Resumes by Email While Hiring for the Summer

Dozens of attachments a day

A tour operator posts summer jobs with the office email address, and applications start that afternoon. Within a week there are dozens a day, nearly all with attachments.

The person hiring opens each one. Most are resumes. A few are zip files, one is named resume.pdf but shows a program's icon, and one asks to enable content before it will display.

Those few are not applications. They are malware dressed as applications, sent to the person most likely to open them.

Why job ads attract malware

A job ad publishes an email address and an invitation to send files to it. Whoever reads that inbox has been told to expect attachments from strangers, and to open them.

Attackers know this. A message saying please find my resume attached looks like every genuine application, and seasonal hiring happens at predictable times.

Small businesses make attractive targets because the person hiring often keeps the books too, on the same computer that logs in to the bank.

Attachments that are not what they seem

The dangerous attachments tend to take a few familiar forms:

• Zip files holding a program instead of a document.
• Disguised endings such as resume.pdf.exe, shown as resume.pdf because Windows hides known endings.
• Word files asking to enable content, which lets hidden code run.
• Links to download a resume from a file-sharing site instead of an attachment.
• Password-protected zip files, which security software cannot look inside.
• Screensaver files with a document's icon, which are programs too.

The second fools careful people. With file endings hidden, the name looks right, and only the icon or the file type gives it away.

A form instead of an address

An application form on your own website changes what can arrive. It asks for a name, contact details, the position and availability, and accepts one file of a type you choose.

Limit the file to PDF and Word documents under a modest size. Zip files, programs and screensavers are then refused before they reach anyone.

The form sends the hiring manager a short notice, not the file. The resume waits on the server until someone with a login opens it.

What the server has to check

A check made only in the visitor's browser can be bypassed, so the server must check every upload itself: the file's ending, what it actually contains, and its size.

It should rename each upload and store it outside the public part of the site, where it cannot be opened by typing its address or run as a program.

These are jobs for whoever builds the form. A form that checks only a file's name, or stores uploads in a public folder, solves one problem and creates another.

A worked example

A commercial dive company hires dive tenders and deckhands each spring for its busiest season of marine construction and inspection work.

Its job ads listed the office email address. The office manager, who also runs payroll, opened every attachment on the office computer, and one week found two zip files and a document asking to enable content.

The company added an application form to its careers page. It asks for availability dates, certifications and experience in short text fields, and accepts an optional resume as a PDF or Word file.

Uploads are checked on the server, renamed and kept outside the public folders. The office manager gets a notice and reads applications on a password-protected page.

The ads now point to the form instead of listing an address. Attachments that still arrive by email get a polite reply pointing to the form and are deleted unopened.

Most of what matters for a tender's job fits in the text fields, so many applications carry no file at all, and the payroll computer no longer opens strangers' attachments.

Attachments that still arrive

Some applicants will email anyway, and some ads get copied to boards you never chose. Treat those attachments as untrusted.

Never open zip files or programs from applicants. Turn on file endings in Windows so disguised names show, and open Word files in Protected View without enabling content.

Keep Windows, Office and security software updated on the computer that opens them. A computer still on Windows XP, which stopped getting security updates on April 8, should not be that computer.

A separate address for hiring

If an email address must appear in a job ad, make it one used only for hiring, read on a computer that holds nothing else of value.

A separate webmail account lets attachments be previewed without downloading them, and it keeps the payroll and banking computer out of the hiring altogether.

When the season's hiring ends, retire the address or point it at the form, so next year's ads start clean.

Where the resumes are kept

Resumes are full of personal details: addresses, phone numbers and work histories. Keep them in one place that only the people hiring can reach.

Decide how long to keep applications once the season's hiring is done, and delete the rest. An old folder of resumes is of use to nobody except whoever finds it.

The counter-case

A firm hiring one person a year, through referrals, may never see a malicious attachment. A job board that collects and screens applications itself takes much of the risk away too.

Even so, the rules for opening attachments apply to every inbox, and any business that advertises an address for resumes is inviting files from strangers.

For a seasonal business that hires a crew every spring, a form built once and reused each year is the safer habit.

Moving applications onto the site

1. Add an application form to the careers page.
2. Accept PDF and Word files only, under a size limit.
3. Check uploads on the server, not only in the browser.
4. Store resumes outside the public folders.
5. Point every job ad to the form.
6. Show file endings on every office computer.
7. Delete applications once the season's hiring is done.

Step three is where forms most often fall short. A check in the browser looks the same to an honest applicant, but only the server's check stops a file renamed on purpose.

Why a file behind a login can still open for anyone who has its address, and how to test for it, are both covered by a dealer price list anyone can open, from January.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.