LinkedIn phishing?

[jducoeur]

Today, as so often lately, I got a LinkedIn invitation from an old colleague who I haven't seen in a number of years. In this particular case, it was the CEO for my last company, who I had actually been looking for at one point, when I thought it might make sense for my current company to buy the old one's IP.

And it suddenly occurred to me: how the heck do I know that it's actually him? I mean, LinkedIn allows anybody to claim a particular identity -- I can say that I'm person X, formerly company Y, and they don't do much to check that. They let me send out invitations to all of my "colleagues" from that company, and those colleagues are likely to simply accept me at face value. They lend a wholly spurious imprimateur of legitimacy to me, simply because I claim to be that person. Heck, they even *encourage* me to make contact with everyone from company Y, and make it as easy as possible to do so. I haven't looked at it in detail, but it appears to me that LinkedIn's trust model is badly broken: it provides just the right combination of privacy and communication to make identity theft really easy.

So here's a prediction: if it hasn't happened already, we're going to see a quiet rise in highly targeted, very dangerous social-engineering attacks conducted via LinkedIn, and possibly other systems like it. It will be used to convince a target that the hacker is an old associate, and the resulting trust will be leveraged for criminal ends.

Given the rise of targeted phishing (one of the news stories of the past couple of months is the fall of generic spam, and the rise of targeted criminal phishing attacks aimed at C-level executives at companies), I think this one's damned near certain. The crooks aren't dumb enough to miss this opportunity, and it's going to force LinkedIn and companies like it to rethink their procedures after a few good scandals arise...

Comments

[cvirtue.livejournal.com]

I'd been rather wondering about things like that as well (not quite as up front in my brain as you have been, though.)

To start to set up your network, you need their valid email addresses, which helps, but as you say, the system hands you suggestions after that, and you don't need even that thin level of prior contact/memory.

[msmemory.livejournal.com]

Oh, but you don't need their valid email address. You can claim to be Rupert.Murdoch at gmail dot com, and it'll send you a verification mail, but there's no guarantee that Rupert Murdoch of the news empire is the owner of that gmail account.