8/23/2007
Monster.com and other Job Boards are stealing your personal identification
With so many millions who are out-of-work and signing up on job boards, I believe it’s downright disgusting criminal behavior how these companies steal identities of those who are unemployed … below is just part of the story — the link will tell you more…
Cyber crooks are targeting a wave of new attacks at people searching for jobs online, security experts warn. Oddly enough, the criminals behind this scam appear to be just as interested in hiring you as they are in hijacking your PC.
Over the course of the past few weeks, virus writers have set their sights on users of job search giant Monster.com and at least one other jobs site with tainted online advertisements designed to install malicious software on the visitors’ machines, according to SecureWorks, an Atlanta-based security and research firm.
SecureWorks says that since May, more than 40,000 people have had their personal information stolen — including Social Security numbers, bank account data and job site credentials — thanks to a Trojan horse program that was planted in several advertisements running on the jobs sites. Some of these ads required a visitor to actually click on them before the Trojan could do its dirty work, while in other cases the Trojan appeared to swing into action as soon as the page hosting the ad was served, researchers found.
SecureWorks researcher Don Jackson said the Trojan was developed using a toolkit sold in black market forums under the name “icepack.” The toolkit is similar to the Mpack toolkit that surfaced earlier this year. It generates Trojans that probe for the absence of several software security updates holes that then permit the program to deliver its viral payload. Among the many weapons in its arsenal are exploits for recently patched security vulnerabilities in Apple’s QuickTime and Microsoft’s Windows Media Player. It also includes exploits for multiple Web browsers, including Internet Explorer, Firefox and Opera.
SecureWorks classifies the Trojan as a variant of the Prg Trojan, a fast-evolving piece of malware that appears to have been developed in tandem by different criminal groups. Secure Science Corp., the San Diego company that first spotted the Prg Trojan in late 2006, has a very detailed analysis (PDF) of the way it operates and some theories about its creators.
Anti-virus maker Symantec Corp. has been monitoring the attacks, which the company attributes to a Trojan its software recognizes as “Infostealer.Monstres.” According to Symantec, the malware steals sensitive data posted by victims to Monster.com and then relays that information to a Web site controlled by the attackers. The Trojan also directs a victim’s PC to blast out junk e-mail.
Symantec’s advisory doesn’t say what that spam looks like, but SecureWorks’s Jackson said the junk e-mails are typical work-at-home scams that include the Trojan as an attachment.
Part of the reason employment forums are being targeted may be that job search sites have truly massive numbers of visitors each day. But there appears to be another angle in play here: The scammers really are trying to recruit new employees.
Work-at-home scams propagated through e-mail are almost always recruitment schemes run by organized criminal groups. The groups typically troll job boards and forums looking for potential “mules,” people who agree — sometimes unknowingly — to launder stolen funds or reship commercial goods on behalf of fraudsters.
