Website manager / Web Administrator required for Ashford based company to build, manage and promote product and subscription websites in business, training and property sectors. As a Website manager / Web Administrator you will be required to build, design and maintain my Ashford, kent based cliens Website. you need to have good HTML, PHP, Dreamweaver and Photoshop. Role includes: Site design Site creation Site administration User administration Content management Marketing Search Engine Optimisation Search Engine Promotion Pay Per Click Advertising Skills needed are: HTML/FTP Frontpage/Dreamweaver PHP Javascript Photoshop or equivalent Technical support Any Zen Cart, Joomla experience advantageous. Additional Essential skills are: Excellent IT skills including Word, Excel, database systems Excellent customer service skills Good interpersonal skills Ability to work under pressure and follow confidentiality procedures Ability to work independently and as part of a team Good organisational and communication skills Reliable and Trustworthy The post will be offered on a 3 month trial period contract. On satisfactory completion will become a permanent position. Start: asap If you are interested please e-mail CV's to charmainek@reflexgroup.co.uk. Reflex is acting as an employment agency with respect to this vacancy

One of the worlds largest online shopping search engines require the expertise of a focused Product Manager to join one of the fastest growing Internet business in Europe. You will be responsible for the continual improvement of the customer experience globally,generating an effective development roadmap.Set performance targets whilst developing new initiatives and features to guide the team. Proven track record and excellent communication skills essential Salary £55k London Permanent Abraxas plc acts as an employment agency/business. No terminology in this advert is intended to discriminate on the grounds of age, and we confirm that we will gladly accept applications from persons of any age for this role.

Work details used for targeted attacks Monster Worldwide, the owner of employment search site Monster.com, last week began notifying the estimated 1.3 million users affected by a breach that leaked résumé information and pledged to beef up network monitoring and defenses to prevent such a leak from happening again.…

