Slashdot Mirror
CareerBuilder Cyberattack Delivers Malware Straight To Employers
An anonymous reader writes: Security threat researchers Proofpoint have uncovered an email-based phishing attack which infected businesses with malware via the CareerBuilder online job search website. The attack involved the hacker browsing job adverts across the platform and uploading malicious files during the application process, titling the documents "resume.doc" and "cv.doc." Once the CV was submitted, an automatic email notification was sent to the business advertising the position, along with the uploaded document. In this case, Proofpoint found that as a business opens the automatic email from CareerBuilder to view the attached file the document plays on a known Word vulnerability to sneak a malicious code onto the victim's computer. According to the threat research group, the manual attack technique although time-consuming has a higher success rate than automated tools as the email attachments are more likely to be opened by the receiver.
That's what these morons get for demanding resumes in .DOC format instead of PDF. I don't need someone else editing my resume, especially an employer I'm submitting it to. So why do they want it in an editable format rather than a format which is specifically designed to be read-only and to appear exactly the same no matter what device you view or print it on?
You should blow your load into slashdot comment content instead, to show off what you can accomplish.
it was a novel idea and i'm sure it solves some problems but having scripting in a document format is simply has too high a price to pay. scripting does not belong in documents!
Anons need not reply. Questions end with a question mark.
again, as I have said before, make sites fully liable for their content. Including ads. They can self host, or fuck off.
He can't, Slashdot doesn't allow whitespace-only comments.
CB also appears to be very insecure spamming morons.
Good Job, CareerBuilder. Do you ever wonder why I tell people to avoid you like the plague?
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
When has trusting the internet EVER worked.
Is Dice vulnerable to this attack as well?
I believe I've seen them before, but I don't know how its done
Microsoft fixed the underlying vulnerability over a year ago.. Less than a month after it was first reported.
Do people really run computers with security patches turned off?
Computers connected to the internet?
Computers which are primarily used to open files emailed by random strangers?
It's a Word doc. This has always been a "vulnerability". You are soliciting Word docs, for heaven's sake.
"Please send me files, which like all files, might be infected" is not a "cyber-attack".
white priviledge
rewriting history since 2109
WANTED: Security expert to help patch the problems caused by our search for security experts.
Table-ized A.I.
Yep. Like the one you where reading and posted your comment on. Like Google. Like most other websites.
Only a few refuse* to work without JS. And for most of them you are the product, not the customer.
*Yes, refuse. They certainly can work without it, but choose not to. And often most of their JS has got little to do with their sites content, and much do to with "content enhancing offers" (read: advertisement spam) and user-tracking (and other stuff thats definitily not there to benefit you).
Of the remaining JS the most is dedicated to making the site look "hip" or "flashy", without adding anything to (the understanding of) the actual content.
And to link back to this threads origin, personally I regard running JS thats included in random webpages as similary stupid as opening random .DOC files (or other "text"-documents containing scripting).
tl;dr: The "must have JS running" sites are often as moronic as the Flash-only sites of yesteryear
I used to PREFER the former (see subject), but it too showed some vulnerabilities (better than OLE compound document .DOC word files though by far, via macros etc.).
* IF only these headhunters realized holding down the SHIFT key stops macro action in MS Office apps... you know?
(I tell them in response emails that I am sending formats they CAN read in Word, or really, ANY word processor, when I send them my resume via attachments... most of them, thank goodness, understand this - however, does their 'automated systems' geared specifically to .DOC though I wonder? Some DO use those, for keyword searches on THEIR end when they go "cold calling" seeking candidates...)
APK
P.S.=> I don't really jobhunt anymore (retired pretty much as of 2009 & run my own business since 2008 here), but I send them .txt mostly IF I see a job that does interest me (not above working one that I find interesting even now though, but has to pay right too, of course) - @ least that format is still safe! apk