Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

Researchers Flag Security Flaws In New LinkedIn Offering

LinkedIn's new "Intro" tool could be a security nightmare waiting to happen, researchers warn

A new LinkedIn feature designed to familiarize users with their email partners could introduce a slew of security problems to enterprises and individuals who use it, researchers said this week.

The new feature, LinkedIn Intro, enables iPhone users to route their email through LinkedIn so that they can get background on an email sender or receiver before they write. The feature helps the user become more familiar with their email partners, LinkedIn says.

But security experts say the new feature is deeply flawed and potentially dangerous to the user's personal privacy -- and, by extension, to any enterprise that allows employees to use LinkedIn via the corporate network.

"Intro reconfigures your iOS device (e.g. iPhone, iPad) so that all of your emails go through LinkedIn’s servers. You read that right," states the security consulting firm Bishop Fox in a blog about the new LinkedIn feature. "Once you install the Intro app, all of your emails, both sent and received, are transmitted via LinkedIn’s servers. LinkedIn is forcing all your IMAP and SMTP data through their own servers and then analyzing and scraping your emails for data pertaining to…whatever they feel like.

The blog continues: "'But that sounds like a man-in-the-middle attack!' I hear you cry. Yes. Yes it does. Because it is. That’s exactly what it is. And this is a bad thing. If your employees are checking their company email, it’s an especially bad thing."

Other security experts also flagged the potential security vulnerabilities in the new LinkedIn feature.

"To give them credit, from the engineering point of view it is pretty nifty. But from the security and privacy point of view it sends a shiver down my spine," said Graham Cluley, an independent security researcher, in a blog post. "LinkedIn also scooped up the contents of users' iOS calendars, including sensitive information such as confidential meeting notes and call-in numbers -- which they then transmitted in plain text, not encrypted."

In fact, Intro could create problems for encrypted email, the Bishop Fox blog says. "Cryptographic signatures will break because LinkedIn is rewriting your outgoing emails by appending a signature on the end," Bishop Fox states. "This means email signatures can no longer be verified. Encrypted emails are likely to break because of the same reason – extra data being appended to your messages."

The approach of the new feature could also create legal problems for email users because it changes the content of the email and interferes with confidentiality rules, Bishop Fox states.

"[LinkedIn] calls it 'doing the impossible,' but some might call it 'hijacking email,'" the blog says.

Have a comment on this story? Please click "Add a Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
patligalli
50%
50%
patligalli,
User Rank: Apprentice
10/25/2013 | 9:21:40 PM
re: Researchers Flag Security Flaws In New LinkedIn Offering
thanks for the news , I am probably going to remove from my Iphone...
When It Comes To Security Tools, More Isn't More
Lamont Orange, Chief Information Security Officer at Netskope,  1/11/2021
US Capitol Attack a Wake-up Call for the Integration of Physical & IT Security
Seth Rosenblatt, Contributing Writer,  1/11/2021
IoT Vendor Ubiquiti Suffers Data Breach
Dark Reading Staff 1/11/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2020: The Year in Security
Download this Tech Digest for a look at the biggest security stories that - so far - have shaped a very strange and stressful year.
Flash Poll
Assessing Cybersecurity Risk in Today's Enterprises
Assessing Cybersecurity Risk in Today's Enterprises
COVID-19 has created a new IT paradigm in the enterprise -- and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-3113
PUBLISHED: 2021-01-17
Netsia SEBA+ through 0.16.1 build 70-e669dcd7 allows remote attackers to discover session cookies via a direct /session/list/allActiveSession request. For example, the attacker can discover the admin's cookie if the admin account happens to be logged in when the allActiveSession request occurs, and ...
CVE-2020-25533
PUBLISHED: 2021-01-15
An issue was discovered in Malwarebytes before 4.0 on macOS. A malicious application was able to perform a privileged action within the Malwarebytes launch daemon. The privileged service improperly validated XPC connections by relying on the PID instead of the audit token. An attacker can construct ...
CVE-2021-3162
PUBLISHED: 2021-01-15
Docker Desktop Community before 2.5.0.0 on macOS mishandles certificate checking, leading to local privilege escalation.
CVE-2021-21242
PUBLISHED: 2021-01-15
OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is a critical vulnerability which can lead to pre-auth remote code execution. AttachmentUploadServlet deserializes untrusted data from the `Attachment-Support` header. This Servlet does not enforce any authentication or a...
CVE-2021-21245
PUBLISHED: 2021-01-15
OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, AttachmentUploadServlet also saves user controlled data (`request.getInputStream()`) to a user specified location (`request.getHeader("File-Name")`). This issue may lead to arbitrary file upload which can be used to u...