LinkedIn phishing vulnerability

http://sigkill.dk/blog/archives/311-LinkedIn-phishing-vulnerability.html

by rlm • 16 years ago

31 5 16 years ago

sigkill.dk

amatriain• 16 years ago

Wow. So easy to exploit...

oscardelben2• 16 years ago

Ok, so for this to work you have to click on a phishing email.

A few weeks ago I was working on the linkedin api and I noticed that if I was sending messages to multiple contacts, they would all see each other's email on cc instead of ccn. I reported this to the team and I hope it's fixed by now. It's not a big deal, but it's a way to know the email address of all your contacts.

ig1• 16 years ago

You can see the email details on your contacts on linkedin anyway, no ?

oscardelben2• 16 years ago

I'm not sure about that. But anyway your contacts will see your contacts's email.

Timothee• 16 years ago

Yes, it's a phishing email but where it's different and vulnerable is that you receive a seemingly legitimate email from LinkedIn (it's in fact a legitimate email that was "forwarded" to you), that does link to LinkedIn.com, not limkedin.com or similar. You never actually give your email and password to a site that makes you think it's LinkedIn. It IS LinkedIn.

The weak part is that your LinkedIn account gets associated to an extra email address without your express consent. (allegedly, since I haven't tried this)

LinkedIn phishing vulnerability

Related Stories