Slashdot Mirror
Researcher Hijacks LinkedIn Profiles Using Cookie
mask.of.sanity writes "A security researcher has demonstrated holes in the way cookies are handled on LinkedIn profiles by hijacking profiles. The session cookies are sent over unsecured HTTP and remain active for up to a year."
"The session cookies are sent over unsecured HTTP" Isn't this basically the same as the way the firefox addon firesheep worked?
Meh. Most session cookies are sent over unsecured HTTP. The only reason this is coming up is the linkedin IPO.
-- IANAL, this isn't legal advice, and definitely isn't legal advice for you. Also, Squee!
It's the week of internet security breach articles!
A bit off topic but I noticed Facebook seems to have made everyone HTTP and not HTTPS by default now. Check your own. I had to go in and change my settings after a mate pointed it out that its now the norm. Can anyone tell me why HTTPS is not now the default standard? Given that a lot of data is now going via unsecured public wifi hotspots it seems like its only a matter of time before it becomes a commonly used hack.
BULLETIN: Guy leaves keys in running, unlocked card - gets stolen. News at 11.
About a month ago my mom was asking me why she was able to add connections to MY LinkedIn profile. Obviously I'd logged in once on her computer and the cookie had been active ever since.
I'd have less of a concern with it if the cookies didn't last so FUCKING long. In fact... you should only have one active login session at a time, unless they want to create the notion of a "trusted" computer whose login cookie lasts forever. But if I don't click "remember me on this computer", having the login cookie persist for long periods of time is just dumb.
I prefer: Manufacturer sells key-less cars, get stolen from customers. News at 6.
Next IPO, breedersr.us, a social media darling to compare and comment on cock sizes.
(to the rhythm of Burma Shave)
I have no skills
I have no friends
I don't have much on LinkedIn
Haven't compared
Epic Fail
Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
No profit that I can think of. Granted, 13-year-olds don't need a profit motive to deface a rivals Facebook page. But in my adult world, I don't see the attraction to the risk/reward equation of a LinkedIn hijacking.
1. hijack a LinkedIn account
2. change the account information
3. ????
4. profit
Bullshit.
Networking is the number 1 way to get employment. You skills only dictate the level of employment you get, and advancement.
LinkedIn is just a way to network. It's another tool. The fact is, LinkedIn has a business plan, and a way to make money; which is a hell of a lot different then the boom in the late 90s. Which was 'Sell at a loss, make up for it in volume'
LinkedIn is becoming one of the first places people check when they are thinking of hiring you.
The Kruger Dunning explains most post on
They can't even be configured to send non-HTMLized update emails anymore.
I told the stupid bastards over a year ago the whole site should be protected by SSL, not just the signon. To have that kind of personal information floating around the net is unacceptable. The guy in customer service just gave me a blank stare via email. I haven't been back to the site since. Not surprised to read this today in slashdot.
Have a nice day, you dopes! Get a clue and come back when you know how to run a secure website!
OHHHH NOO not my linked in account.. what ever will I do? Man I hate that site!
No, skill is the number one way to get employment. Level/advancement is part of getting employment - unless you're being obtuse and counting anything whatever which pays (and no-one at McDonalds reads your LinkedIn profile).
If you do cool things in your field, you will gain a reputation which will put you in demand. If are not already heard of, you can show what you have done. Publish first, publish/perish, etc. Your CV will list your qualifications and provide pointers to any portfolio.
The number 2 way is networking, which has some value in terms of trusting personal recommendations but is mainly just humans demonstrating the usual primate social behaviour and favouring their group for its own sake.
And number 3 is poor substitutes for networking such as LinkedIn. So, it's like I said in my initial post - which will be angrily modded down because everyone with a LinkedIn profile is embarrassed to be a number 3.
LinkedIn is becoming one of the first places people check when they are thinking of hiring you.
Maybe the people you work with. Anyone who uses such masturbatory nonsense to judge you (or the person you claim to be, or the person someone else claims to be you) is going to be a terrible employer. It's even worse than people who use your Facebook profiles to judge you, because at least there's the small chance that the Facebook profile wasn't simply engineered to get you a better job than you're cut out for.
LinkedIn is popular today because everyone's desperately seeking employment, perhaps preemptively. Desperation often results in irrational behaviour. The problem is that there's not enough work to go around because we're organised/sufficiently advanced such that we can get along just fine working fewer hours. We should be spreading the work around more evenly, not clamouring like whores for more pointless things to do. Go against a whole society's worth of divide-and-conquer indoctrination and consider a little less competition and a little more cooperation.
The /. site has the same problem as the one outlined in this story; so yeah I'd pretty much have to agree with that sentiment after having let them know a long time ago and still nothing has been done about it.
/. as in my opinion this is totally lame regardless, no site should function this way.
Glad I don't pay for a subscription - hopefully at least there they require another token besides the one set when logging in in order to get to order and cc info; or better yet they don't save CC info.
Even so, I rarely log in to
Did you ever wake up in the morning, with a Zombie Woof behind your eyes? -- FZ
I bet I can use cookies to hijack accounts too. "A free chocolate chip cookie if you log in to example.com on this professional, secure kiosk here and do XYZ."
Just set Firefox to delete all cookies when you exit. That's what I've done ever since I had the option.
No, they still check sites like Monster and Dice.
Don't tell me I'm wrong I just did a job search a month ago, every call was because they got my resume from Dice or Monster, not because they saw my LinkedIn profile.
But its not like some recruiters didn't ask to be added to my network, even though those recruiters didn't extend the job offer. They're still in the black hole, I've neither accepted them nor declined them.
LinkedIn's whole business model is upselling basic account users and also convincing them to add apps to their profile. Oh yeah, and convincing them to remain visible by hiding who has viewed their profile. I e-mailed them once when I had no apps in my profile after just creating it, and the next login, I had an app auto-added to my profile.
Now that I have a job, I'm thinking of getting rid of my LinkedIn profile. I guess I don't need to have hundreds of connections in my profile, I really don't need my profile at this time.
If you're still not happy with yourself, you use LinkedIn to compare cock size and actually check other people's profiles.
No. That's chatroulette.
Someone congratulate this n00b for uncovering something the rest of us have already known for years.