Forgot your password?
typodupeerror
Security Businesses

Monster.com Data Stolen, Won't Email Users 200

Posted by Soulskill
from the security-specialist-wanted,-apply-within dept.
chiguy writes "There's been another break-in at Monster.com. It's surprising that there are still unencrypted passwords stored in database despite the previous hack, as is the decision to not email users — presumably so that no one will make a fuss. From PC World: 'Monster.com user IDs and passwords were stolen, along with names, e-mail addresses, birth dates, gender, ethnicity, and in some cases, users' states of residence. The information does not include Social Security numbers, which Monster.com said it doesn't collect, or resumes. Monster.com posted the warning about the breach on Friday morning and does not plan to send e-mails to users about the issue, said Nikki Richardson, a Monster.com spokeswoman. The SANS Internet Storm Center also posted a note about the break-in on Friday.'"
This discussion has been archived. No new comments can be posted.

Monster.com Data Stolen, Won't Email Users

Comments Filter:
  • by Anonymous Coward on Sunday January 25, 2009 @10:02AM (#26597763)
    They did the mash. They did the monster mash.
    • Re: (Score:2, Funny)

      by Anonymous Coward
      Was it a graveyard smash?
      • Re: (Score:3, Funny)

        by Anonymous Coward

        CNN reports that it caught on in a flash.

  • Accountability (Score:5, Insightful)

    by Zironic (1112127) on Sunday January 25, 2009 @10:07AM (#26597789)

    When will companies face accountability for the damages they cause due to lax data security?

    • Re: (Score:3, Insightful)

      by homer_s (799572)
      What do you consider to be "private data"? I was on a call with a customer last week who wanted a simple refer-a-friend type app. - they consider first-name and last-name to be private info and want to know about encryption, firewall policies, etc.

      As a client, they certainly have the right to ask us to do all kinds of encryption (as long as they pay for it). But it is absurd what people consider to "private data" now.
      All this will do is make other data like SSNs - treat some publicly known data as an
    • by gillbates (106458)

      When programmers are expected to get it right the first time, just like engineers.

      I kind of hate to the harbinger of bad news, but ever since Microsoft managed to convince people that software defects were a *normal* part of computer operation, the chances of holding companies accountable for bugs, security breaches, etc... have gotten vanishingly small.

      • Re:Accountability (Score:5, Interesting)

        by thethibs (882667) on Sunday January 25, 2009 @12:42PM (#26598741) Homepage

        Actually, it was IBM and CS academics that did that. OS360 was released with a long error list and assurance that this was normal for a product of that size. It was this era that produced factors like one error per so many LOC, where "so many" ranged from ten to a thousand depending on the source.

        This was long before Microsoft existed and it didn't need much pushing. It was so self-serving that the software industry never argued against it. It also came just in time to meet a huge increase in demand for programmers that could only be met by lowering the bar for entry--so for most of the new crop of programmers, the predictions were accurate.

        The sad idea of calling programmers "software engineers" in the hope that a new name would make them more diligent has clearly not worked. Since most are paid by the hour without reference to quality or results, it's unlikely that anything will ever work in this environment.

        What's needed is a change in the business model that links payment to a finished, correct product. ISVs working on fixed-price contracts and firmware developers have very low error rates.

        • While I tend to agree, it's also more likely to happen when people commissioning the software accurately define what "correct" means (in your "correct product" definition above).

          • by thethibs (882667)

            Granted. That's what IT architects are for. Unfortunately, very few projects have them, so programmers are expected to fill the role; one for which they are poorly qualified.

            The other problem is that most software projects are staffed, costed and scheduled before the product is designed--before anyone knows what needs to be built. Other than in the Aquarian atmosphere of an Agile project, failure is inevitable.

            • Granted. That's what IT architects are for. Unfortunately, very few projects have them, so programmers are expected to fill the role; one for which they are poorly qualified.

              Fairly often, the architects you get aren't qualified to fill the role either.

