Slashdot Mirror
Monster.com Malware Tags Another Site
bl8n8r writes "The first wave of problems for Monster.com came in the form of malware as recruiters cluelessly pointed trojaned Windows systems into Monster's database. The incident reportedly gleaned more than 1.6 million records from the job search site's database. The second incident followed two days later in the form of an infected Monster.com server pharming out malware by way of advertisements hosted on its websites. The latest incident now shows jobseekers using USAJobs are also at risk from the pharmed Monster trojan. The worst part is Monster.com seems to shrug it off with: 'As is the case with many companies that maintain large databases of information, Monster is from time to time subject to illegal attempts to extract information from its database. Despite ongoing analysis, the scope of this illegal activity is impossible to pinpoint.'"
If there's one thing we've been shown over and over and over and over and over and over again, it's that Windows is just not a suitable OS to use in a server environment.
The main problem is, as illustrated here, an insufficient level of security and quality. This isn't just a problem with the Windows itself. This is a problem with the other Microsoft products that are commonly used on Windows, including IIS and SQL Server. They're far too easily compromised, and fixes never come rapidly enough.
When high-quality products like Linux, Apache and PostgreSQL are available for free, there's really no reason to be using anything from Microsoft in a server environment. Hell, there are many reputable companies offering very affordable, and worthwhile, support for those products. And when the rare security issue does arise, a patch is usually available within the same day, if not within an hour or less.
Maybe someday IT managers and executives will realize that Windows is clearly not the optimal way to go. There are alternatives, and they are far better when it comes to security, quality, reliability, efficiency, and most importantly, cost.
SELECT * FROM customers;
I'm curious to know how they could screw up a simple thing like database security to the point where some windows laptop on their network can just connect and do the above.
It's called desperation. Or whistling in the dark.
expandfairuse.org
[a] Monster discovered: Did you note that Monster themselves noticed the infiltration. Wasn't posted to a full disclosure list which means they caught it on their own for a change. Give them that credit
[b] Monster initiated contacting those affected and working with LEA's. This didn't come to light in the same fashion as say with what happened at LinkedIn. Linkedin spurns bug bounty hunter. So why post such a trollish statement as "monster shrugged it off". There should be a mechanism to moderate those who post articles.
Infiltrated dot Net
...they have a real monster on their hands.
Information on the internet with disseminate. Everyone here who cries "information wants to be free" when the topic of the RIAA comes up needs to recognize that the same goes with your information when it gets on the internet. "Online" and "secure information" are oil and water.
We are all just people.
This is the shit we have to deal with. This is why even if you go only to trusted websites, you need to be careful. Use an alternative browser (that's not IE) or OS. Don't open email attachments, install toolbars, or anything that you haven't checked to make sure is ok.
All it takes is one 'yes' to have your computer pulled out from under you and put to work by some bastard that's probably not even in the business anymore.
Job? I don't have time to get a job! Who will sit around and bitch about being broke and unemployed then?
Mod me down. I am here to waste a modpoint.
Those of us who know the dangers of Microsoft technology need to really start calling those people out. And I don't mean online. I mean in person, in the meetings where they're proposing their Microsoft-based "solutions".
I've seen this happen in meetings before. During one such meeting, one DBA suggested the use of SQL Server 2005 for a new project. And immediately, two Oracle DBs tore him a new asshole. They listed the numerous security issues that SQL Server has been plagued with. They listed a variety of technical problems with SQL Server. They basically told him that they would not stand for that kind of, as one of the Oracle DBAs put it, "raccoon shit" on their network.
Below is an email Monster sent out to account holders. I was expecting a sincere apology with perhaps an offer for free credit monitoring. Instead, when they have a security issue, they invite their users to be more savvy about the internet.
Note their directions on "HOW TO BE A SAFE INTERNET USER". If perhaps they had taken their own advice, maybe we wouldn't be in this situation?
--
Dear Valued Monster Customer,
Protecting the job seekers who use our website is a top priority, and we value the trust you place in Monster. Regrettably, opportunistic criminals are increasingly using the Internet for illegitimate purposes. As is the case with many companies that maintain large databases of information, Monster is from time to time subject to attempts to illegally extract information from its database.