(InfoWorld) - The last thing you need when you're unemployed is a bank account that's suddenly emptied. But that's exactly what some unwary users of employment search site Monster.com faced after identity thieves made off with the personal information of more than a million people looking for jobs. This still-developing story has enough nooks and crannies to confuse a gumshoe, but some facts are clear: Monster's resume database was looted, and the personal information taken was used to forge convincing messages that deposited password-stealing Trojans and ransomware on users' PCs. Calculated and ambitious, the attack is striking for how it blended several elements -- stolen credentials of legitimate users, phishing e-mails, Trojan horses, money mules and more -- into a slick assault. Here's what we know so far. Was Monster.com hacked? No, as Symantec said immediately. Instead, the attackers accessed the resume database with legitimate usernames and passwords, probably stolen from professional recruiters and human resource personnel who use the "Monster for employers" section of the site to look for job candidates. But it wasn't until Thursday that Monster.com admitted as much. "By gaining unauthorized access to employer accounts, the software was obtaining job seeker contact information," a new alert said. What was snatched from the database? Names, e-mail addresses, mailing addresses, phone numbers and resume IDs, said Symantec. Yesterday, Monster.com added that only about 5,000 of the people whose data was filched live outside the U.S. That squares with what Symantec's Amado Hidalgo said in an e-mail: The information-stealing Trojan was hard-coded to dig through only the "hiring.monster.com" and "recruiter.monster.com" domains, limiting their theft to the Monster USA site's database. "They only targeted the U.S. Monster site and not any other international Monster [Worldwide] Inc. sites, such as those in the U.K., Spain, etc.," said Hidalgo. How was the information stolen? The Infostealer.Monstres Trojan runs batch searches by sending HTTP commands to the Monster Web site to navigate through folders, said Hidalgo. The malware then parses the output that appears in a pop-up window that holds the job seeker profiles that match the search criteria. Essentially, the Trojan worked as an automated search bot that located candidates, captured their contact information and sent it to a remote server controlled by the criminals. Symantec said that the server, though located in Russia, was hosted by a company out of Ukraine. By using Infostealer.Monstres to do their harvesting, the attackers also covered their tracks -- the Trojan could be planted on any computer previously compromised, with the search seemingly originating with that computer's owner -- and could easily spread the work out among a number of IP addresses, probably to slip under any Monster radar potentially watching for unusually large numbers of search requests coming from any one location. (There is no evidence at the moment that Monster deploys such radar.) How many people are affected? Initially, Symantec's researchers played it vague, saying only that "several hundred thousand" were at risk. Thursday, though, Monster said that it had found contact information on the hackers' server for about 1.3 million people who had posted resumes. The other number that's been bandied about -- 1.6 million -- represents the tally of contact entries Symantec counted on the server last week; a significant number of Monster users apparently post more than one resume. How did the hackers manage to grab so many contract records without Monster.com noticing? That's a good question. Monster itself hinted at one explanation: automated searches like the ones Infostealer.Monstres ran aren't unusual. "Many of our customers use automatic or semiautomatic means to search our database," said Monster spokesman Steve Sylven last Sunday. "Moreover, many of our larger customers rely heavily on our database, and their use may be similar to programmatic or scripted access." Translation: The searches conducted by the bigger Monster customers are as bot-like as those run by the Trojan. The thieves also probably relied on some standard tactics to avoid detection, including running the searches from innocent PCs and spreading out the work (see "How was the information stolen?" above). Spammers and malware spreaders use zombies to send junk mail and malware for the same reasons. What did the criminals do with the Monster data once they had it? No one's arguing the facts: personal information purloined from the Monster resume database was used to create, then send, targeted phishing e-mails -- the term is "spear phishing" -- that spread other malicious software or recruited "money mules," the middlemen who transfer money from a phished bank account to a foreign bank account. It's the emphasis where Monster and Symantec part. Monster has focused on the mule-recruiting angle or even depicted those e-mails as run-of-the-mill phishing. "The purpose of gathering this information appears to be sending email disguised as Monster in order to gain recipients' trust, and then attempting to convince users to engage in financial transactions," the company now says on its revised security alert. Only in passing does it also call out "or lure them into downloading malicious software." That, however, is the prime use of the stolen information, said Symantec's Hidalgo, who traced connections between Infostealer.Monstres and at least two other Trojans. The first, Banker.c, watches for, steals, then transmits back to hacker HQ online banking log-in information for accounts at Bank of America and the German arm of Citibank. The second, Gpcoder.e, is "ransomware," a Trojan that encrypts files on the infected PC's hard drive, then informs its owner that the files will be unusable until a fee is paid. In Gpcoder.e's case, the ransom was $300. What good does the other stolen information do the thieves? Two words: response rate. According to research conducted by an Indiana University team in 2005, people are much more likely to click or give up information if the message contains clues of legitimacy, as when the message appears to come from a close friend. In fact, 72 percent of the people in the study who received phishing mail from someone in their social network took the bait and divulged their log-on information, four and a half times the number in the control group. Spear phishing, then, can be incredibly effective, at least from the criminals' point of view. By using the Monster resume data to target the recipient and flesh out the e-mail with the recipient's real name -- often usually difficult or impossible to guess from the e-mail address itself -- the crooks can expect more people to let down their guard and actually launch the attached file. (In the case of Gpcoder.e, the file posed as Monster Job Seeker Tool, fictitious software of course, but likely enough to get people to click; when they did, they installed the Trojan, not a job search assistant.) So the goal of the attackers is...what? Bank account log-ons, clearly. Ransomware, though not uncommon, usually flops because someone -- often one or more security vendors -- cracks the encryption used to lock up the files and makes that public, eliminating the need to pay up. Another clue that bank accounts are the endgame is the effort spent on recruiting money mules. The group wouldn't need mules unless it had, or anticipated having, access to bank accounts. When did this start? We don't know, and so far, Monster has not talked about this. But one self-described Monster user claimed here to have received money-mule messages between June 3 and June 13, and had reported them to Monster. "Monster only said it was not from them and did not admit that they had let my information get away from them," said "Anonymous." Symantec first alerted Monster of its findings last Friday, Aug. 17, both the security company and Monster have said. Evidence of the Gpcoder.e seeding -- using phony Monster messages touting a nonexistent tool -- goes back at least as far as early July, according to analysis by U.K.-based security company Prevx Ltd. It may have started days or even weeks before that. Some reports, in fact, have claimed users started seeing phishing mail built atop the stolen personal information as early as February of this year. What can Monster users do to protect themselves? For the 1.3 million whose resumes have been pillaged, it's too late; the horse has left the barn. Even so, some users decided to cancel their accounts as a way to block any future malware-based searches. "I can still search for jobs and submit my resume to postings, but employers/recruiters cannot find me in their searches," said a Chicago user identified as "Greg" in a comment on a Computerworld story that ran Thursday. "I certainly would encourage others to protect themselves and delete their Monster accounts as well." Monster hasn't disabled batch or automated searches, or if it has, it's not said as much. (On Sunday, company spokesman Steve Sylven seemed to say that because large corporate customers of the service used automated searches, banning them would be out of the question.) It has, however, shut down the server that the gang was using to store its stolen data and presumably disabled the legitimate accounts used to access the database. (Symantec's Hidalgo said last week that his team had forwarded those accounts to Monster.) We say "presumably" because while we have asked Monster if those accounts have been closed, the company has not explicitly acknowledged doing so. Other than that, the only advice being given by Monster or Symantec is the usual: Be suspicious of all unsolicited, unanticipated e-mail, run up-to-date antivirus software -- to stop Trojans such as Banker.c or Gpcoder.e at the door -- and refuse to give out personal information.

