Date:28/02/2007 URL: http://www.thehindubusinessline.com/2007/02/28/stories/2007022804970400.htm

Back Security threat to Monster users

Our Bureau

Advertisement

Pune Feb. 27 Websense Security Labs^TM has discovered e-mails that attempt to lure users to click on a link in order to upgrade their system security.

The e-mails, which are spoofed from Monster, are written in HTML and claim that Monster systems have been upgraded and that users need to download a certified utility to be able to use Monster.

Once the user clicks on the site, the greeting appears, Monster.com, welcomes you. "We are happy to inform you that we have successfully upgraded our site. Because of our system has great changes, you have to install Monster.com certified utility to be able to use Monster.com database. If you don't set up this tool until March 1, 2007, you will not be able to use your account. You don't have to answer this letter. It's just a newsletter. Thank you for your co-operation.''

According to an official communication, this is a potential threat to India as Monster has large number of registered users from India. The domain name that the e-mails point to is using five different IP addresses. Upon connecting to one of the IP addresses, the code is run, several files are downloaded and installed on the user's machine, and another file is downloaded and installed from a server in Denmark. The files appear to be designed to steal end-user information.