        • Re:Accountability (Score:4, Interesting)

          by Belial6 (794905) on Sunday January 25, 2009 @04:28PM (#26600669)
          The problem is that only software is expected to be perfect. No other product the average person or business buys is expected to live up to even close to the quality that software is. Go walk through any brand new house. Look close. I know that I could find literally tens of thousands of "bugs". In fact, flaws in houses are so common that parts are now standard who's primary purpose is to hide the flaws, or make it look like the flaws are 'supposed to be there'. The same can be said of cars, books, furnature, food, etc. Mind you, the less complex an item is, the fewer flaws you will find, but it still comes down to the fact that people just accept flaws in virtually every product they buy. So, no, IBM did not invent the idea that errors are to be expected. That concept has existed long before IBM ever came around.
          • Re: (Score:3, Insightful)

            by jmauro (32523)

            The issue is while the other products have defined and well used laws for product liablitiy, software does not. In fact the industry rejects and attempt to institute any sort of liablity procedures for them. As such, there would be a legal recourse for the owner of a house if the flaws in construction caused them to lose money or have loss of life, if software caused the issue there would be no legal recourse. Flaws in houses and cars tend to be minor things (paint chips, trim, etc), since the threat o

            • Re: (Score:3, Insightful)

              by jlarocco (851450)

              I disagree. For things that can cause loss of life, be a safety hazard (usually embedded stuff), or cause significant financial loss, software is held to the same standards as "regular" stuff. I'd say software even does a better job in that case, because, for example, most of the times when planes crash due to a defect, it ends up being a hardware defect.

              Fact of the matter is, for typical desktop software it's just not worth the trouble of removing every single bug. If you think Vista and OS X are exp

          • Re:Accountability (Score:4, Insightful)

            by hot soldering iron (800102) on Sunday January 25, 2009 @10:54PM (#26603665)

            Several points of your statement have been debated numerous times here on /.
            1) Software is expected to be perfect because the revision *only* requires a rewrite. No materials or tooling need to be changed to create a better program. (end sarcasm)
            2) Pointing to different consumer products as examples of acceptably flawed products isn't really accurate. Medical and Aviation are just 2 areas where flaws aren't acceptable. BUT... the rate of innovation is so low that it resembles a flat line because they have to test and bug-stomp all the way, at tremendous cost.
            3) Each area of industry has evolved its' own set of best practices, rules of thumb, acceptable quality control levels, etc... because they have a limited set of requirements to deal with. They have certain materials, tooling, methods, laws, profit margins, and expectations of customers to deal with. Software is limited in scope only by the human imagination, and thus presents an unlimited set of requirements and resources. The problem has few set limits, and thus is much harder.
            4) The design of a product is usually the cheapest part of the creation. They will redesign many times to save a little money on the tooling, materials, labor, packaging, etc... whereas design is the complete manufacturing stage for software. There aren't many opportunities to save money during the manufacture of the product.

        • by Culture20 (968837)

          What's needed is a change in the business model that links payment to a finished, correct product.

          I'd suggest linking payment to a finished product, "correct" or not. Then fines for bugs found depending on severity.

        • by hairyfeet (841228)

          Hell, it isn't even limited to software. Ever see the list of errata on the average CPU or GPU? And that has been going on as long as I can remember. When you are talking about a competitive market and add in the fact that the one that gets to market first can snatch up a big chunk of the business you often just need to get it "good enough" to get it out the door and hope nothing major breaks. Remember the floating point bug in the first Pentiums? Or the bug in the first Phenoms that degraded performance 10

      • Re: (Score:3, Insightful)

        It's rather difficult to code with 100% correct code when the developer is expected to be the project manager, the software architect, the QA team, and the production migration team all on his or her own, and to get it done in 1/2 the time that he or she knows is the minimum amount of time needed to get the job done right.

