LinkedIn profiles at hijack risk

Powered by SC Magazine
 

Even changing your password won't protect you.

Vulnerabilities in how cookies were handled on LinkedIn profiles laid user profiles at risk of tampering, a security researcher said.

Rishi Narang, a former senior consultant for financial service firm Deloitte and Touche said accounts could be hijacked for up to a year by intercepting cookies that tracked user sessions.

An attacker could keep accessing an account on the site despite a password reset because cookies were still valid after the change.

Cookies were vulnerable to man-in-the-middle-attacks because the website reverted to hypertext transfer protocol after users logged in through its secure cousin, HTTPS.

LinkedIn would not detect alterations to information in cookies that kept sessions valid, Narang wrote on his blog:  “In just 15 minutes, I was successfully able to access multiple active accounts that belong to individuals from different global locations".

He said users could log in "many times in these months but their cookie was still valid”.

“An attacker can sniff the cookies from [a] clear-text session and then use it to authenticate [their] own session," he wrote.

"He can then compromise and modify the information available at the user profile page.

“Even if the domain which issued the cookie does not host any content that is accessed over HTTP, an attacker may be able to use links of the form https://www.linkedin.com to perform the same attack.”

LinkedIn said it was evaluating the implementation of opt-in HTTPS support for parts of its website.

“Whether you are on LinkedIn or any other site, it’s always a good idea to choose trusted and encrypted wifi networks or [virtual private networks] whenever possible," the company said in a statement.

"LinkedIn takes the privacy and security of our members seriously, so we currently support [secure sockets layer] for logins and other sensitive web pages. In addition, we are evaluating opt-in SSL support for other parts of the site and expect those to be available in the coming months.” 

Cookie monsters

The session ID cookie (JSESSIONID) remained unchanged after a user logs in.

Another cookie (leo_auth_token) had the user ID, a Unix timestamp that decided the expiry of the cookie, and a hexdecimal string.

Narang said users should set a secure flag in cookies to prevent transmission over unsecured HTTP.

To prevent an attack, users must disable their accounts and lose all contacts. This alters the leo_auth_token cookie, and revoked the previous version.

It was the second bit of bad news in a week for the No.1 professional social-networking site, which listed on the New York Stock Exchange at $US8.79 billion ($A8.28 billion) or $45 a share before racing on its first day to $122 a share, indicating financial advisers underestimated demand for the hot stock.

Copyright © SC Magazine, Australia


LinkedIn profiles at hijack risk
A critical security vulnerability accompanied bad news that LinkedIn's financial advisers left money on the table during its highly publicised share float last week.
 
 
 
Top Stories
NSW Govt gets ready to throw out the floppy disks
[Opinion] Dominic Perrottet says its time for government to catch up.
 
iiNet facing new copyright battle with Hollywood
Fighting to protect customer details.
 
The CISO’s dilemma: Do you trust your partner’s partner?
[Blog post] How far down the chain do you check?
 
 
A critical security vulnerability accompanied bad news that LinkedIn's financial advisers left money on the table during its highly publicised share float last week.
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
In which area is your IT shop hiring the most staff?




   |   View results
IT security and risk
  25%
 
Sourcing and strategy
  12%
 
IT infrastructure (servers, storage, networking)
  22%
 
End user computing (desktops, mobiles, apps)
  15%
 
Software development
  26%
TOTAL VOTES: 310

Vote
Would your InfoSec team be prepared to share threat data with the Australian Government?

   |   View results
Yes
  58%
 
No
  42%
TOTAL VOTES: 118

Vote