the admin running them both has a lot to do with it. If you told me Windows admins are less apt to get security right, I'd believe you. But that doesn't mean the products themselves, when configured properly, are necessarily insecure.

Re:

[account_deleted]

Comment removed based on user account deletion

Here, I'll pinpoint the scope for them:

[Ant P.]

SELECT * FROM customers;
I'm curious to know how they could screw up a simple thing like database security to the point where some windows laptop on their network can just connect and do the above.

Re:Here, I'll pinpoint the scope for them:

[Valar]

Except that that is exactly NOT how the trojan works. I won't comment on the malware via ads issue, because I'm not familiar with the details (something you should try).

Here's how the trojan actually works.

A monster.com affiliated recruiter is someone who pays monster.com to have access to the section of the site where they can search the database of resumes and profiles with some fairly powerful search tools, and find candidates that might be qualified for open positions at their company. This trojan finds one of these people's computers and infects it. It sniffs out account and password information, which it then uses to log into the recruiting site. The trojan then makes a very broad search-- one that should make available all of the resume information. It then aggregates all of this information and uploads it to an external server, where presumably badies will parse it, and attempt to either make a spam mailing list probably.

The thing is, this information is all basically PUBLIC information. I mean, yes, it is supposed to be public only to companies that pay monster.com to show it to them, but it is your resume for goodness' sake. You know, that document that you send all over creation, hoping people will read it? Yeah.

So basically, I think the people whose accounts were comprised will noticed a slight increase in their spam traffic from having their email address crawled yet one more time.

Re:

[BlakLanner]

Slight? It is rather noticeable. The email address I used to use for my job search has been virtually spam-free for 4 years. Since the breach, I have been getting flooded with spam from the scammers trying to get you to "handle their e-commerce transactions". It has been rather annoying to say the least.

Re:

[LBt1st]

I've gotten fake e-mail from "monster.com" offering me a job. Only the job is a work at home deal and requires me to have a Bank of America account. If I don't have one, I'm suppose sign up for one at their website.
An obvious phishing scam, but how many of these things are going out to people who wouldn't know.. who are desperate for a job?

I've since removed my account.. well I actually couldn't find an option on their site to delete it, so I resorted to clearing all my info.
monster.com is now in my e-mail'

Re:

[dbc001]

Monster.com sends spam anyway. I used to use an email forwarder for my monster account (now deleted). I got several emails from shady recruiters, asking me if I was interested in working as a bank teller or insurance salesman - even though my monster info clearly indicated my interest in working as a web designer.

Re:

[ErroneousBee]

I'm curious to know how they could screw up a simple thing like database security to the point where some windows laptop on their network can just connect and do the above.

Look at the response headers from those two websites. The site is setup by the usual MCSEs who showed management a pretty webpage without actually having anything robust underneath.

We need to call those fools out.

[Anonymous Coward]

Those of us who know the dangers of Microsoft technology need to really start calling those people out. And I don't mean online. I mean in person, in the meetings where they're proposing their Microsoft-based "solutions".

I've seen this happen in meetings before. During one such meeting, one DBA suggested the use of SQL Server 2005 for a new project. And immediately, two Oracle DBs tore him a new asshole. They listed the numerous security issues that SQL Server has been plagued with. They listed a variety of

Re:

[Shados]

Wow, Oracle DBAs being against SQL Server? Who would have thought!

Re:

[Jeruvy]

Complete BS. Oracle is the KING of SECURITY HOLES.

They're not shrugging it off

[rastoboy29]

It's called desperation.  Or whistling in the dark. 

Re:

[Harmonious Botch]

They're actually trying to fix it. But the problem is that they can't find the right people. Seems that everyone they try to hire thinks they are id thieves and hangs up on them.

Trollish submitter

[packetmon]

The worst part is Monster.com seems to shrug it off with: 'As is the case with many companies that maintain large databases of information Funny how they shrugged it off:

Earlier this month, Monster discovered [a] a malicious code that attempted to harvest stolen email addresses from its database and transfer them to a server in Ukraine. The hackers then sent out phishing emails that claimed to be prospective employers offering a work-from-home job that asked for access to the user's bank account. Monster responded by notifying these job seekers that their contact records had been downloaded illegally and is now working with law enforcement officials and the appropriate regulatory agencies [b]. Monster also revealed that this incident was not the first time the company's database had been the target of criminal activity.

The company says that to boost its security measures it is implementing new robust capabilities for worldwide monitoring and surveillance of site traffic, reviewing and tightening all site access policies and controls and launching a series of targeted initiatives to protect job seeker contact information.

Source [thewhir.com]

[a] Monster discovered: Did you note that Monster themselves noticed the infiltration. Wasn't posted to a full disclosure list which means they caught it on their own for a change. Give them that credit

[b] Monster initiated contacting those affected and working with LEA's. This didn't come to light in the same fashion as say with what happened at LinkedIn. Linkedin spurns bug bounty hunter [theregister.co.uk]. So why post such a trollish statement as "monster shrugged it off". There should be a mechanism to moderate those who post articles.

Re:

[Ant P.]

There should be a mechanism to moderate those who post articles.

Don't want to go offtopic too much but there is the firehose and the /. staff these things have to get through first. It's not a good system (I don't know of any that are), but it's there.

Re:

[packetmon]

If there is one thing I've learned in my 9 years here @ /. (original nicks are joq/xprnstar and sil) is that, Slashdot is very influential believe it or not in the industry. Instances like this paint a not so pretty picture unfairly at companies, industries and technologies. Comments, fine we can deal with those, but there are those - and I don't know for the life of me know why - who takes sites such as /., Ars and others as the hammer of god. If I came in from the outside not knowing the true issue/story

Re:Trollish submitter

[cyclone96]

Beyond everything that you nicely outline, when it comes to the USAJobs site they won't be able to "shrug it off" because of the connection to the government.

