Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

10/28/2013
11:38 AM
Connect Directly
LinkedIn
Twitter
RSS
E-Mail
50%
50%

LinkedIn Defends 'Intro' Email Security

LinkedIn responds to user and security expert concerns about new email feature, cites measures it took to make LinkedIn Intro safe.

LinkedIn: 10 Important Changesr
(click image for larger view and for slideshow)
LinkedIn: 10 Important Changes
LinkedIn's newest feature, called Intro, stirred up controversy last week when the professional social network introduced it -- and a few other features -- at an event about its mobile offerings. LinkedIn Intro is an opt-in service that lets you connect on a professional level with people you email every day.

"When people email you, we show you their LinkedIn profile: you can put faces to names, write more effective emails, and establish rapport," LinkedIn said in the announcement. "You can grow your professional network by connecting with them on LinkedIn."

But not everyone was as enthusiastic about it: Security experts were wary, especially in light of LinkedIn's breach last year, which compromised 6.5 million user passwords. To use Intro, users are required to route all emails through LinkedIn's "Intro" servers, which then scan them for certain types of content and temporarily store the passwords to users' external accounts. Security expert Graham Cluley said this sent a shiver down his spine.

[ Learn how to keep your job search private. Read 5 LinkedIn Privacy Settings For Job Hunters. ]

Over the weekend, LinkedIn responded to criticism in a blog post highlighting the measures it took to ensure Intro was safe and secure.

"When the LinkedIn Security team was presented with the core design of Intro, we made sure we built the most secure implementation we believed possible," said Cory Scott, senior manager of information security at LinkedIn. "We explored numerous threat models and constantly challenged each other to consider possible threat scenarios."

LinkedIn described the actions it took prior to Intro's launch. Among them:

-- Isolating Intro in a separate network segment and implementing a security perimeter across trust boundaries;

-- Performing hardening of the external- and internal-facing services and reducing exposure to third-party monitoring services and tracking;

-- Engaging iSEC Partners, a security consultancy, to perform a line-by-line code review of the credential handling and mail parsing/insertion code;

-- Penetration testing the final implementation by LinkedIn's internal team to ensure vulnerabilities were addressed; and

-- Ensuring it had the right monitoring in place to detect potential attacks, react quickly and minimize exposure.

LinkedIn clarified that all communications use SSL/TLS at each point of the email flow between a user's device, LinkedIn Intro and the third-party email system. "When mail flows through LinkedIn Intro, we make sure we never persist the mail contents to our systems in an unencrypted form," Scott said. "And once the user has retrieved the mail, the encrypted content is deleted from our systems."

Scott also addressed rampant concerns from iOS users. "It's important to note that we simply add an email account that communicates with Intro," he said. "The profile also sets up a certificate to communicate with the Intro web endpoint through a web shortcut on the device. We do not change the device's security profile in the manner described in a blog post that was authored by security firm Bishop Fox on Thursday."

LinkedIn's Scott said he and LinkedIn welcome "healthy skepticism and speculation," but LinkedIn felt it was necessary to clarify its practices and correct the misperceptions.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
David F. Carr
50%
50%
David F. Carr,
User Rank: Apprentice
10/29/2013 | 3:13:40 AM
re: LinkedIn Defends 'Intro' Email Security
By nature, social computing leans toward sharing and openness. People join LinkedIn to build their circle of connections not to live the most private life possible.
News
Inside the Ransomware Campaigns Targeting Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
Commentary
Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-21392
PUBLISHED: 2021-04-12
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.28.0 requests to user provided domains were not restricted to external IP addresses when transitional IPv6 addre...
CVE-2021-21393
PUBLISHED: 2021-04-12
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.28.0 Synapse is missing input validation of some parameters on the endpoints used to confirm third-party identif...
CVE-2021-29429
PUBLISHED: 2021-04-12
In Gradle before version 7.0, files created with open permissions in the system temporary directory can allow an attacker to access information downloaded by Gradle. Some builds could be vulnerable to a local information disclosure. Remote files accessed through TextResourceFactory are downloaded in...
CVE-2021-21394
PUBLISHED: 2021-04-12
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.28.0 Synapse is missing input validation of some parameters on the endpoints used to confirm third-party identif...
CVE-2021-22497
PUBLISHED: 2021-04-12
Advanced Authentication versions prior to 6.3 SP4 have a potential broken authentication due to improper session management issue.