Saturday, June 15, 2024

Critical LinkedIn AutoFill Vulnerability Allow Hackers to Steal LinkedIn Users Sensitive Information

A new vulnerability discovered in LinkedIn AutoFill functionality leaks users sensitive information to 3rd party websites.

LinkedIn provides an AutoFill a future for other websites to fill information such as LinkedIn user’s name, email address, phone number, location, and job.

This Linkedin provides only for paying customers of LinkedIn’s Marketing Solutions increases the volume and quality of conversions.

LinkedIn AutoFill Future

Customer domains must be whitelisted for LinkedIn AutoFill to function properly, but this vulnerability could abuse this restriction and leaks the sensitive information.

This Vulnerability allowed an attacker to steal your full name, phone number, email address, ZIP code, company and job title.

Also Read: iOS Trustjacking -Dangerous iOS Vulnerability to Hack iPhones & Gain Complete Control Remotely by Attackers

In this case,  If any of those sites have cross-site scripting vulnerabilities, which Cable confirmed some do, hackers can still run AutoFill on their sites by installing an iframe to the vulnerable whitelisted site,Techcrunch says.

Exposed LinkedIn Flaw working in the following ways,

  1. The user visits the malicious site, which loads the LinkedIn AutoFill button iframe.
  2. The iframe is styled so it takes up the entire page and is invisible to the user.
  3. The user clicks anywhere on the page. LinkedIn interprets this as the AutoFill button being pressed, and sends the information via postMessageto the malicious site.

According to researcher Jack Cable , “It seems like LinkedIn accepts the risk of whitelisted websites (and it is a part of their business model), yet this is a major security concern,”

This leads , a compromise in any of the whitelisted websites would have exposed the information of LinkedIn users to malicious hackers.

He discovered the issue on April 9th, 2018 and immediately disclosed it to LinkedIn. The company issued a fix on April 10th but didn’t inform the public of the issue.

Website

Latest articles

Sleepy Pickle Exploit Let Attackers Exploit ML Models And Attack End-Users

Hackers are targeting, attacking, and exploiting ML models. They want to hack into these...

SolarWinds Serv-U Vulnerability Let Attackers Access sensitive files

SolarWinds released a security advisory for addressing a Directory Traversal vulnerability which allows a...

Smishing Triad Hackers Attacking Online Banking, E-Commerce AND Payment Systems Customers

Hackers often attack online banking platforms, e-commerce portals, and payment systems for illicit purposes.Resecurity...

Threat Actor Claiming Leak Of 5 Million Ecuador’s Citizen Database

A threat actor has claimed responsibility for leaking the personal data of 5 million...

Ascension Hack Caused By an Employee Who Downloaded a Malicious File

Ascension, a leading healthcare provider, has made significant strides in its investigation and recovery...

AWS Announced Malware Detection Tool For S3 Buckets

Amazon Web Services (AWS) has announced the general availability of Amazon GuardDuty Malware Protection...

Hackers Exploiting MS Office Editor Vulnerability to Deploy Keylogger

Researchers have identified a sophisticated cyberattack orchestrated by the notorious Kimsuky threat group.The...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Free Webinar

API Vulnerability Scanning

71% of the internet traffic comes from APIs so APIs have become soft targets for hackers.Securing APIs is a simple workflow provided you find API specific vulnerabilities and protect them.In the upcoming webinar, join Vivek Gopalan, VP of Products at Indusface as he takes you through the fundamentals of API vulnerability scanning..
Key takeaways include:

  • Scan API endpoints for OWASP API Top 10 vulnerabilities
  • Perform API penetration testing for business logic vulnerabilities
  • Prioritize the most critical vulnerabilities with AcuRisQ
  • Workflow automation for this entire process

Related Articles