Vulnerabilities / Threats
10/28/2013
11:38 AM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%
Repost This

LinkedIn Defends 'Intro' Email Security

LinkedIn responds to user and security expert concerns about new email feature, cites measures it took to make LinkedIn Intro safe.

LinkedIn: 10 Important Changesr
(click image for larger view and for slideshow)
LinkedIn: 10 Important Changes
LinkedIn's newest feature, called Intro, stirred up controversy last week when the professional social network introduced it -- and a few other features -- at an event about its mobile offerings. LinkedIn Intro is an opt-in service that lets you connect on a professional level with people you email every day.

"When people email you, we show you their LinkedIn profile: you can put faces to names, write more effective emails, and establish rapport," LinkedIn said in the announcement. "You can grow your professional network by connecting with them on LinkedIn."

But not everyone was as enthusiastic about it: Security experts were wary, especially in light of LinkedIn's breach last year, which compromised 6.5 million user passwords. To use Intro, users are required to route all emails through LinkedIn's "Intro" servers, which then scan them for certain types of content and temporarily store the passwords to users' external accounts. Security expert Graham Cluley said this sent a shiver down his spine.

[ Learn how to keep your job search private. Read 5 LinkedIn Privacy Settings For Job Hunters. ]

Over the weekend, LinkedIn responded to criticism in a blog post highlighting the measures it took to ensure Intro was safe and secure.

"When the LinkedIn Security team was presented with the core design of Intro, we made sure we built the most secure implementation we believed possible," said Cory Scott, senior manager of information security at LinkedIn. "We explored numerous threat models and constantly challenged each other to consider possible threat scenarios."

LinkedIn described the actions it took prior to Intro's launch. Among them:

-- Isolating Intro in a separate network segment and implementing a security perimeter across trust boundaries;

-- Performing hardening of the external- and internal-facing services and reducing exposure to third-party monitoring services and tracking;

-- Engaging iSEC Partners, a security consultancy, to perform a line-by-line code review of the credential handling and mail parsing/insertion code;

-- Penetration testing the final implementation by LinkedIn's internal team to ensure vulnerabilities were addressed; and

-- Ensuring it had the right monitoring in place to detect potential attacks, react quickly and minimize exposure.

LinkedIn clarified that all communications use SSL/TLS at each point of the email flow between a user's device, LinkedIn Intro and the third-party email system. "When mail flows through LinkedIn Intro, we make sure we never persist the mail contents to our systems in an unencrypted form," Scott said. "And once the user has retrieved the mail, the encrypted content is deleted from our systems."

Scott also addressed rampant concerns from iOS users. "It's important to note that we simply add an email account that communicates with Intro," he said. "The profile also sets up a certificate to communicate with the Intro web endpoint through a web shortcut on the device. We do not change the device's security profile in the manner described in a blog post that was authored by security firm Bishop Fox on Thursday."

LinkedIn's Scott said he and LinkedIn welcome "healthy skepticism and speculation," but LinkedIn felt it was necessary to clarify its practices and correct the misperceptions.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
David F. Carr
50%
50%
David F. Carr,
User Rank: Apprentice
10/29/2013 | 3:13:40 AM
re: LinkedIn Defends 'Intro' Email Security
By nature, social computing leans toward sharing and openness. People join LinkedIn to build their circle of connections not to live the most private life possible.
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-3946
Published: 2014-04-24
Cisco IOS before 15.3(2)S allows remote attackers to bypass interface ACL restrictions in opportunistic circumstances by sending IPv6 packets in an unspecified scenario in which expected packet drops do not occur for "a small percentage" of the packets, aka Bug ID CSCty73682.

CVE-2012-5723
Published: 2014-04-24
Cisco ASR 1000 devices with software before 3.8S, when BDI routing is enabled, allow remote attackers to cause a denial of service (device reload) via crafted (1) broadcast or (2) multicast ICMP packets with fragmentation, aka Bug ID CSCub55948.

CVE-2013-6738
Published: 2014-04-24
Cross-site scripting (XSS) vulnerability in IBM SmartCloud Analytics Log Analysis 1.1 and 1.2 before 1.2.0.0-CSI-SCALA-IF0003 allows remote attackers to inject arbitrary web script or HTML via an invalid query parameter in a response from an OAuth authorization endpoint.

CVE-2014-0188
Published: 2014-04-24
The openshift-origin-broker in Red Hat OpenShift Enterprise 2.0.5, 1.2.7, and earlier does not properly handle authentication requests from the remote-user auth plugin, which allows remote attackers to bypass authentication and impersonate arbitrary users via the X-Remote-User header in a request to...

CVE-2014-2391
Published: 2014-04-24
The password recovery service in Open-Xchange AppSuite before 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, and 7.4.2 before 7.4.2-rev13 makes an improper decision about the sensitivity of a string representing a previously used but currently invalid password, which allows remote attackers to obtain potent...

Best of the Web