LinkedIn security flaws allow account hijacking
Posted on 24 May 2011.
LinkedIn users are in danger of having their their account hijacked when accessing it over insecure Wi-Fi networks or public computers, says independent security researcher Rishi Narang, and it's all due to session and authentications cookies with an unnaturally long lifespan and LinkedIn's failure to remove them once the user logs out.


The cookies in question are JSESSIONID and LEO_AUTH_TOKEN, and are available even after the session initiated by the user has been terminated.

They are also set to expire only after one solid year, and this fact allowed the researcher to access a number of active accounts of various individuals from all over the world during a period of many months. "They would have login/logged out many a times in these months but their cookie was still valid," he says.

In addition to all of that, those two cookies and the others that the welcome page stores are transmitted in clear text over HTTP, because they don't have a secure flag set. "If the secure flag is set on a cookie, then browsers will not submit the cookie in any requests that use an unencrypted HTTP connection, thereby preventing the cookie from being trivially intercepted by an attacker monitoring network traffic," explains Narang.

According to him, until LinkedIn makes some changes, the only way to "expire" the cookies is for the users to change their password and then authenticate themselves with the new credentials. This could be a stopgap measure if you know that someone has stolen those cookies and is accessing your account, but won't new cookies be created after the password change and authentication?

It seems to me that the only solution to this problem is for LinkedIn to effect some changes, and according to Reuters, they are planning to offer "opt-in" SSL support for the entire site in the coming months (and that would encrypt the cookies in questions), but have not commented on the fact that the cookies have such a long lifespan.






Spotlight

How to talk infosec with kids

Posted on 17 September 2014.  |  It's never too early to talk infosec with kids: you simply need the right story. In fact, as cyber professionals itís our duty to teach ALL the kids in our life about technology. If we are to make an impact, we must remember that children needed to be taught about technology on their terms.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  

DON'T
MISS

Fri, Sep 19th
    COPYRIGHT 1998-2014 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //