Identity Theft and Internet Fraud Expanding to Job Search Sites
By ryan | August 27, 2007
Internet fraudsters have found yet another way to take your personal information and use it against you. This attack targets people that post their resumes on Job searching sites such as Career Builder and Monster Jobs. Security company Symantec, reported a new trojan named infostealer.montres, which was trying to access the job posting site monster.com. It was also connecting to a remote server, and, when they accessed this server, they found more than 1.6 million entries with personal information belonging to several hundred thousand people.
This was being done by the trojan connecting to hiring.monster.com and recruiter.monster.com, Employer only sites. The trojan appears to be using stolen credentials of many recruiters to login to the web site and perform searches for specific fields and countries.
Then, the personal details such as name, surname, email, home address, work,mobile,home phone numbers are uploaded to a remote server where the attackers have full control. This type of server is a spammers dream and can then send extremely personalized spam to the person’s email, home address, mobile phone etc. There have also been reports that the spam can be sent with monsters company logo to make email spam appear to be legit and from a potential employer.
A good rule of thumb when posting to such sites, is to limit the amount of personal information you list, until you have established that the employer is legitimate. You can also use a separate disposable email such as a hotmail account or gmail account as your email.
Topics: Security, Technology, Vulnerability |