        Add to that hundreds of different pieces of the core code being designed by different teams with little to no overlap in communications, testing, etc., and you get a nightmare - it's impo
    • by PDG (100516)
      The law is already on the books in Massachusetts. Check out my comment below.
    • Re: (Score:3, Interesting)

      by WiiVault (1039946)
      I agree, this seems to be a growing problem. These companies seem to have little incentive to protect us, so perhaps they need a disincentive to let our data get stolen. I think it should be indexed to the number of accounts compromised and also increase with every violation. It is just criminal that these companies have next to zero accountability to protect their customers.
      • > It is just criminal that these companies have next to zero accountability to protect
        > their customers.

        As you are a paying customer they have whatever accountability their contract with you provides for. If it isn't adequate why did you agree to those terms?

        • by WiiVault (1039946)
          Are you serious? Really? I must have missed the clause where they say that they are free to lose all my info at any time. And yes we are "paying" because they shove ads at us all the time, I'm pretty sure that is how the site is funded.
    • by Dan541 (1032000)

      When incompetence becomes a crime.

      • Re: (Score:3, Funny)

        by Dan541 (1032000)

        When incompetence becomes a crime.

        and that won't happen because no politician will incriminate themselves.

  • by Anonymous Coward on Sunday January 25, 2009 @10:13AM (#26597823)
    If only there was some kind of service where you could advertise for a network security guy...
  • by assemblerex (1275164) on Sunday January 25, 2009 @10:20AM (#26597859)
    I am a nigerian prince who wishes to hire you. I will send you a check for $60,000 to cover your employment of $55,000.
    All I ask is that you purchase $5000 in laptops to send back to the parent company here.You can even keep one as your work computer.
    As soon as we get the laptops we will send you another check for $100,000 to hire two employees. We only ask the extra $10,000 be sent back to the parent company.
  • by Ritz_Just_Ritz (883997) on Sunday January 25, 2009 @10:24AM (#26597887)

    In these economic times people don't seem to care so much about "silly" things like privacy and security when they're scrapping for a job. In a better economy, I think people would be more inclined to make a big fuss. Sad.

    • In these economic times people don't seem to care so much about "silly" things like privacy and security when they're scrapping for a job.

      Do I smell sarcasm? Are you saying people who become less concerned with privacy when facing unemployment are the ones that are silly? If so, I take it then that you have stable employment and have no ability to empathize. If you were facing losing your house, keeping your home address private would be of very little concern. If you were risking bankruptcy, I'm sure you'd be less worried about spam. In either case, you'd be less concerned with more important privacy-related issues as well.

      It is sad, bu

  • Hopefully (Score:3, Funny)

    by Gates82 (706573) on Sunday January 25, 2009 @10:33AM (#26597931)
    Hopefully the data was stolen by a good employer.

    --
    So who is hotter? Ali or Ali's Sister?

  • Maybe the hackers are hiring? (No polygraph or pee tests required.)

    • The hackers, no. They seem to be doing just fine without any help, thanks. The spammers and scammers, heck yeah! Business is booming baby!

  • No wonder (Score:4, Interesting)

    by PutonBackBurner (1406907) on Sunday January 25, 2009 @10:57AM (#26598055)
    I went in to change my password to something over 25 characters, with letters (upper and lower), numbers and specials characters. It kept notifying me that the pass was not strong enough. I reviewed and followed the instructions, then extending it to over 50 characters. I received the same warning message even when clicking on the submit button - wtf?

    After several attempts, I tried logging out and logging in with the new pass. Guess what, it did change!

    Bad interface, bad notifications, bad programming , bad (or no) testing. No wonder they got had.

