
A business social media platform has allowed a bug to remain open for a year, despite having been warned six times by a researcher.
The issue arose from how Secure Sockets Layer (SSL) connections are configured, which can expose users to Man in the Middle (MitM) attacks.
MitM attacks occur where a cyber-criminal (or other third party) transparently receives an IP data stream not intended for them before relaying the data.
Both the relaying and the receiving link terminals are typically oblivious to the issue, while the criminals can acquire all kinds of data from the members, including login details and financial information for internet banking.
Zimperium boss Zuk Avraham said that members outside of the US and Europe who opted against ticking the box that activates option HTTPS after the login page are potential victims of the flaw. The security firm also informed LinkedIn of the issue.
Avraham said:
“When the victim types email and password, it’ll be sent over the network in an unencrypted form that can be easily read by any attacker – even the most amateur ones.”
Most LinkedIn members will not be aware of the problem, but those that do will feel disappointed that such an online entity could be so casual in resolving an obvious flaw like this one.
Small and medium-sized enterprises (SMEs) are no exception with regards to being responsible for closing holes that could potentially breach data. This is why they should be looking at making information security vacancies available so that they have the right personnel in place to deal with such issues.
Send us your CV and have our recruiters match you to the ideal opportunities
Do you already have an account with us?
Log inWant to have an account with us?
RegisterWant to just send us your CV?
By submitting your registration and CV to us you are agreeing to join our database and to be contacted about relevant jobs industry communications. Please read our terms of business for more information.