CareerBuilder Cyberattack Delivers Malware Straight To Employers 48
An anonymous reader writes: Security threat researchers Proofpoint have uncovered an email-based phishing attack which infected businesses with malware via the CareerBuilder online job search website. The attack involved the hacker browsing job adverts across the platform and uploading malicious files during the application process, titling the documents "resume.doc" and "cv.doc." Once the CV was submitted, an automatic email notification was sent to the business advertising the position, along with the uploaded document. In this case, Proofpoint found that as a business opens the automatic email from CareerBuilder to view the attached file the document plays on a known Word vulnerability to sneak a malicious code onto the victim's computer. According to the threat research group, the manual attack technique although time-consuming has a higher success rate than automated tools as the email attachments are more likely to be opened by the receiver.
Serves them right! (Score:5, Interesting)
That's what these morons get for demanding resumes in .DOC format instead of PDF. I don't need someone else editing my resume, especially an employer I'm submitting it to. So why do they want it in an editable format rather than a format which is specifically designed to be read-only and to appear exactly the same no matter what device you view or print it on?
Re:Serves them right! (Score:5, Insightful)
That's what these morons get for demanding resumes in .DOC format instead of PDF.
Ah yes, the ultra-secure PDF, which has never been a vector for malware.
Re: (Score:3)
Both should be scanned by the job site. Neither is encrypted, and both are being re-served to clients, so a scan should have been done.
If they were half as smart as they think they are, they'd demand plain text. It doesn't hide malware unless you save it to a file and double-click it. Who gives a shit about what font a resume is in? They can buy the layout.
Re: (Score:1)
Or define a common XML schema and don't include a tag to execute arbitrary code.
Re: (Score:2)
Re: (Score:2)
Well we're all fucked then.
Re: Serves them right! (Score:2)
Son
You don't actually think they read the resumes do you? That is waaay too much to ask HR. According to that slick salesman from Taleo HR is liberated and can focus on more important things like uh firing people and getting coffee.
You see you need the file in an ancient .doc format which will use an algorithm to check employment dates and delete. After that it looks for grammatical errors which is flawed and will delete perfectly good candidates due to Taleos own bugs! Last use a score like excite and Goog
Re: (Score:2)
I agree. But to be safe, demand plaintext unless you're looking for a photographer or a graphic designer.
Re: (Score:2)
So, we go back to plain ASCII text format. Unless that has it too. :/
Re: (Score:2)
Re: (Score:2)
If you don't understand the concept of software monoculture, then you're an idiot.
Here's a clue, moron: Adobe Reader isn't the only way to view PDFs.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
scripting in a document is bad (Score:3)
it was a novel idea and i'm sure it solves some problems but having scripting in a document format is simply has too high a price to pay. scripting does not belong in documents!
Re: (Score:1, Troll)
it was a novel idea and i'm sure it solves some problems but having scripting in a document format is simply has too high a price to pay. scripting does not belong in documents!
I'll let all the guys doing web pages know. I guess we'll have to figure something else out.
Re:scripting in a document is bad (Score:5, Funny)
Honestly, though, giving web designers access to scripting on the client side has produced a LOT of shit code and security holes.
So, if you're in the business of letting all the guys know, can you tell them to stop being so incompetent at security?
Because the average web developer seems to be pretty stupid and useless when it comes to writing code which doesn't want to become a gaping security hole.
kthanksby.
Re: (Score:2, Informative)
I'll let all the guys doing web pages know. I guess we'll have to figure something else out.
We wish you would. You've made the web neigh well unusable without noscript. I have to block javascript by default and just whitelist a few things to even tolerate the web a little bit.
So yes, PLEASE, let them know. I'm tired of having to set up noscript for all my friends and then whitelist their banks and shit so that stuff still works.
Re: (Score:1)
Javascript doesn't belong on the internet, neither does advertising or html5 or flash or any of that other fluff. The web should be only plain text and maybe a few images, I might even allow animated gifs. By the way, who's the asshat that put a pdf viewer in my web browser? Bunch of god damn fruit loops.
Re: (Score:2)
Re: scripting in a document is bad (Score:2)
Really?
There are sites that function without js in 2015?? Please, I do not use no script as it requires a crappy browser and UAC controls the hell out of me to allow. The ads are far less annoying.
Seems adblockers are the more realistic option
Re: There are sites that function without js (Score:1)
Yep. Like the one you where reading and posted your comment on. Like Google. Like most other websites.
Only a few refuse* to work without JS. And for most of them you are the product, not the customer.
*Yes, refuse. They certainly can work without it, but choose not to. And often most of their JS has got little to do with their sites content, and much do to with "content enhancing offers" (read: advertisement spam) and user-tracking (and other stuff th
Re: (Score:1)
Microsoft should invent Inactive-X
Liability (Score:2)
So not only is CB Spamming Morons (Score:2)
CB also appears to be very insecure spamming morons.
Good Job, CareerBuilder. Do you ever wonder why I tell people to avoid you like the plague?
Obvious question--can we ask it? (Score:2)
Is Dice vulnerable to this attack as well?
Hard to sympathize (Score:2)
Microsoft fixed the underlying vulnerability over a year ago.. Less than a month after it was first reported.
Do people really run computers with security patches turned off?
Computers connected to the internet?
Computers which are primarily used to open files emailed by random strangers?
Erm (Score:4, Insightful)
It's a Word doc. This has always been a "vulnerability". You are soliciting Word docs, for heaven's sake.
"Please send me files, which like all files, might be infected" is not a "cyber-attack".
Re: (Score:1)
Le sigh. "Flamebait".
My point is that you are soliciting files. "Send me files", you say.
They just now figured out that files might be infected?
Recursion Expert (Score:4, Funny)
WANTED: Security expert to help patch the problems caused by our search for security experts.