Monstrosity

Well, it would stink to work in either the PR department or the software development department at Monster.com right about now. The Infostealer.Monstres Trojan that was discovered attacking the job seeker site late last week just keeps sounding worse and worse. Bad enough that the malicious code collected 1.6 million records containing e-mail addresses, phone numbers, addresses and resume details of job seekers, but now the clever boys and girls at Symantec have figured out what the bad guys want to do with that information.

The general idea is to deliver unsuspecting Monster.com members a double package of woe: fake "job" offers that amount to "mule" activites designed to get ill-gotten gains out of the country, and a further Trojan called Banker.c, designed to steal log-ins for online banking accounts.

Now, clearly, anyone with half a brain would not fall for the job offer. This "Transfer Manager" position requires you to have a Bank of America account, and to give that account number to this supposed employer. You then receive money via Western Union, deposit it in your account, and they will withdraw it. For this you get a commission. Uh huh. Riiiiiight. Sounds totally legit.

Nevertheless, bad guys do these things because some people fall for it. Truth is, they would be likely to have at least some success. If you've posted a resume to Monster.com, you might be pretty likely to open an attachment that looked like it came from them. So even if you aren't duped by the job offer, you've given them a chance to plant malicious code on your machine.

But here's the kicker. I can't see how Monster could have absolutely been sure to prevent this kind of thing. The whole scheme was made possible in the first place by using stolen job poster log-in information. You can only be as secure as the people who log in to your service. If they allow their passwords to be stolen, it's pretty hard to guard against unauthorized access.

But I'll bet you anything they're gonna try. I'm sure Monster.com's infrastructure folks are burning the midnight oil to work on preventative measures as we speak. Right alongside the PR folks, who are, I'm sure, buring the midnight oil doing damage control.

Posted by Kevin Carlson at 12:45 PM  Permalink