USAJobs was built under federal contract, and the government was slowly moving to requiring every federal position be applied for through USAJobs. That includes internal promotions, executives, new-hires...basically everyone who is not elected or an appointee. A lot of fairly high ranking career civil servants are in that database.

I'm guessing the government is going to be very harsh on this, as they typically are when a contractor screws up IT security.

BTW, most federal employees and managers hate USAJobs, since you are not allowed to interview anyone unless the computer ranks them highly when it runs it's resume search algorithm. I can't interview someone unless the computer spits it out. Potential hires (and internal promotions) have to figure out how to "fake out" the search algorithm so their resume gets through. I'd love to see it go away.

Re:

[Anonymous Coward]

I for one was NOT comforted when I received an email from USAJobs saying that my SS# was safe. I'm a recent MPA grad and it's required on the site and in submissions + transfers to agency sites as far as I can tell. What disturbed me was the wording of their security notice, it implies that USAJobs is actually sending/providing my full information to an outside contractor.

That this includes my SS# going from a .gov to a .com is really a case of gov't being lazy about integration imho.

More importantly, I'm

pee in the pool

[Original Replica]

Information on the internet with disseminate. Everyone here who cries "information wants to be free" when the topic of the RIAA comes up needs to recognize that the same goes with your information when it gets on the internet. "Online" and "secure information" are oil and water.

Re:

[Loconut1389]

There's a difference between computerized records and online. I'd argue that with the right encryption and access protocols and safeguards, computerized records are more secure than a locked filing cabinet. Even online records can be secured if designers are paranoid and careful. The problem is when things aren't done with security in mind, or cutting corners to save money or time- or "wouldn't it be easier if everyone just had the root password" type thinking. You information doesn't necessarily want to be

Re:

[Original Replica]

I agree that there is a big difference between computerized records and online, the catch is that to not be online you have to physically unplug your storage from the internet. No off-site access, authorized or not. In the case of Monster.com, accessibility to information was what they were all about. Sure, they wanted to only allow access to paying/legit customers but the exact same could be said of most music licensing software. The same skills and sub-culture that have people unlocking the iPhone and pok

Re:

[Anonymous Coward]

Isn't part of the anti-RIAA argument that downloading music helps advertise and increases sales? You'd think with something like a resume, in which the sole purpose is to be seen by people in the hopes that they'll give you money, there would be little reason to be upset about its dissemination.

See?

[Renraku]

This is the shit we have to deal with. This is why even if you go only to trusted websites, you need to be careful. Use an alternative browser (that's not IE) or OS. Don't open email attachments, install toolbars, or anything that you haven't checked to make sure is ok.

All it takes is one 'yes' to have your computer pulled out from under you and put to work by some bastard that's probably not even in the business anymore.

Text of the email Monster sent out

[Anonymous Coward]

Below is an email Monster sent out to account holders. I was expecting a sincere apology with perhaps an offer for free credit monitoring. Instead, when they have a security issue, they invite their users to be more savvy about the internet.

Note their directions on "HOW TO BE A SAFE INTERNET USER". If perhaps they had taken their own advice, maybe we wouldn't be in this situation?

--

Dear Valued Monster Customer,

Protecting the job seekers who use our website is a top priority, and we

Say good-bye to Monster Dot Com

[Oshkoshjohn]

The very first time I read this, I used my username and password to access my account on Monster, only to discover a different person's name and data. I did the right thing, and changed the data in some of the fields to nonsense, and removed data in other fields. I have not been back.

Re:

[Craig Maloney]

I used this opportunity to cancel my Monster account. It wasn't doing anything for me anyway, but I figured that if enough people did it, they might take it seriously. You can read my account closure experience here [decafbad.net]. To say they shrugged this off as a small breach is an understatement. They didn't do anything real until the problem had escalated out of hand. If you feel as I do that Monster didn't act appropriately, I encourage you to also cancel your account. Maybe then they'll realize what their mistake w

pass the buck

[spyrochaete]

Monster really did shrug off this attack. They haven't responded to my email about whether my data was comprimised. All I got was an email saying that their databases had been breeched, followed by instructions on how *I* should surf the web safely. One of their recommendations was to contact companies by telephone instead of the web.

say what ???

[Lord Balto]

So they are telling you NOT to use their service but to use the telephone instead? Am I missing something here? What exactly is their business model anyhow?

Re:

[zairgit]

They sent me paper mail [zairgit.com].

but was it an accident?

[clarkn0va]

I have a friend who once worked for monster.ca and he explained in plain terms that it was little more than a front for harvesting their users' personal information for their own purposes.

It wouldn't shock me in the least to discover that monster played an active part in this shenanigan.

db

big deal

[delong]

Oh gee, the h4x0rs got my resume. What are they gonna do? SPREAD IT AROUND?

Ah, fun with Windows!

[WheelDweller]

A lot of people think Bill Gates is a computer genius, but he's actually a marketting genius. These people are going to pick up the pieces of their shattered OS, flush-n-fill, and start over. Some people just don' learn!

If we had, say, cars that had to have $5000 of repair done every month, we'd be good friends with several lawyers. Microsoft does nothing about viruses for two decades and such calamity is considered a 'way of life'. ...and people wonder why I'm such a hardcore Linux fan. Sheesh.

Guess I need to take my SSN out of my Resume

[mcnut]

I suppose it was a bad idea to include my mother's maiden name, first pets name, original hometown, SSN, major banking and credit card numbers complete with routing and Security numbers in my resume. Who knew?