Slashdot Mirror


LinkedIn Sues 100 Individuals For Scraping User Data From the Site (betanews.com)

Mark Wilson, writing for BetaNews: Professional social network LinkedIn is suing 100 anonymous individuals for data scraping. It is hoped that a court order will be able to reveal the identities of those responsible for using bots to harvest user data from the site. The Microsoft-owned service takes pride in the relationship it has with its users and the security it offers their data. Its lawsuit seeks to use the data scrapers' IP addresses and then discover their true identity in order to take action against them. LinkedIn says that a botnet has been used to gain access to user data which is then passed on to third parties. The site has a number of measures in place to prevent this type of data harvesting, but it seems that scrapers have found a way to circumvent these security restrictions. A series of automated tools -- FUSE, Quicksand, Sentinel, and Org Block -- are used to monitor suspicious activity and blocking scraping.

23 of 112 comments (clear)

  1. LinkedIn Response in Summary by damn_registrars · · Score: 4, Funny

    "hey, data scraping is our gig"

    --
    Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
  2. Security my Ass by ketomax · · Score: 5, Interesting

    The Microsoft-owned service takes pride in the relationship it has with its users and the security it offers their data.

    Thanks to LinkedIn hackers are attempting to login to my accounts on sites like Steam, Facebook, eBay, Twitter, etc. Now, I know better and use different passwords for different sites. But, at least these sites have security in place to warn me of suspicious logins while denying the logins.

    1. Re:Security my Ass by ShaunC · · Score: 2

      The annoying thing is, I'm getting a lot of SASL authentication attempts from Microsoft Azure IPs against the email address I used for LinkedIn. Microsoft's LinkedIn service leaked my email address and an ancient password, and lots of Microsoft Azure cloud instances are now busy attempting to login to that email account.

      Aug 15 10:51:04 mail postfix/smtpd[12561]: connect from unknown[13.84.216.161]
      Aug 15 10:51:07 mail postfix/smtpd[12561]: warning: unknown[13.84.216.161]: SASL LOGIN authentication failed: authentication failure
      Aug 15 10:51:07 mail postfix/smtpd[12561]: lost connection after AUTH from unknown[13.84.216.161]
      Aug 15 10:51:07 mail postfix/smtpd[12561]: disconnect from unknown[13.84.216.161]
      Aug 15 10:51:07 mail postfix/smtpd[12561]: connect from unknown[13.84.216.161]
      Aug 15 10:51:09 mail postfix/smtpd[12561]: warning: unknown[13.84.216.161]: SASL LOGIN authentication failed: authentication failure
      Aug 15 10:51:09 mail postfix/smtpd[12561]: lost connection after AUTH from unknown[13.84.216.161]
      Aug 15 10:51:09 mail postfix/smtpd[12561]: disconnect from unknown[13.84.216.161]
      Aug 15 10:51:10 mail postfix/smtpd[12561]: connect from unknown[13.84.216.161]
      Aug 15 10:51:12 mail postfix/smtpd[12561]: warning: unknown[13.84.216.161]: SASL LOGIN authentication failed: authentication failure
      Aug 15 10:51:12 mail postfix/smtpd[12561]: lost connection after AUTH from unknown[13.84.216.161]
      Aug 15 10:51:12 mail postfix/smtpd[12561]: disconnect from unknown[13.84.216.161]
      Aug 15 10:51:12 mail postfix/smtpd[12561]: connect from unknown[13.84.216.161]

      Yadda yadda. I report them all to Microsoft's CERT but despite the "thank you" emails, I wind up getting attacked from the same IPs day in and day out.

      --
      Thanks to the War on Drugs, it's easier to buy meth than it is to buy cold medicine!
    2. Re: Security my Ass by MitchDev · · Score: 2

      Same with Passwords eh?

      See, Security requires a lack of convenience, you don't get both.

      If you use the same login ID and same password multiple places, especially in today's world, you are kind of inviting yourself to be hacked.

  3. So... by The-Ixian · · Score: 5, Informative

    You publish a public document then get mad when people use it for their own purposes.... brilliant.

    How about you just make user privacy a default so that anonymous users cannot see any information?

    You would then see which throw away accounts are being used to log in to see the data...

    --
    My eyes reflect the stars and a smile lights up my face.
    1. Re:So... by freeze128 · · Score: 3, Insightful

      I'll do you one better: Don't use LinkedIn.

    2. Re:So... by Gr8Apes · · Score: 3, Insightful

      Linked In is a public billboard. Treat it like that and this doesn't matter.

      --
      The cesspool just got a check and balance.
    3. Re:So... by JustAnotherOldGuy · · Score: 3, Insightful

      I'll do you one better: Don't use LinkedIn.

      That was my solution. So while everyone else is running around in hair-on-fire mode, my defensive plan is to have a sandwich and then take a nap.

      --
      Just cruising through this digital world at 33 1/3 rpm...
    4. Re:So... by thegarbz · · Score: 2

      I'll do you one better: Don't use LinkedIn.

      Yes please don't. We don't need more competition in the employment market as it is.

    5. Re:So... by The-Ixian · · Score: 2

      Simple. If you are an employer or recruiter, create an account. Once you are inside the gates, things are nice and open.

