LinkedIn profiles at hijack risk

A security researcher based in India has claimed that vulnerabilities in how cookies were handled on LinkedIn profiles laid user profiles at risk of tampering.

Rishi Narang, a former senior consultant for financial service firm Deloitte and Touche said accounts could be hijacked for up to a year by intercepting cookies that tracked user sessions.

An attacker could keep accessing to an account on the site despite a password reset because cookies were still valid after the change.

Cookies were vulnerable to man-in-the-middle-attacks because the website reverted to hypertext transfer protocol after users logged in through its secure cousin, HTTPS.

LinkedIn would not detect alterations to information in cookies that kept sessions valid, Narang wrote on his blog. 

“In just 15 minutes, I was successfully able to access multiple active accounts that belong to individuals from different global locations".

He said users could log in "many times in these months but their cookie was still valid”.

“An attacker can sniff the cookies from [a] clear-text session and then use it to authenticate [their] own session," he wrote.

"He can then compromise and modify the information available at the user profile page.

“Even if the domain which issued the cookie does not host any content that is accessed over HTTP, an attacker may be able to use links of the form https://www.linkedin.com to perform the same attack.”

LinkedIn said it was evaluating the implementation of opt-in HTTPS support for parts of its website.

“Whether you are on LinkedIn or any other site, it’s always a good idea to choose trusted and encrypted wifi networks or [virtual private networks] whenever possible," the company said in a statement.

"LinkedIn takes the privacy and security of our members seriously, so we currently support [secure sockets layer] for logins and other sensitive web pages. In addition, we are evaluating opt-in SSL support for other parts of the site and expect those to be available in the coming months.” 

Cookie monsters

The session ID cookie (JSESSIONID) remained unchanged after a user logs in.

Another cookie (leo_auth_token) had the user ID, a Unix timestamp that decided the expiry of the cookie, and a hexadecimal string.

Narang said users should set a secure flag in cookies to prevent transmission over unsecured HTTP.

To prevent an attack, users must disable their accounts and lose all contacts. This alters the leo_auth_token cookie, and revokes the previous version.

Copyright © SC Magazine, Australia