LinkedIn profiles at hijack risk

Powered by SC Magazine
 

Even changing your password won't protect you.

Vulnerabilities in how cookies were handled on LinkedIn profiles laid user profiles at risk of tampering, a security researcher said.

Rishi Narang, a former senior consultant for financial service firm Deloitte and Touche said accounts could be hijacked for up to a year by intercepting cookies that tracked user sessions.

An attacker could keep accessing an account on the site despite a password reset because cookies were still valid after the change.

Cookies were vulnerable to man-in-the-middle-attacks because the website reverted to hypertext transfer protocol after users logged in through its secure cousin, HTTPS.

LinkedIn would not detect alterations to information in cookies that kept sessions valid, Narang wrote on his blog:  “In just 15 minutes, I was successfully able to access multiple active accounts that belong to individuals from different global locations".

He said users could log in "many times in these months but their cookie was still valid”.

“An attacker can sniff the cookies from [a] clear-text session and then use it to authenticate [their] own session," he wrote.

"He can then compromise and modify the information available at the user profile page.

“Even if the domain which issued the cookie does not host any content that is accessed over HTTP, an attacker may be able to use links of the form https://www.linkedin.com to perform the same attack.”

LinkedIn said it was evaluating the implementation of opt-in HTTPS support for parts of its website.

“Whether you are on LinkedIn or any other site, it’s always a good idea to choose trusted and encrypted wifi networks or [virtual private networks] whenever possible," the company said in a statement.

"LinkedIn takes the privacy and security of our members seriously, so we currently support [secure sockets layer] for logins and other sensitive web pages. In addition, we are evaluating opt-in SSL support for other parts of the site and expect those to be available in the coming months.” 

Cookie monsters

The session ID cookie (JSESSIONID) remained unchanged after a user logs in.

Another cookie (leo_auth_token) had the user ID, a Unix timestamp that decided the expiry of the cookie, and a hexdecimal string.

Narang said users should set a secure flag in cookies to prevent transmission over unsecured HTTP.

To prevent an attack, users must disable their accounts and lose all contacts. This alters the leo_auth_token cookie, and revoked the previous version.

It was the second bit of bad news in a week for the No.1 professional social-networking site, which listed on the New York Stock Exchange at $US8.79 billion ($A8.28 billion) or $45 a share before racing on its first day to $122 a share, indicating financial advisers underestimated demand for the hot stock.

Copyright © SC Magazine, Australia


LinkedIn profiles at hijack risk
A critical security vulnerability accompanied bad news that LinkedIn's financial advisers left money on the table during its highly publicised share float last week.
 
 
 
Top Stories
ANZ looks to life beyond the transaction
If digital disruptors think an online payments startup could rock the big four, they’ve missed the point of why people use banks, says Patrick Maes.
 
What InfoSec can learn from the insurance industry
[Blog post] Another way data breach laws could help manage risk.
 
A ten-point plan for disrupting security
[Blog post] How can you defend the perimeter when it’s in the cloud?
 
 
A critical security vulnerability accompanied bad news that LinkedIn's financial advisers left money on the table during its highly publicised share float last week.
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
What is delaying adoption of public cloud in your organisation?







   |   View results
Lock-in concerns
  29%
 
Application integration concerns
  3%
 
Security and compliance concerns
  27%
 
Unreliable network infrastructure
  9%
 
Data sovereignty concerns
  21%
 
Lack of stakeholder support
  3%
 
Protecting on-premise IT jobs
  4%
 
Difficulty transitioning CapEx budget into OpEx
  3%
TOTAL VOTES: 1029

Vote