Changing Your LinkedIn Password Still May Not Have Kept Your Account Safe • Hacker News Board

Re: Changing Your LinkedIn Password Still May Not Have Kept Your Account Safe

#21

Post by tedunangst » Sat, Jun 23, 2012, 9:30 PM UTC

btilly wrote: post #17

I suspect that it is much worse than that. The fact that the mobile app can still access LinkedIn means that there is an authentication back door that it uses. What does that back door look like? Clearly it does not care about your password. If someone studies the mobile app and figures out how it does this authentication trick, then we'll know the damage. Is there a universal authentication where you just need to kn…

I suspect that back door is a browser cookie. Tons of sites don't deauth old cookies on password change. Hacker News being one of them. Why doesn't anybody freak out over the HN backdoor?

Re: Changing Your LinkedIn Password Still May Not Have Kept Your Account Safe

#22

Post by elangoc » Sat, Jun 23, 2012, 10:24 PM UTC

hackinthebochs wrote: post #14

elangoc wrote: post #13

I'm fairly certain that LinkedIn has little or no regard for user privacy and security. Why do I say this? Even as early as 2007, I noticed that LinkedIn displayed 3 rotating links to people I might be 'interested' in connecting with. And among names of people I knew well, one or two names repeatedly popped up that were vaguely familiar, but they were neither friends nor friends of friends (as far as I knew). Then it…

It seems more likely that the person on the other end of the conversation simply did the "import gmail contacts" option, and during this process they noticed the correspondence between you and him. Then when you changed your email for linkedin that connection was broken.

Although that might seem like a likely explanation, LinkedIn wasn't putting the "import email contacts" widget in your face like they do, now.

Of the two people I vividly remember as only vaguely familiar suggested people, neither was in my Gmail address book. I had a 2-sent-emails thread with one person, and no direct emails with the other. In 2007, Gmail might have already been auto-collecting contact info of people you email directly, but that can't explain the 2nd person.

Re: Changing Your LinkedIn Password Still May Not Have Kept Your Account Safe

#23

Post by th » Sat, Jun 23, 2012, 10:29 PM UTC

As mentioned in other comments in this thread, LinkedIn's tech team frequently disregards security standards.

I found a CSRF attack on LinkedIn by accident when searching in Duck Duck Go some months back. I clicked a link in my search results and was presented with a page thanking me for signing up for some LinkedIn group. I then received an email thanking me for joining the group as well.

LinkedIn was joining a group whenever an authenticated user performed a GET request to a particular URL in their browser. I followed this up by searching Google for other URLs that suffered from the same problem and found many. I wrote an exploit (very easy for that issue) and contacted LinkedIn. They have fixed the issue by now but it took more than 6 months.

Re: Changing Your LinkedIn Password Still May Not Have Kept Your Account Safe

#24

Post by elangoc » Sat, Jun 23, 2012, 10:39 PM UTC

tedunangst wrote: post #20

hackinthebochs wrote: post #14

Earlier quoted context omitted.

It seems more likely that the person on the other end of the conversation simply did the "import gmail contacts" option, and during this process they noticed the correspondence between you and him. Then when you changed your email for linkedin that connection was broken.

Exactly. All of these "there's no way anyone could have known that" stories ignore the fact that there is another person who could have known and provided that info.

That's a good point. I'll keep that in mind.

I'm still hesitant to feel like it explains everything -- in 2007, LinkedIn still didn't seem that ubiquitous (after all, FB was then just opening itself up to non-college students, and LinkedIn's target demog. was still the pre-internet generation). So there weren't a whole lot of people I knew on the site to begin with, and there wasn't anybody I knew in common on LinkedIn connecting me to at least 2 of the vaguely familiar people I knew. And those 2 people started getting suggested to me by the site at the same time -- it seems too coincidental that these people (and others) provided their email contacts to LinkedIn at exactly the same time.

One good takeaway is, despite it taking me 5 more years to learn my lesson, and the really hard way :-(, I'm now using KeePass and creating difficult, unique passwords for each site, and using git to sync across computers. That helps.

Re: Changing Your LinkedIn Password Still May Not Have Kept Your Account Safe

#25

Post by btilly » Sat, Jun 23, 2012, 10:44 PM UTC

tedunangst wrote: post #21

btilly wrote: post #17

I suspect that it is much worse than that. The fact that the mobile app can still access LinkedIn means that there is an authentication back door that it uses. What does that back door look like? Clearly it does not care about your password. If someone studies the mobile app and figures out how it does this authentication trick, then we'll know the damage. Is there a universal authentication where you just need to kn…

I suspect that back door is a browser cookie. Tons of sites don't deauth old cookies on password change. Hacker News being one of them. Why doesn't anybody freak out over the HN backdoor?

Then capture that cookie over the wire, and voila you are in.