As you may be aware, the Monster resume database was recently the target of malicious activity that involved the illegal downloading of information such as names, addresses, phone numbers, and email addresses for some of our job seekers with resumes posted on Monster sites. Monster responded to this specific incident by conducting a comprehensive review of internal processes and procedures, notified those job seekers that their contact records had been downloaded illegally, and shut down a rogue server that was hosting these records.
The Company has determined that this incident is not the first time Monster's database has been the target of criminal activity. Due to the significant amount of uncertainty in determining which individual job seekers may have been impacted, Monster felt that it was in your best interest to take the precautionary steps of reaching out to you and all Monster job seekers regarding this issue. Monster believes illegally downloaded contact information may be used to lure job seekers into opening a "phishing" email that attempts to acquire financial information or lure job seekers into fraudulent financial transactions. This has been the case in similar attacks on other websites.
We want to inform you about preventive measures you can take to protect yourself from online fraud. While no company can completely prevent unauthorized access to data, we believe that by reaching out to job seekers like you, the Company can help users better defend themselves against those who have attacked Monster as well as other databases.
We are committed to maintaining an ongoing dialogue with all of our job seekers about Internet security and the steps Monster is taking to protect its job seekers. The Company has placed a security alert on Monster sites offering information to educate you about online fraud. This information can be found at http://help.monster.com/besafe/. We have also included information on Internet safety and examples of fraudulent "phishing" emails at the bottom of this letter.
Monster has launched a series of initiatives to enhance and to protect the information you have entrusted to us. Some of these steps are being immediately implemented, while others will be put into place as appropriate.
We believe these actions are the responsible steps to protect the trust you place in Monster. We are also working with Monster's hundreds of thousands of employer customers to ensure a safe and effective online job search. We will continue to share information with you about the enhancements we are making as we serve as your online career resource partner. We invite you to keep reading to learn more about how to use the Internet safely.
Sincerely,
Signature
Sal Iannuzzi
Chairman and CEO
Monster Worldwide
HOW TO BE A SAFE INTERNET USER
Every Internet site in the world is facing the growing issue of fraudulent usage of information, and we want to work with users around the world to stop this practice - please keep reading to
Monster really did shrug off this attack. They haven't responded to my email about whether my data was comprimised. All I got was an email saying that their databases had been breeched, followed by instructions on how *I* should surf the web safely. One of their recommendations was to contact companies by telephone instead of the web.
IIS: http://secunia.com/product/1438/
SQL Server: http://secunia.com/product/6782/
IIS 6 and SQL Server 2005 have never ever EVER been compromised -- both vulnerabilities in IIS were not publicly disclosed. So, AC, like, STFU.
It wouldn't shock me in the least to discover that monster played an active part in this shenanigan.
db
I am literally 3000 tokens away from the chaotic crossbow --Stephen
So they are telling you NOT to use their service but to use the telephone instead? Am I missing something here? What exactly is their business model anyhow?
And die!
There, that should do it.
The very first time I read this, I used my username and password to access my account on Monster, only to discover a different person's name and data. I did the right thing, and changed the data in some of the fields to nonsense, and removed data in other fields. I have not been back.
Goddamned kids! Get off my lawn!
Oh gee, the h4x0rs got my resume. What are they gonna do? SPREAD IT AROUND?
For requiring me to submit my social security number, DOB, etc for all federal job postings. AND USING A NON-SECURE CONTRACTOR to manage the information.
Morons.
And sure they sent me an email saying that their SS#s were stored safely, but like I have any reason whatsoever to believe that--especially since USAJobs forwards the information to multiple sub-agency sites.
A lot of people think Bill Gates is a computer genius, but he's actually a marketting genius. These people are going to pick up the pieces of their shattered OS, flush-n-fill, and start over. Some people just don' learn!
...and people wonder why I'm such a hardcore Linux fan. Sheesh.
If we had, say, cars that had to have $5000 of repair done every month, we'd be good friends with several lawyers. Microsoft does nothing about viruses for two decades and such calamity is considered a 'way of life'.
--- For a good time mail uce@ftc.gov
I suppose it was a bad idea to include my mother's maiden name, first pets name, original hometown, SSN, major banking and credit card numbers complete with routing and Security numbers in my resume. Who knew?
ok.. so heads you lose tails I win. right?
I for one, would welcome employment by the 1337 h4x0rs! (..if they paid me well and i was outside legal jurisdiction)