The search and advertising company is a force to be reckoned with across the Web. Now it's looking to do the same in alternative energy (along with many others, large and small).

Critical vulnerabilities in common PC software, including both applications and operating systems, continue to grow in number and stand as the leading cause for concern in the IT security landscape today, according to training experts at the SANS Institute.Holes in so-called client-side applications, including Web browsers, e-mail clients, productivity suites, and media players, have become particularly worrisome over the last year, according to SANS, which highlighted the issue as part of its annual report on the top 20 Internet security risks for 2007.As hackers have shifted their attention further away from operating system flaws and drilled down to applications-layer vulnerabilities they have found a seemingly endless wealth of possibilities for infecting PCs with everything from spyware to botnet programs, SANS researchers contend.Unless something can be done to improve software developers' coding habits or better test popular applications for such issues before they land on end-users' machines, attackers will be able to continue their successful assaults against enterprise networks and devices for the foreseeable future, said Rohit Dhamankar, project manager for the Top 20 report at SANS and a senior manager of security research for TippingPoint.?"There's just been such a dramatic rise in the numbers of vulnerabilities found in applications like Internet Explorer and Microsoft Office and a number of media players that attackers are having their way," said Dhamankar. "Enterprises are bolstering security, but desktop users still pose a massive risk if they can download anything they want from the Web; the attacks are also growing in sophistication to the extent that many can defeat antivirus and other security systems primarily by obfuscating their code."Some of the most powerful tools that hackers have adopted in hunting for potential targets are the same industrial-strength applications fuzzing tools that software vendors themselves are using to search for holes in their products, said the expert.Enterprises could do themselves a favor by enforcing stricter policies that dictate the types of applications that end-users are allowed to put on their work machines and using technical means to ensure that those rules are being followed, Dhamankar said.Other SANS researchers noted that while companies may not want to tell end-users that they cannot utilize media players, messaging clients, and other applications that have moved into the business world from the consumer sector, they could help themselves out by limiting the variety of client-side applications that people may choose from."IT departments can't focus on all the applications of the world, but they can choose several and keep their eye on those while allowing end-users some freedom," said Amol Sarwate, research manager at Qualys who studies vulnerability patterns for SANS. "What companies need to do is enforce standards for applications usage and utilize technical means to block unwanted software, devices, and even wireless access points."While many businesses have already realized that they need to shift more of their efforts toward defending client-side vulnerabilities, most have failed to embrace a proactive approach versus simply keeping track of publicly-reported flaws and patching those issues said Sarwate.Enterprises need to think about future security issues It will be particularly important for firms to examine the additional security issues that will be introduced in the coming years with broader adoption of technologies including VoIP (Voice over IP), according to the expert."The key is for people to start thinking ahead of these client-side vulnerabilities to understand what the next big thing may be. Things like VoIP need to be examined for their security implications," said Sarwate. "Many companies are already adopting these tools because of all the advantages they offer, but there will be many attacks carried out against these systems as well."Among the advice that SANS is offering organizations hoping to improve their client-side security coverage is to mandate secure configurations at installation time for all applications, to constantly verify patching and upgrading of both applications and system software, to scan for new vulnerabilities frequently, and to keep their security systems up to date.Other leading areas of concern highlighted by SANS in its report included critical vulnerabilities in Web applications that allow for cross-site scripting attacks or for computers to be otherwise compromised simply by pointing their browsers at poisoned URLs."Gullible, busy, accommodating computer users," including executives, IT staff, and others with privileged access also remain a major weak point for enterprise security, according to SANS, as these seemingly more seasoned users of computers and software are still falling for increasingly targeted spear-phishing campaigns in large numbers.One of the best ways to educate users about the problem is for organizations to create fake spear-phishing threats and send them out to internal users to determine which individuals might be most likely to fall for the schemes and follow up with additional training, the group said.Critical vulnerabilities in the software and systems that provide the operating environment and primary services to computer users, or server-side software, remain another area of leading concern, according to SANS.Problems in Microsoft Windows services, Unix and Mac OS services, back-up and AV programs, management servers, database software, and VoIP technologies in particular are proving troublesome, according to the report.Many of those issues can be addressed by following the same advice offered for solving client-side vulnerabilities, SANS said in the research.

