LinkedIn May be "Hacker's Dream Tool" But Attacks Easy to Foil

It's not very often that Anonymous and CNN agree on anything, but it did happen when CNN Money reported that professional networking site LinkedIn was a "Hacker's dream tool", the latest social media scare story. Sharing the link, the account @YourAnonNews tweeted "CNN is spot on with this article (a rarity we've found). LinkedIn is a hackers dream tool".

When you read the article, you discover that, as so often happens, they are not talking about any technical vulnerability. All they mean is that LinkedIn is a useful source of professional biographical information that is useful for the type of social engineering attack known as "spear phishing".  Social engineering refers to all the techniques based on getting people to do things they should not be doing, by tricking them in some way. This is, in fact, the way many famous hacks have been done. When Paris Hilton's smartphone was "hacked", for example, someone simply fooled a T-Mobile store employee into revealing the password for resetting the user password, then created a new one.

Spear phishing is a social engineering attack where someone uses detailed personal information to fool the victim into believing a message comes from a trusted source, tricking them into clicking on a link they would never touch in a mail from a stranger. It is called spear phishing because it is just like a normal phishing attack but much more precisely targeted, aiming at a single user rather than millions.

In reality LinkedIn is simply a useful source of professional information about people, second only to Google. This information is used to identify the names of colleagues that can be used in spoofed mails as the "sender" or it can be used in more complex ways. One way is to create a completely fake profile of a person who works at a company. Then this account sends out connection requests to all the other employees on LinkedIn and many of these will accept the request without ever asking themselves if the person exists. Once connected to real employees the persona then has access to employee-only groups and other information.

This does not mean that you should be alarmed, wonder if LinkedIn is safe or close your account. Quite the contrary. I have a profile on LinkedIn and I recommend all the people who attend my networking workshops to have one, too. All you need to do is be a little more careful. This means being suspicious when someone unexpectedly invites you to try some new software. Most important of all you should not accept invitation requests from people that you do not know or cannot verify.  There is a philosophy called "open networking" which does exactly that, but it is appropriate only for independent professionals who ae free to take whatever risks they feel are appropriate. If you are working for a large organization you should be more careful because your carelessness causes harm not only to you but also to your colleagues and your employer.


Lectures, Workshops, Coaching, Writing
For lectures, workshops, coaching and writing on networking and other topics visit http://andrewhennigan.com, email speaker@andrewhennigan.com or call 0046 73 089 44 75


Related Posts on Networking:

How to Separate Work and Private Networking
Involuntary Networking: Why First Street is Fascinating but Scary
LinkedIn Etiquette: How to Approach People You Don't Know
Selling Your Ideas: Influencing Your Way to Success
Professional Networking: Five Sites You Should be Using
How to Use Twitter for Professional Networking
Sign Up Now: Joining New Networking Sites Boosts Your Reputation
Zerply: Three Thumbs Up, Two Thumbs Sideways
Three Keys to Networking


Comments

Post a Comment

Popular posts from this blog

Dear Best Regards: How to Start and End Your Emails

Image
Last year I wrote that to make your email more effective you should put meaningful content into the subject line, keep your messages short and consider other channels (see Three Timesaving Tips for Email ). I also wrote some guidelines about common culture problems when email crosses borders (see Three Non-Obvious Ways Culture Affects Email ). But there is one other question about international email that comes up regularly in workshops: how should you start and finish? Do I use "Dear", "Hi",or "Hello" to start with? What do I do if I don't know if the person I am writing to is a man or a woman? "What is the difference between "Best regards  and "Warm regards"? This is a question that puzzles many people and a while ago it stressed me, too. But the answers to these questions are perhaps easier than you imagine. DEAR MR/MRS WHATEVER . First of all, at the start of a mail you probably have some sort of salutation. How do you kn
Read more

Reverting to Emails: Confusion and the Indian English Language

Image
In workshops about global email many people focus on their issues communicating with colleagues in India. Partly this is related to some deeper cultural differences that lead to misunderstandings. But many problems are also caused by the different ways in which Indian people use English. There are some "English" words that you will probably only hear in India, like " stepney ", their word for a spare wheel. A hundred years ago this term was coined in the UK and was exported to India where it survived. Back home only a few antique vehicle enthusiasts have any idea what it means. There are also many English expressions that are peculiar to India, like "What is your good name?". But in both cases an English speaker from elsewhere would just see an unfamiliar expression and either ask what it means or google it. Most problems are caused by another kind of difference: where a standard US or UK English word is used but with a different meaning. Recently s
Read more

TED’s Magical Red Carpet

Image
Watch any TED(x) video or, better still, attend a live event, and you will probably notice that speakers stand in the middle of a circular red carpet. This choice is not just a question of aesthetics. That red carpet actually plays a key role in the success of the TED format. Having the speaker stand in the middle of a red carpet has several important consequences, leading the speaker to follow best practices that they might not be aware of. No script or notes . Since there is no table, lectern or other furniture within reach, the speaker cannot easily read from a script. This forces them to deliver their talk from memory, which is much more compelling because few people can read from a script and make it sound natural. And no matter how good you are at reading, the audience can see that your eyes are scanning the text and this breaks the magical connection with their minds. Encouraging people to speak from memory pushes them to make a much better talk than they might ot
Read more