LinkedIn security flaws allow account hijacking
Posted on 24 May 2011.
LinkedIn users are in danger of having their their account hijacked when accessing it over insecure Wi-Fi networks or public computers, says independent security researcher Rishi Narang, and it's all due to session and authentications cookies with an unnaturally long lifespan and LinkedIn's failure to remove them once the user logs out.


The cookies in question are JSESSIONID and LEO_AUTH_TOKEN, and are available even after the session initiated by the user has been terminated.

They are also set to expire only after one solid year, and this fact allowed the researcher to access a number of active accounts of various individuals from all over the world during a period of many months. "They would have login/logged out many a times in these months but their cookie was still valid," he says.

In addition to all of that, those two cookies and the others that the welcome page stores are transmitted in clear text over HTTP, because they don't have a secure flag set. "If the secure flag is set on a cookie, then browsers will not submit the cookie in any requests that use an unencrypted HTTP connection, thereby preventing the cookie from being trivially intercepted by an attacker monitoring network traffic," explains Narang.

According to him, until LinkedIn makes some changes, the only way to "expire" the cookies is for the users to change their password and then authenticate themselves with the new credentials. This could be a stopgap measure if you know that someone has stolen those cookies and is accessing your account, but won't new cookies be created after the password change and authentication?

It seems to me that the only solution to this problem is for LinkedIn to effect some changes, and according to Reuters, they are planning to offer "opt-in" SSL support for the entire site in the coming months (and that would encrypt the cookies in questions), but have not commented on the fact that the cookies have such a long lifespan.






Spotlight

The synergy of hackers and tools at the Black Hat Arsenal

Posted on 27 August 2014.  |  Tucked away from the glamour of the vendor booths and the large presentation rooms filled with rockstar sessions, was the Arsenal - a place where developers were able to present their security tools and grow their community.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  

DON'T
MISS

Fri, Aug 29th
    COPYRIGHT 1998-2014 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //