Slashdot Mirror
CareerBuilder Cyberattack Delivers Malware Straight To Employers
An anonymous reader writes: Security threat researchers Proofpoint have uncovered an email-based phishing attack which infected businesses with malware via the CareerBuilder online job search website. The attack involved the hacker browsing job adverts across the platform and uploading malicious files during the application process, titling the documents "resume.doc" and "cv.doc." Once the CV was submitted, an automatic email notification was sent to the business advertising the position, along with the uploaded document. In this case, Proofpoint found that as a business opens the automatic email from CareerBuilder to view the attached file the document plays on a known Word vulnerability to sneak a malicious code onto the victim's computer. According to the threat research group, the manual attack technique although time-consuming has a higher success rate than automated tools as the email attachments are more likely to be opened by the receiver.
That's what these morons get for demanding resumes in .DOC format instead of PDF. I don't need someone else editing my resume, especially an employer I'm submitting it to. So why do they want it in an editable format rather than a format which is specifically designed to be read-only and to appear exactly the same no matter what device you view or print it on?
it was a novel idea and i'm sure it solves some problems but having scripting in a document format is simply has too high a price to pay. scripting does not belong in documents!
Anons need not reply. Questions end with a question mark.
again, as I have said before, make sites fully liable for their content. Including ads. They can self host, or fuck off.
CB also appears to be very insecure spamming morons.
Good Job, CareerBuilder. Do you ever wonder why I tell people to avoid you like the plague?
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
Is Dice vulnerable to this attack as well?
Microsoft fixed the underlying vulnerability over a year ago.. Less than a month after it was first reported.
Do people really run computers with security patches turned off?
Computers connected to the internet?
Computers which are primarily used to open files emailed by random strangers?
It's a Word doc. This has always been a "vulnerability". You are soliciting Word docs, for heaven's sake.
"Please send me files, which like all files, might be infected" is not a "cyber-attack".
white priviledge
rewriting history since 2109
WANTED: Security expert to help patch the problems caused by our search for security experts.
Table-ized A.I.
Yep. Like the one you where reading and posted your comment on. Like Google. Like most other websites.
Only a few refuse* to work without JS. And for most of them you are the product, not the customer.
*Yes, refuse. They certainly can work without it, but choose not to. And often most of their JS has got little to do with their sites content, and much do to with "content enhancing offers" (read: advertisement spam) and user-tracking (and other stuff thats definitily not there to benefit you).
Of the remaining JS the most is dedicated to making the site look "hip" or "flashy", without adding anything to (the understanding of) the actual content.
And to link back to this threads origin, personally I regard running JS thats included in random webpages as similary stupid as opening random .DOC files (or other "text"-documents containing scripting).
tl;dr: The "must have JS running" sites are often as moronic as the Flash-only sites of yesteryear