100 Million LinkedIn Accounts for sale

It was reported in the news that 100 million LinkedIn Accounts were for sale on the Dark Web.

LinkedIn previously reset the passwords of those accounts they believed were compromised in 2012, but it seems many more accounts were compromised than previously believed.

LinkedIn's response should have been to reset all the users passwords and implemented better protection for the new passwords.

From a user perspective, we need to ensure we are using different passwords for each of our web services.  Why?  Well if your LinkedIn password is the same as your email provider, other social media accounts, cloud storage, etc, then the compromised password could be replayed into a number of websites and services to gain access to those.

Although it's not two-factor authentication, two-step verification will give some additional security to your LinkedIn account.  Not only will this add security to your account, it's also free.  The instructions to switch on two-step verification for LinkedIn is relatively straightforward.

Don't forget your other web accounts, as two step verification is available for Google, Facebook, Microsoft, Twitter and many other site.  If the websites and services you use aren't taking your security seriously, should you be using them?

LinkedIn – the hacker’s research tool [Link - MTI Bytes]

Here is a repost of a piece I wrote for our work blog: http://www.mtibytes.com/post/LinkedIn-the-hackers-research-tool

=================

As of July 2015, LinkedIn has approximately 380 million users worldwide, a number that is continuing to grow. The social media platform is very useful for networking in the business world. It invites users to share their online CV with other industry professionals and establish contacts, publish industry commentary, and research potential employers or candidates.

Reconnaissance
The security risks of sharing personal details on other social media platforms like Facebook have been well documented, but for enterprises, LinkedIn can be equally dangerous. LinkedIn pages can provide a considerable level of detail to potential cyber attackers: names, job titles, email addresses, partnering organisations, upcoming projects, and even hobbies and interests. At first glance, this information might seem relatively trivial, but it forms part of the ‘cyber kill chain’ and can lead to malicious attacks.

For hackers, LinkedIn can inform the ‘plan of attack’. Employee and company profile pages can help hackers identify a target; source the names of executives and department heads; and learn the email structure; as well as the names of affiliated companies.

This leaves organisations vulnerable to a range of cyber attacks. One example is spear phishing: a targeted person receives an email inviting them to access a link, which initiates the installation of malicious software.

Socially engineered access
Emails from known sources (a colleague, for example) and information about hobbies, can instill confidence in the targeted individuals, making them more likely to click on the link.

The name drop of the company CEO could create a false air of familiarity, which might spur someone to act hastily and neglect to follow the correct channels. It’s not hard to imagine that an IT helpdesk might grant a ‘known employee’ remote access in response to a pleading call or email to finish time-sensitive work on a Friday afternoon.

This might provide the hacker with the name, job title, and email address of a company employee, all of which are readily accessible on LinkedIn. In return, he stands to make financial gains, steal data, or simply obtain secure company information.

Human error
Most worryingly perhaps is this issue isn’t one that can be simply remedied with protective software. No technical solution can prevent an attacker from conducting an Internet search. LinkedIn and other social media profiles are often among the first to appear in a list of search engine hits. Once the attacker has deployed the malicious software, cajoled an employee, or gained remote access, the key goal is theft, whether for more information, financial remuneration, or data.

Education is the answer
As our virtual presence continues to grow, there needs to be more awareness made inside organisations about the potential risks of basic company details falling into the wrong hands. To safeguard company information and data, enterprises should attend more closely to what they wish to make visible to whom.

As more of our private lives are made public and readily available on the Internet, education becomes the vital component. Organisations should be looking to provide this level of training to all employees, or risk the consequences.

Muting Social Media...

At the beginning of this month, it was reported in the news that Twitter were trying out a mute feature.  This feature is being made live this week over various platforms, but I'm surprised why you’d follow someone who over-shares.  Surely the mute feature would be to unfollow them.

I'm on a number of social media sites, including Twitter, Facebook and LinkedIn, and am all too aware of people who over-share on social media.  I'm sure you have the same with the people you are connected with on various social media sites.

In the last year or so, I've noticed that it’s the same people who share a lot on my recent news feeds, but have noticed many people have been sharing a lot less.  In fact I'm guilty of this as my regular blogging has slowed somewhat, and I'm also using Twitter and Facebook less frequently.  My LinkedIn is quite active, which I suspect was due to my relatively recent new role with a new organisation.

I believe this could be attributed to the “Snowden Effect”, as more and more people hear about and begin to understand about data privacy, they become more concerned with what they are sharing and how it is so easily accessible with the aid of everyone’s favourite search engine. 

I find I'm a lot more cautious when using social media now, as I don’t know who may read or misread my comments at a later date.  The recent news about the “right to be forgotten” in the EU court is interesting, as Google can on search on publicly available data on the internet.  It still surprises me how many people believe that Google holds all this data, although I appreciate Google does cache some information.

It’s not just about data that can be used, there are also legal implications.  We have seen a number of legal cases and prosecutions around trolling, but this does not seem to slow the flow of negative or inflammatory comments on social media sites.  Listening to the news on the radio today it seems that the Crown Prosecution Service (CPS) are issuing new guidelines towards the elderly and teenagers receiving abuse, including via social media.

After the initial explosion and the subsequent growth of social media, it has meant the laws protecting the users have always lagged behind.  It’s great to be a part of this pioneering time, but as with all pioneers, it’s difficult to protect yourself from the unknown.