XSS Vulnerability Addressed In LinkedIn

Business networking site LinkedIn has a cross site scripting (XSS) vulnerability fixed in the website. Security Expert Rohit Dua from India Wednesday posted a message about the leak on Full Disclosure. LinkedIn Help forum did not have adequate security, the profile pages of LinkedIn were not vulnerable.

To exploit the vulnerability must be a user logged in. When starting a discussion on the Help pages, it was possible for an attacker to execute code in the form fields. The code then implemented, was also open to non-visitors.

LinkedIn has vulnerability - with the help of Dua - rectified within three hours, writes Threat Mail. According been a spokesman for LinkedIn are private data of users at no time in danger and there is no abuse of the vulnerability.

Security Professionals On LinkedIn Stalked By Fake Recruiters

Several security professionals who are active on LinkedIn, have been the target of fake recruiters who probably tried to map the social circle and connections. The Dutch security researcher Yonathan Klijnsma warned two weeks ago for the 'recruiters'.

Also employees of the Finnish anti-virus firm F-Secure were approached by the fake accounts, which utilized under different from stock photos. The "recruiters" were mainly as employees of Talent Sources and approached security professionals through a standard message from a recruiter. What was the real purpose is unknown. Possibly this was an experiment to test how sensitive security professionals for social engineering. The accounts of the 'recruiters' appeared after some time to disappear. Still, warns Sean Sullivan from the F-Secure it is hoped that no one has given the fake accounts important information.

HackerOne Receives Investment Of $ 25 Million

HackerOne, the platform for reporting vulnerabilities in various software projects and applications, during a new round of investment $ 25 million received. HackerOne was in 2013 founded with the help of Facebook and Microsoft. Initially HackerOne focused on rewarding bug reports in popular software projects from which millions of people use. Meanwhile, all kinds of software companies through the website launched a so-called "bug bounty program."

HackerOne fulfills coordination between bug detector and the software in question. Also advises the platform software vendors for their own software via HackerOne want to start a rewards program. The money in the latest round of investment was raised include from Salesforce Chairman and CEO Marc Benioff, Dropbox's CEO and co-founder Drew Houston and Yelp CEO and co-founder Jeremy Stoppelman.

Since the last round of investment HackerOne the number of employees has expanded from 10 to 50. By now, Yahoo !, Twitter, Adobe, Dropbox, LinkedIn, Snap Chat and Airbnb all use the services of the platform. The total number of customers has now passed the 250. These software companies and projects in recent years to more than 1,500 researchers over $ 3.2 million was paid. The money was used to locate nearly 10,000 vulnerabilities and fix. Despite the positive noises made ​​LinkedIn recently announced that it had started a private reward program for a select group of researchers, because programs where everyone can join would create too much noise to. Why chose LinkedIn sure to route payments to researchers via HackerOne.

LinkedIn Pays Select Group Of Investigators For Leak

The business social networking site LinkedIn has since late last year decided to reward a program for a select group of researchers who report vulnerabilities. Unlike many other sites that launched a reward program to open bug reports LinkedIn decided the program decided to keep. According to information director Cory Scott , the program stems from the bug reports via security@linkedin.com enter.

Most reports were not usable according to Scott, but a small group of researchers used to send detailed bug reports. Then LinkedIn for this group of researchers decided to launch a special rewards program. This has already yielded more than 65 specific bugs for which more than $ 65,000 was paid. The program is structured so that the security team LinkedIn directly with investigators from the beginning works to the end. Payments late LinkedIn HackerOne walk through a platform where many companies start public reward programs.

Scott notes that LinkedIn has looked at an open reward program, but given the experience of external bug reports and the status of the current ecosystem of bug reports, the cost does not outweigh the benefits. Yet Scott calls outside researchers for bugs via security@linkedin.com to continue to report. He further states that it was decided to share the experiences LinkedIn to give "more nuance" to the discussion on the subject, which might be useful for others.

Expert: Passwords Are Not The Problem But People

This week, Microsoft unveiled Windows 10 biometric logon will support so users no longer have to use password to gain access to their systems and accounts, but according to one expert passwords are not the problem, but people.

"Although there are safer alternatives and other authentication methods that can be used in addition to the password, the password will still be a long time with us, whether you like it or not," said Richard Walters of Inter media. He also thinks there should be more attention to their passwords "work". Most programs currently only works with passwords. "The reality is that there is nothing wrong with passwords. People are the problem. Users choose passwords that are too simple, too short and too predictable."

Walters points to the passwords of Sony and LinkedIn users who came out through data leaks. Then it appears that more than half of the passwords consist of fewer than eight characters. Even when websites take measures such as salting and hashing these kinds of short passwords still a risk, according to the expert. Users also increase the risk by using the same password for multiple websites.

Password Management

"Despite all attempts to educate users on the importance of using relatively long, complex passwords and willing hour, they do not. And they are rarely changed." Walters, however, sees programs a solution that not only choose a password for the user, but also changes regularly. This form of "automated password management" can help prevent attacks or reduce their impact. "The risk of a data breach is now greater than ever. The removal of human interaction with passwords and the selection and re sizing automation will be a big step forward at different levels."

Phishing Attack On LinkedIn Users With HTML Attachment

LinkedIn users have become the target of a phishing attack that through html files attempting to steal credentials. The email has the subject "LinkedIn Alert" and argues that there is a mandatory security update is necessary due to unusual activity.

LinkedIn phishing email

For this check is sent an html file. When users open the file, they get to see a copy of the real LinkedIn site. However, the code has been modified so that users via the HTML page to try to log their data forwarding to the attackers, warns anti-virus company Symantec. The IT security advises users to turn on two-factor authentication. Even if the credentials are stolen an attacker can therefore not on the account login.