Google launched a location service for mobile users on Wednesday that doesn't rely on GPS.Google Maps with My Location, currently in beta, locates users who don't have GPS-enabled phones based on their location to nearby cell towers. The result isn't as accurate as GPS but works for people who lack the positioning technology in their phones."It helps users speed up search by showing the general neighborhood they're in," said Steve Lee, product manager at Google for the service. Without the location service, users must type in their address or neighborhood in order to find nearby businesses using Google Maps.Google Maps with My Location will use GPS data to locate the user if the phone has the capability. But even for users of GPS-enabled phones, the cell location service might be useful, Lee said. That's because the cell tower feature works better indoors than GPS, it doesn't drain the phone battery as quickly and can bring up a result quicker, he said.The service could be useful to a person who might be traveling in an unfamiliar city and looking for restaurants or other businesses. A user pulls up Google Maps and hits the zero key on the phone. A blue dot will appear on the map in the user's location. If the service used GPS in the phone, the blue dot will be solid. If the service used cell towers to determine the location, the blue dot will have a halo around it, indicating that the location isn't precise. The user can then search for nearby businesses.Google says the cell tower technique will locate the user within about 1000 meters. It doesn't use triangulation, which calculates a user location based on the user's distance to three nearby towers. Instead, it essentially shows the range of the tower that the user's phone is connecting to.But the accuracy should improve as more people use the service, Lee said. That's because Google is keeping a database of location queries, minus any personal information like individual phone numbers or names. That will allow Google to learn more precise information about the range of each tower so that it can deliver a more accurate location area to users. The coverage area of cell towers can vary from about a quarter of a mile to several miles based on whether the tower is in an urban or rural area.For now, Google Maps with My Location doesn't feature any advertising, but it could in the future. "This product makes a lot of sense for advertising," Lee said.In order to use the service, phone owners must download a free application from Google. The application will work on BlackBerry, Windows Mobile, and Symbian phones as well as many phones that support Java. A few notable exceptions include the Samsung Blackjack, Moto Q, and Palm Treo 700W, which don't support the APIs Google requires to find cell towers, Lee said.

IBM is suing Shentech for selling laptop batteries that catch fire and sport allegedly fake IBM logos.The suit, filed Nov. 20 in the U.S. District Court for the Northern District of Ohio, accuses Shentech of trademark infringement, false advertising, unfair competition, and deceptive trade practices.IBM says that a consumer in Ohio bought a battery from Shentech for a ThinkPad laptop. The battery overheated and caught fire, causing damage to the laptop, IBM said. The user reported the problem to Lenovo, which licenses the IBM trademark. After examining the faulty battery, IBM discovered that it was not a genuine IBM battery, the company said in the suit.IBM then ordered 12 batteries from Shentech and found them all to be fakes, IBM said.IBM asks the court to require Shentech to turn over all of the batteries so that IBM can destroy them. IBM also asks for all the profits that Shentech earned from the sale of the batteries. In addition, IBM wants treble damages or $1 million per counterfeit mark per type of item sold.The Shentech.com Web site continues to list ThinkPad batteries for sale as well as a host of other electronic devices and components. Shentech appears to be a Web-only operation with a mailing address in Flushing, New York. It describes its secret to success as its "ability to provide cutting edge computer technology parts at bargain prices."No one from Shentech could be reached immediately for comment.

U.S. employers may have noticed a slight spike in productivity Wednesday as a computer glitch blocked access to online reviews site Yelp.com.The outage lasted from around 9 a.m to 11 a.m. Pacific Time, and blocked visitors from some companies, including Bank Of America, Kaiser Permanente, and Visa, according to posters at Yelp's discussion forums. Access at IDG's West Coast offices was also blocked.Yelp is a popular source of user-generated restaurant, entertainment, and business reviews in the Bay Area, and some companies have blocked access to the site to prevent employees from reading and contributing reviews during office hours.The glitch didn't shut down the Web site, but many visitors to the site were greeted with a "403" error telling users that they did not have permission to access the server. This type of error is returned by Web servers when someone tries to visit a restricted area of the site.Yelp wouldn't explain exactly what went wrong, except to say that it was a glitch caused by an update to the Web site that was pushed out Tuesday night. Most Yelp users had no problem visiting the site Wednesday, said Yelp spokeswoman Stephanie Ichinose. "It was a very narrow isolated incident that's now been rectified."That probably comes as welcome news to some.Yelpers were at first worried that their companies had moved to block access to the popular service. "Seems like a lot of filters at work added yelp to their list of blocked sites now," wrote one poster named Euge l. "I've heard of a handful of daily day time posters in the west coast have been blocked as well as the east coast. Is this the end of day time yelp?"

Using botnets to plant links and nurture zombie farms Miscreants have set out to poison search results with links to malware infested sites via a new campaign.…

 Related Pages

http://www.bluefirerecruitment.co.uk
Who supply:
uk overseas employment jobs

http://www.employersjobs.com
Who supply:
job search websites

http://www.employersjobs.com
Who supply:
job search sites

http://www.theblossomstudio.com
Who supply:
uk wedding web site design

http://www.employersjobs.com
Who supply:
job search engines