Social Networking Giant LinkedIn has Security Flaws

by Swati on May 23rd, 2011

LinkedIn might have been on cloud nine after its IPO success, but the path ahead doesn’t appear so smooth for this social networking giant. Recently, the site was under scrutiny for some of its security vulnerabilities.

Rishi Narang, an independent Internet security researcher, pointed out some of LinkedIn’s security issues. “LinkedIn has security flaws that makes users’ accounts vulnerable to attack by hackers, who could break in without ever needing passwords”, Rishi told Reuters.

According to the security researcher, the problem is related to the way LinkedIn manages a commonly used type of data file known as a cookie. After the LinkedIn users enter their username and password to access the account, the site creates a cookie “LEO_AUTH_TOKEN” on the computer of the users that provides access to their accounts.

“There are several website that use such cookies, but what makes LinkedIn more vulnerable is that its cookie does not expire for a full year from the date it is created. In most of the other sites, the cookies expire in 24 hours or less than that. Some like the banking sites log off users after 5- 10 minutes of inactivity”, Narang said in his blog on Saturday.

The long life of the LinkedIn cookie means that anybody can sniff the cookies from clear-text session, and then access and modify the information available on the user profile page for as much as a year. Narang said that the problem is serious because LinkedIn’s users are unaware of the issue and have no idea that they should be protecting the cookies.

To all this, LinkedIn issued a statement saying the company has already taken steps to secure the accounts of its users and that it takes the privacy and security of its members seriously. The company said that it currently uses SSL, or secure sockets layer technology for encrypting sensitive data like account logins. It is planning to offer “opt-in” SSL support for other parts of the site, in the coming months, that would cover encryption of those cookies.

Whether it is LinkedIn or Facebook, each social networking site has had its own share of security issues. The users must keep this in mind and protect their account by opting for trusted and encrypted WiFi networks or VPNs (virtual private networks), whenever possible.

Image Source: http://www.zdnet.com

1. Privacy and Security on Social Networking Sites[In...
2. LinkedIn is the most important Social Networking S...
3. Bloomberg Study: Google+ is going to be the bigges...
4. LinkedIn boosts browsing security, rolls out Local...
5. Derive the best out of your Network from the Twitt...

• Previous Post Next Post