I'm not sure it's fair to casually attribute an infection from such an exploit to user stupidity.
The first reason being that it sounds like the format was intentionally designed to allow this extra functionality.
The second reason being that the way it's described sounds very similar to the kind of behavior that is sometimes encountered while using a subscription music service like Yahoo Unlimited or Netflix's 'Watch Now' feature.
In the description it mentions that if the user plays the (infected) music file, IE launches and prompts them to download a codec. To me, this doesn't sound so much like typical malicious behavior as it does typical Windows-DRM behavior.
I could see how someone who has spent much time using DRM'd WMAs might be conditioned to assume that behavior like this was just par for the course.
My guess is that the fingerprint thing is mostly just the employer trying to cover its behind. While the fingerprint/background check can help with screening, I would be more concerned with what was being done to prevent a security issue once the person became an employee.
Though it's probably small, I'd wager that there's a greater risk that your sister's personal info could be compromised by a government agency (a la: V.A. laptop), than used for nefarious purposes by the employer.
Last week I caught a radio interview with a trial attorney about the whole Gardisil controversy. According to the attorney, the importance of getting Gardisil put on the list of mandated vaccines for schools is that once it becomes mandatory, it becomes almost impossible to take legal action against the manufacturer for any problems caused by the vaccine. This guy even went so far as to call it "the pay for Vioxx" vaccine.
Why is this so hard to do? My dad is the worst for this. The tightwad won't pay the extra $20/month for broadband, but expects me to come by every month or so and spend half the day helping him download updates over a dial-up connection. Then he has the nerve to ask to use my cellphone because I'm tying up his land line! When I offer to take the computer home to do whatever needs to be done, "that's alright, no sense in wasting gas".
Slashdot Mirror
I'm not sure it's fair to casually attribute an infection from such an exploit to user stupidity. The first reason being that it sounds like the format was intentionally designed to allow this extra functionality. The second reason being that the way it's described sounds very similar to the kind of behavior that is sometimes encountered while using a subscription music service like Yahoo Unlimited or Netflix's 'Watch Now' feature. In the description it mentions that if the user plays the (infected) music file, IE launches and prompts them to download a codec. To me, this doesn't sound so much like typical malicious behavior as it does typical Windows-DRM behavior. I could see how someone who has spent much time using DRM'd WMAs might be conditioned to assume that behavior like this was just par for the course.
My guess is that the fingerprint thing is mostly just the employer trying to cover its behind. While the fingerprint/background check can help with screening, I would be more concerned with what was being done to prevent a security issue once the person became an employee. Though it's probably small, I'd wager that there's a greater risk that your sister's personal info could be compromised by a government agency (a la: V.A. laptop), than used for nefarious purposes by the employer.
Last week I caught a radio interview with a trial attorney about the whole Gardisil controversy. According to the attorney, the importance of getting Gardisil put on the list of mandated vaccines for schools is that once it becomes mandatory, it becomes almost impossible to take legal action against the manufacturer for any problems caused by the vaccine. This guy even went so far as to call it "the pay for Vioxx" vaccine.
Why is this so hard to do? My dad is the worst for this. The tightwad won't pay the extra $20/month for broadband, but expects me to come by every month or so and spend half the day helping him download updates over a dial-up connection. Then he has the nerve to ask to use my cellphone because I'm tying up his land line! When I offer to take the computer home to do whatever needs to be done, "that's alright, no sense in wasting gas".