Senior CyberSecurity Specialist Zouheir Abdallah @ZuZ, has publicly and responsibly disclosed a vulnerability in LinkedIn’s mobile app. Zouheir is known for reporting a serious vulnerability in DropBox’s 2 Factor Authentication back in July 2013.
LinkedIn iOS app parses HTML in the messages, and this can be used to phish for credentials or be escalated into a full blown attack. LinkedIn’s vulnerability lies in the messaging feature of LinkedIn’s mobile app, that parses HTML code, which could have serious impact on LinkedIn‘s users.
Proof of concept of the flaw and submitted it to the LinkedIn Security team in September 2013. Later in October 2013, the vulnerable application was patched.
One of the possible attack vector is that, using this vulnerability attacker can easily phish LinkedIn user on iOS app. As shown in the screenshot, POC message says:
Hey, Can you please view my LinkedIn profile and endorse me! Thanks! I appreciate it!
The phishing site can be a replica of LinkedIn and tricks the victim into giving out his username and password.The iOS app will display the url without the hyperlink embedded in the HTML a href , and the receiver of the message will not even know that he is being redirected to a malicious site.
This attack can be used against LinkedIn too by claiming that LinkedIn requires re-authentication to view some article on LinkedIn. This attack could also work on different devices such as Android and Blackberry, but he couldn’t test as he didn’t have other handsets at hand.
LinkedIn doesn't have a Bug Bounty program neither a Hall of Fame, nevertheless he received a symbolic token of a Shirt, Mug, and a thank you note from LinkedIn's security team.
Author Venkatesh Yalagandula Follow us Google + and Facebook and Twitter
LinkedIn iOS app parses HTML in the messages, and this can be used to phish for credentials or be escalated into a full blown attack. LinkedIn’s vulnerability lies in the messaging feature of LinkedIn’s mobile app, that parses HTML code, which could have serious impact on LinkedIn‘s users.
Proof of concept of the flaw and submitted it to the LinkedIn Security team in September 2013. Later in October 2013, the vulnerable application was patched.
One of the possible attack vector is that, using this vulnerability attacker can easily phish LinkedIn user on iOS app. As shown in the screenshot, POC message says:
Hey, Can you please view my LinkedIn profile and endorse me! Thanks! I appreciate it!
The phishing site can be a replica of LinkedIn and tricks the victim into giving out his username and password.The iOS app will display the url without the hyperlink embedded in the HTML a href , and the receiver of the message will not even know that he is being redirected to a malicious site.
This attack can be used against LinkedIn too by claiming that LinkedIn requires re-authentication to view some article on LinkedIn. This attack could also work on different devices such as Android and Blackberry, but he couldn’t test as he didn’t have other handsets at hand.
LinkedIn doesn't have a Bug Bounty program neither a Hall of Fame, nevertheless he received a symbolic token of a Shirt, Mug, and a thank you note from LinkedIn's security team.
Author Venkatesh Yalagandula Follow us Google + and Facebook and Twitter
No comments:
Post a Comment