    I mean really, if you can't design and code a simple change password feature....
    • Re:No wonder (Score:5, Informative)

      by pimpimpim (811140) on Sunday January 25, 2009 @11:25AM (#26598217)
      What's also very nice: I just went there to change it. The change password feature does NOT ask you for your old password. So anyone who finds an open monster session e.g. in an internet cafe can change the password of that user and kidnap the account. This is the situation after their attack, not very promising what the future concerns. These are really basic security features that take at most a few hours to implement.
    • Re:No wonder (Score:5, Informative)

      by pimpimpim (811140) on Sunday January 25, 2009 @11:29AM (#26598249)
      oh, and... it's not even using an SSL connection, just plain http. Crazy.
  • Cancel Your Accounts (Score:5, Interesting)

    by db32 (862117) on Sunday January 25, 2009 @11:00AM (#26598075) Journal
    If you have a Monster account cancel it and leave a note in the "why are you canceling?" box. Don't make it some rant, but make sure you explain that you will not tolerate their incompetence, their unwillingness to take security of their users personal information seriously, and their total lack of integrity by trying to hide the breech from their users. Then explain that you will try to get everyone you know to cancel their account for their own security. Finding jobs is all about networking...so is taking down misbehaving companies.
    • I just did that very thing.. Apparently the earlier poster who said you couldn't do it from the webpage is no longer correct. They now have a "cancel membership" page...

    • Your comment will be perfectly stored in that same database. At least the hackers will read about your discomfort, so remember to state your geek skills in that rant, so eventually they could offer you a more interesting work.

    • by Shados (741919)

      I'm probably fucking blind, but I can't seem to find the damn delete button. Can't be that hard to find considering all the people who replied to you saying they did it.

    • by Darkk (1296127)

      Yep, I just cancelled it. They screwed up once but the second time?

      Hence the expression-

      "Fool me once, shame on you..fool me twice shame on me!"

  • "No resumes were stolen."

    Uh huh. So there's no possibility that the malefactors will log in with the stolen user IDs and passwords and collect resumes from people's accounts?

    • by Dan541 (1032000)

      Just hope you haven't pissed off the "church" of $cientology.

    • Re: (Score:3, Informative)

      by Speed Pour (1051122)
      <sarcasm>Yeah, cause they want the resumes<sarcasm>

      You must have missed the last 800 times this has happened to companies. They steal the email/name/username and the password, then try them on other sites with something more valuable to them (read: paypal, banks, online stores that also keep credit card info).

      BTW, in case it's not obvious from what I just wrote. Make sure you use a different password on every website. Even if it's only a small variation on a simple password, it might no
  • by v1 (525388) on Sunday January 25, 2009 @11:19AM (#26598187) Homepage Journal

    the person that stole the data emailed the users instead:

    Monster.com let me steal your personal information, not once but twice, knew about it, and didn't feel like letting you know, so I thought I would instead.

    Click this link [monster.com] to send an email to monster.com to let them know what you think about their security and their policy for handling of breaches.

    - The Haxors

    BONUS! If you click on the javascript form (can't link directly to it) on their main page up top right that says Help and Security [monster.com], there's two interesting bullet points lower right:

    - Protect yourself against online fraud
    - Contact us

    Those two really shouldn't be so close together on the same page?

  • Talk about some "monstrous" bad web security.
  • by kimvette (919543) on Sunday January 25, 2009 @12:06PM (#26598473) Homepage Journal

    I'm not terribly surprised. They have a casual approach toward development and quality assurance. In the early days of Monster at TMP Worldwide the QA department consisted of just two people - Fidelity demanded they focus more on QA so they brought me in (Fidelity was and probably still is their single largest account. At the time probably 75% of the jobs were Fidelity postings).

    The code running the site was atrocious - and the web server consisted of a single DEC Unix box. They had terrible cross-browser issues (I can't remember if it was Netscape, which was still dominant at the time, or MSIE which completely broke). The developers had no clue what was wrong, so I did some digging and the issue was a lot of table cells and even table rows were never being closed. I logged the defects and was given access to the code (which was Datapult PF at the time - thank god it was not easy-to-write/impossible-to-read perl). I worked with the developers (coders, really) to identify where each type of cell was being generated, and where it should be closed. The code was such that I had to print it on a line printer and trace with pens where each cell was being opened, and there were a lot of cases where the code was not nested properly. It was UGLY. Well, after a few days I had fixed the bugs and it was rendering properly in "all" of the two major browsers, and even AOL.

    (as an aside, Datapult PF was kind of neat - very readable and a much better alternative than ASP. I had taken the defect tracking system and enhanced it and wanted to clean up the database schema but there just wasn't time)

    Then, by the time they closed the Framingham facility and moved to Maynard, the Fidelity contract had been finalized so they axed most of QA (read: all but one person) and offered me a job as a developer - for $38K, which was just slightly over half of what I was making as a QA engineer. I told them thanks, but no thanks, that $38K is actually quite insulting.

    I don't know if they have a proper QA process and department in place, but back when I was there (1997 or 1998) the only people who liked the fact that there even was QA at all was the developers. Management, sales, etc. all hated us, and the parent company (TMP Worldwide) looked at QA as a cost center. They Just Didn't Get It then, and I wouldn't be surprised if they still do not have QA now and Still Don't Get It.

    I don't know what they're running for a back end now, but the response headers say IIS 6.0 so I'd presume ASP.net. For .Net and PHP there are plenty of harnesses to test for SQL injection bugs, which If THey Get It, they would be running against the site, but far more likely it's a human issue (someone selling the info, since TMP Worldwide grossly under-pays permanent Monster employees, or at least did at the time) or the Windows server has a root kit on it (if it is in fact IIS 6.0) -- or is the result of an untested bridge to other systems they integrate with. If their modus operandi is still that of TMP Worldwide and they view QA as unnecessary unless a client demands it before awarding a large contract (Fidelity is a company which Does Get It) then I would not be surprised if QA personnel and processes are both totally lacking.

    It was a fun contract - don't get me wrong. I liked the people I worked with, and I liked working with the developers to fix the problem, but TMP as a whole just doesn't get it. Monster needs to be run internally like a software company, since it is a large internally-developed software project which is CONSTANTLY being enhanced with more and more features and integrated with other systems (ad servers, etc.). It's not a small project by any means and proper QA from requirements through deployment and maintenance is the only way to minimize liabilities such as this.

    As an aside: does anyone out there remember the sleeping monster? The sleeping monster was in place whenever code was being moved from the staging server to the live server, or when the Oracle database would go down. The sleep

    • Hi, interesting post. I noticed you said Datapult PF was much easier to read/understand than ASP (at the time).

      I tried to find back examples of the syntax and features of Datapult PF, but I couldn't come up with anything. It's even not on the webarchive.

      I'd really like to see examples of its syntax and features, to get a basic feel for it, if you have any. Thanks!
      • by kimvette (919543)

        I have looked for it in recent years (I wanted to toy around with it) and can't find mirrors of the original site, just sites praising it and very old binaries. :(

        I didn't say it was easier to read than ASP - it's easier to read than perl, but at the time was better than ASP. Very easily extended, very modular, etc. - much like PHP is now.

    • by JWSmythe (446288) *

      I interviewed with them about a year ago in Maynard. It seemed like they had a decent shop set up. The folks that I interviewed with were knowledgeable.

      I got there just after a huge blizzard blew through. My first flight was canceled. My second flight late. I barely got any sleep at a friend's place before heading out there.

      If they'd hired me, and if I had access to catch something easy like "all your passwords are plain text" are one thing. Even if I kicke

    • by cecom (698048)

      Man, if you casually disclose things like that about your previous employers, don't expect to get many contracts. It is simply unethical. If they made you sign an NDA, then you just violated it, so you could be in real trouble. If they didn't, then they really are complete idiots :-)

  • by PDG (100516) <pdg@webcrush.com> on Sunday January 25, 2009 @12:28PM (#26598633) Homepage
    Not only is this violation bad in principle, its a violation in Massachusetts and several other states: http://privacylaw.proskauer.com/2007/08/articles/security-breach-notification-l/massachusetts-is-39th-state-to-mandate-breach-notification/ [proskauer.com]
    The really kicker is the law requires the firm with a data breach to inform several state agencies AS WELL AS the person who's data has been compromised:

    "The law requires that a person or agency that owns or licenses personal information about a resident of the commonwealth notify the attorney general, the director of consumer affairs and business regulation, and the affected resident if it "knows or has reason to know of a breach of security"

    • Re: (Score:3, Interesting)

      by chiguy (522222)

      Does anyone go to jail for breaking this law?