      I was simply suggesting that they not make this level of access available to anonymous users.

      If it turns out that a single account is crawling thousands of user's info... there you go, you have the user account responsible and can then do whatever internal correlations you need to do in order to determine who is scraping data.

      --
      My eyes reflect the stars and a smile lights up my face.
  4. Is data scraping illegal? by mwvdlee · · Score: 4, Interesting

    I know scanning the data from a yellow pages breaks copyright law, but using an army of typists to copy the same data from the same source is perfectly fine.
    How does scraping data from a website measure up, assuming all scraped data is available to visitors through normal means (i.e. not using security holes).
    At what point does using data from a website become "scraping" and at what point does it violate copyrights?

    --
    Slashdot social media options: AIM, ICQ, Yahoo, Jabber and Mobile Text. Why no MySpace?
    1. Re:Is data scraping illegal? by omnichad · · Score: 2

      When it's an automated tool (just like scanning from the yellow pages)

    2. Re:Is data scraping illegal? by Big+Hairy+Ian · · Score: 2

      Hmm Yellow pages doesn't require you to sign off on T's & C's before you use it

      --

      Build a Man a Fire, and He'll Be Warm for a Day. Set a Man on Fire, and He'll Be Warm for the Rest of His Life.

    3. Re:Is data scraping illegal? by pem · · Score: 2

      A compilation of names and phone numbers is not subject to copyright in the US. See, e.g. Feist

  5. It's Illegal activity, but LinkedIn went too far by omnichad · · Score: 2

    The charges are a bit trumped up and ridiculous. The illegal access by using a bot and breaking the legally binding user agreement is enough.

    Claiming that it's a violation of the DMCA (anti-circumvention) and CFAA to circumvent their blacklisting procedures is silly. Not being on a blacklist is not a thing you "circumvent" nor is it a different kind of illegal access than using the bot in the first place.

  6. Re:Crime? by omnichad · · Score: 3, Informative

    Yes. They're trying to turn a civil suit about a breach in contract into a criminal charge of anti-circumvention (DMCA) of their IP blacklist procedures and CFAA and criminal trespass for the access to the nearly public profiles that anyone with a free account can view.

  7. Botnet? by wcrowe · · Score: 3, Interesting

    So they're saying a botnet was used to gain access to the data, then passed on to third parties. Unless I'm mistaken, the IP addresses will be pointing to machines on the botnet, and the owners of those machines have no idea that is happening. It sounds like a lot of innocent people might get swept up in this.

    Also ironic that LinkedIn is owned by Microsoft, who is no doubt responsible for the operating systems running on all those bots on the aforementioned botnet.

    --
    Proverbs 21:19
  8. Re:Crime? by Big+Hairy+Ian · · Score: 2

    The account that the Botnet was using to scrape the data would have had to agree to the T's & C's

    --

    Build a Man a Fire, and He'll Be Warm for a Day. Set a Man on Fire, and He'll Be Warm for the Rest of His Life.

  9. Let's see... by MitchDev · · Score: 2, Funny

    Samples from the list of the 100 individuals being sued...

    I. P. Freely
    Mike Hunt
    Hassant bin Laid
    Prince Albert-in-a-can
    Anna und Elsa
    Bartman Simpson

    etc, etc, etc

  10. Re:Crime? by omnichad · · Score: 2

    They have a pretty standard severability clause - and those hold up in court just fine. If part of the contract is invalid / unenforceable, the rest still stands.

    IANAL, but I'd say "no bots / no scraping" is probably perfectly valid legally speaking.

  11. Passing user data on to 3rd parties. by thegarbz · · Score: 3, Interesting

    As a matter of interest, what is the point of LinkedIn if not to pass my user profile to as many people as possible?

    They should be hiring these bots, not taking action against them. The whole purpose of LinkedIn is a public advertisement for work. They like to pretend they are a "social network for business" but really all they are is a giant platform for classifieds, and within that purpose the bots are doing a great job.

  12. Scammers harvest LinkedIn for victims by AnalogDiehard · · Score: 4, Interesting

    I was a (brief) victim of a dating scam. After I got wise and cut them off, I wondered where how they profiled me. My "date" claimed she found me on a FB group but scammers hide their tricks. Googling a quick ego surf revealed that the only place any profile of mine shows up is LinkedIn, which I thought was private. Seeing that I got zero benefit from LinkedIn and I had no other profile stored anywhere, I promptly deleted my LinkedIn account.

    --
    Eternity: will that be smoking, or non-smoking? I Corinthians 6:9-10
  13. Bing scrapes Youtube by Anonymous Coward · · Score: 2, Informative

    Bing scrapes Youtube to index its contents. Bing is Microsoft owned.

    It makes zero difference what EULA terms you put on a public website since the scraper doesn't read or agree to those terms. They don't use your service, they just index your website. If you don't like it Microsoft, don't publish the data publicly, keep the good stuff behind a login and monitor/limit accounts usage of those logins.

    Put it this way, if you weren't scraping you, but you let others index the public data (e.g. Google, DuckDuckGo etc.), then they'd scrape Google and DuckDuckGo instead. Once you published it freely, without first showing a screen sayng "here is the EULA, you agree to this by clicking agree, we show you nothing till you agree", once you did that publishing freely, you lost control.