Tuesday, 21 August 2007

Monster.com Loses Data To Trojan

A new Trojan has attacked online recruiting site-Monster.com- and already accessed data on hundreds of thousands of users...

A new Trojan has attacked online recruiting site-Monster.com- and already accessed data on hundreds of thousands of users.

According to Symantec and Secure Works researchers, a Trojan called Infostealer effectively penetrated Monster.com database and stole details. According to reports, other versions of the Trojan, which is a variant of the Prg Trojan, were also found to be attacking other online job sites.

Less than a month ago, Monster.com and Cyveillance had warned about increasing attacks on recruiting sites. Probably Monster wasn’t aware that the it might be an victim as well. The new Trojan usually enters via phishing messages that Monster.com and Cyveillance had earlier warned about.

According to Symantec, the Trojan has allowed attackers to collect data of as many as 1.6 million people while affecting "several hundred thousand" users on Monster.com alone. Working independently, SecureWorks last Friday reported finding at least a dozen caches of personal information, totaling about 100,000 identities.

"The Trojan appears to be using the credentials of a number of recruiters to login to the Monster.com Website and perform searches for resumes of candidates located in certain countries or working in certain fields," Symantec said. "The Trojan sends HTTP commands to the Monster.com Website to navigate to the Managed Folders section. It then parses the output from a pop-up window containing the profiles of the candidates that match this recruiter’s saved searches."

The personal data is then extracted from the resumes and uploaded to a remote server, Symantec says.