      That's the only way to really get people to follow it. Look at Sarbanes-Oxley, whether you think it's efficient use of documentation, the risk of jail for top executives got them serious about covering their asses.

      Corporations are perfectly willing to pay fines, since fines don't generally affect executive compensation.

      • by PDG (100516)
        That's a pretty naive thing to say. Hefty fines do have an impact on earning will most definitely reflect poorly upon an executive. Its also not the executive's place to micro-manage each and every department. This law is a civil regulation, not criminal law. There isn't much criminal basis for this sort of infraction. Its tortious in nature, specifically negligence (possibly product liability), and the state governments have created statute to coordinate expectations and further define liability.
  • Password safes (Score:5, Informative)

    by thepacketmaster (574632) on Sunday January 25, 2009 @12:34PM (#26598669) Homepage Journal
    This is why I only use randomly generated passwords for these type of sites, and store them in my password safe. They may have gotten my monster password, but they won't be getting into anything else.
    • by cathector (972646)

      this is a great idea but also sounds like a PITA,
      having to look up a random pw to log into a site.
      you could 'generate' a hashed password for each site, and just remember the salt.
      that way if your safe got lost or you didn't have access to it you could still derive your password for each site.

      eg, password = MD5(siteName + myAwesomeSecretSalt) + charsToMakeItPassPasswordRequirements.

      • by horza (87255)

        It's not really a PITA if you usually use one machine, in which case Firefox will remember the password for you after it's entered the first time. You only have to do it each time you change machine or reformat, and the balance of effort vs security seems well worth it. I bet the first thing the person that filched the monster.com username/passwords did was to use the same username (and variations on the real name) plus password to log into Amazon, Ebay, online gambling sites, and anywhere they can spend mo

        • by cathector (972646)

          good points, but if you do use more than one machine (which frankly, i do)
          or don't back up your safe or something, you could be in for some hassle.
          (actually i forget passwords on a regular basis and just rely on "forgot password" features)

          i'm not sure how my idea is insecure - it's a hash of the site name plus a personal master password. i guess if your master password got out though you'd be fux0red, but the same could be said for a password safe.

  • I hadn't visited Monster in years, but this story made me go over there and log in and update my profile (after I e-mailed them asking if my account was one of those compromised.) If this was viral marketing to get them more visits, it worked in my case.
  • Right after the first data breach, I called them up and demanded they delete my account and all of my personal data. The fact that there was not an option to do this online, and that I was forced to call them in person, was the first sign that their data management policies were fscked up.

    I was put on hold for a long period of time, and when I finally got a real person on the other end of the line, I told them in no uncertain terms that I wanted my account removed. You want to know what their response was

  • I assume users of Monster.com should change their password at that site and anywhere else they may have used the same password. What else can users do? Is a password change sufficient?

  • Just checked my saved passwords list and the monster one is a one off.

    Backups, one time passwords, they're a pain to do but at times like this I'm glad I only have one password to update!

  • Combined with the fact that they recently switched to a horrible new UI, this made me login to remove my personal details, change my password, and remove my resume. Most people are using craigslist these days anyway. It's cheaper for employers to post jobs there, and it's a better run site in general (clean UI, good security, etc.). I also left my Yahoo resume up, because that site's not too bad, and I know I get a few hits off it.

  • So to anyone who reuses passwords over & over again on different websites, this is a good reminder of the security risk you are taking.

    If you may have used that password on other websites, now is a good time to change them.

    Just think of the number of people who used the same password for their e-mail account as they used for their monster account.

Do not simplify the design of a program if a way can be found to make it complex and wonderful.

Working...