Open server found with peoples’ resumes, Alaska city gets lucky and watch for these updates
Welcome to Cyber Security Today. It’s Monday September 9th. I’m Howard Solomon, contributing reporter on cyber security for ITWorldCanada.com.
To hear the podcast, click on the arrow below:
 |
 |
 |
Many people post partial resumes online on sites like LinkedIn or on job sites, making sure some personal information like home addresses and phone numbers are left out. They save really detailed resumes for sites that offer more controlled access. Either way, resumes are a source of important personal information for criminals. So it’s worrying that a security researcher has found an open web server with a huge number of full resumes with personal information sitting unprotected on the Internet. These documents were apparently filed between 2014 and 2017. Some of them came from job site Monster.com. According to the news site TechCrunch, a Monster.com official said the server with the files was owned by a recruitment firm. Monster.com sells resumes to such firms. The spokesman said it is the responsibility of the companies buying that data to secure it — and those companies have the responsibility for notifying victims of a data breach. We can’t tell you who the offending company is, because no one is fessing up.
The Alaskan city of Unalaska has got lucky. The municipality recovered $2.3 million of the $2.9 million it lost after falling for a scam I’ve often mentioned in this podcast: Someone impersonated a company that the city deals with. The attacker sent an email to a city employee saying their firm’s bank account had changed, so please now send money to the new account. It took six weeks for the city to wise up. Then it called the FBI. Fortunately the feds were able to track and retrieve the bulk of the money. Usually criminals whisk the money away fast. The lesson is one worth repeating: Organizations have to put in strict rules for employees paying invoices. One rule should cover the safe way to verify requests when customers ask to change where payments normally go.
Attention software developers: If you use the PHP programming language make sure you update to the latest versions. They fix a number of serious security vulnerabilities.
Attention email administrators: If you use the Exim mail transfer agent there is a critical vulnerability that needs to be plugged. Upgrade to version 4.92.2.
Finally, tomorrow is the monthly Patch Tuesday for Microsoft products. Be on the lookout for updates to Windows and other software.
That’s it for Cyber Security Today. Links to details about these stories can be found in the text version of each podcast at ITWorldCanada.com. That’s where you’ll also find my news stories aimed at businesses and cyber security professionals. Cyber Security Today can be heard on Mondays, Wednesdays and Fridays. Subscribe on Apple Podcasts, Google Podcasts or add us to your Flash Briefing on your smart speaker. Thanks for listening. I’m Howard Solomon