CRN
  • Home
  • News
  • Security

LinkedIn profiles at hijack risk

By Darren Pauli on May 24, 2011 3:55PM
LinkedIn profiles at hijack risk

In The Spotlight

Introducing the CRN State of the MSP report

IoT Explained: What is the Internet of Things in Australia (June 2022)

Come to CRN's CyberSecurity Live Event!

See who was at Channel Meets: UC in Sydney

A security researcher based in India has claimed that vulnerabilities in how cookies were handled on LinkedIn profiles laid user profiles at risk of tampering.

Rishi Narang, a former senior consultant for financial service firm Deloitte and Touche said accounts could be hijacked for up to a year by intercepting cookies that tracked user sessions.

An attacker could keep accessing to an account on the site despite a password reset because cookies were still valid after the change.

Cookies were vulnerable to man-in-the-middle-attacks because the website reverted to hypertext transfer protocol after users logged in through its secure cousin, HTTPS.

LinkedIn would not detect alterations to information in cookies that kept sessions valid, Narang wrote on his blog. 

“In just 15 minutes, I was successfully able to access multiple active accounts that belong to individuals from different global locations".

He said users could log in "many times in these months but their cookie was still valid”.

“An attacker can sniff the cookies from [a] clear-text session and then use it to authenticate [their] own session," he wrote.

"He can then compromise and modify the information available at the user profile page.

“Even if the domain which issued the cookie does not host any content that is accessed over HTTP, an attacker may be able to use links of the form https://www.linkedin.com to perform the same attack.”

LinkedIn said it was evaluating the implementation of opt-in HTTPS support for parts of its website.

“Whether you are on LinkedIn or any other site, it’s always a good idea to choose trusted and encrypted wifi networks or [virtual private networks] whenever possible," the company said in a statement.

"LinkedIn takes the privacy and security of our members seriously, so we currently support [secure sockets layer] for logins and other sensitive web pages. In addition, we are evaluating opt-in SSL support for other parts of the site and expect those to be available in the coming months.” 

Cookie monsters

The session ID cookie (JSESSIONID) remained unchanged after a user logs in.

Another cookie (leo_auth_token) had the user ID, a Unix timestamp that decided the expiry of the cookie, and a hexadecimal string.

Narang said users should set a secure flag in cookies to prevent transmission over unsecured HTTP.

To prevent an attack, users must disable their accounts and lose all contacts. This alters the leo_auth_token cookie, and revokes the previous version.

Got a news tip for our journalists? Share it with us anonymously here.

Copyright © SC Magazine, Australia

Tags:
authentication cookies linkedin security vulnerability

Partner Content

Is business nbn Enterprise Ethernet the future of business connectivity for MSPs?
Promoted Content
Is business nbn Enterprise Ethernet the future of business connectivity for MSPs?
Why rock-solid MSPs services require unified infrastructure monitoring
Promoted Content
Why rock-solid MSPs services require unified infrastructure monitoring
Tradewinds has turned unified communications into an easier upsell
Promoted Content
Tradewinds has turned unified communications into an easier upsell
How to prepare for the increasing demand for cloud-ready partners
Promoted Content
How to prepare for the increasing demand for cloud-ready partners
Microsoft, Yealink and Alloy’s roadshows fire up the Australian channel
Promoted Content
Microsoft, Yealink and Alloy’s roadshows fire up the Australian channel

Sponsored Whitepapers

How vulnerability scans identify & protect against cyberthreats before criminals locate them
How vulnerability scans identify & protect against cyberthreats before criminals locate them
Monitoring & automation: A primer for MSPs
Monitoring & automation: A primer for MSPs
Endpoint Detection and Response
Endpoint Detection and Response
How to put your infrastructure into overdrive
How to put your infrastructure into overdrive
MSPs: Stack your solutions
MSPs: Stack your solutions
By Darren Pauli
May 24 2011
3:55PM
0 Comments

Related Articles

  • Don't miss Australia’s premiere IoT Conference on 9th June
  • 5 essential digital transformation ideas
  • Top 5 Benefits of Managed IT Services
  • Nation-state, ransomware groups using Log4j flaw
Share on Twitter Share on Facebook Share on LinkedIn Share on Whatsapp Email A Friend

Most Read Articles

State of the MSP

State of the MSP

Minister's office was warned of concerns about Entrepreneurs Program

Minister's office was warned of concerns about Entrepreneurs Program

Broadcom to invest in VMware partners, sales, engineers

Broadcom to invest in VMware partners, sales, engineers

Atturra acquires MOQ Limited for $15.5 million

Atturra acquires MOQ Limited for $15.5 million

All rights reserved. This material may not be published, broadcast, rewritten or redistributed in any form without prior authorisation.
Your use of this website constitutes acceptance of nextmedia's Privacy Policy and Terms & Conditions.