Friday, November 1, 2024
HomeVirusNew Vulnerability Discovered in LinkedIn Messenger That Allow to Spread Malware and...

New Vulnerability Discovered in LinkedIn Messenger That Allow to Spread Malware and Compromise the Victims PC

Published on

Malware protection

World’s largest professional network  LinkedIn That has more than 500 Million Registered users. LinkedIn messenger Platform Vulnerability Allows attacker spread Malware into victims by taking advantage of LinkedIn’s security restrictions Flow.

LinkedIn messenger is the Mostly used Future Platform which helps for professional Community to Share their skills, Messenger easily sends resumes, transfer academic research and share job descriptions from the LinkedIn community.

Normally, LinkedIn security restrictions scan the Malicious activities of the attached File when user send valid files via messenger.

- Advertisement - SIEM as a Service

But this LinkedIn messenger Flow allows attacker bypass the LinkedIn security restriction and send a Malicious file which normally looks like a legitimate file but actually its Malicious one.

Based on the LinkedIn Security Restriction, following file format allow to upload and attach to a message.

  • Documents – csv, xls, xlsx, doc, docx, ppt, pptx, pdf, txt.
  • Images– gif, jpeg, jpg, png.

Also Read: Bypass an Anti-Virus Detection with Encrypted Payloads using VENOM Tool

How Does This  Vulnerability Works

This Vulnerability Allows to Attacker upload any Malicious file into LinkedIn messenger by Modifying the file Extension of the Malicious file.

According to Checkpoint Research, A PowerShell script was uploaded into LinkedIn messenger by modifying the Malicious file Extension as .pdf .

LinkedIn Messenger

Malicious File uploading into LinkedIn

Later, Attacker Successfully sends the Malicious file by controls the name of the file (Name parameter), the format of the file (MediaType parameter), and the file extension.

In this Below Response , we could see that LinkedIn Security Restriction will be allowed(Virus Not Detected) to upload the Malicious file because of Modifying the File Extension.

LinkedIn Messenger

LinkedIn Virus Check ByPassed

so Finally Malicious File will be successfully uploaded without detecting by the LinkedIn security restrictions and once Victims click the file then it will be triggered and successfully infect the victim’s Machine.

Video Demo For Malware Upload into Messenger

Also Abuse the DOCX, XLSM file with embedded Malicious Macro then uploaded successfully to LinkedIn’s CDN, passing the virus check and sent to the victim.later Victims will be Compromised by the Malware.

Checkpoint Reported to LinkedIn Security on 14 June 2017 and LinkedIn Successfully Fixed the Issue.

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

LightSpy iOS Malware Enhanced with 28 New Destructive Plugins

The LightSpy threat actor exploited publicly available vulnerabilities and jailbreak kits to compromise iOS...

ATPC Cyber Forum to Focus on Next Generation Cybersecurity and Artificial Intelligence Issues

White House National Cyber Director, CEOs, Key Financial Services Companies, Congressional and Executive Branch...

New PySilon RAT Abusing Discord Platform to Maintain Persistence

Cybersecurity experts have identified a new Remote Access Trojan (RAT) named PySilon. This Trojan...

Konni APT Hackers Attacking Organizations with New Spear-Phishing Tactics

The notorious Konni Advanced Persistent Threat (APT) group has intensified its cyber assault on...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

New KBOT Virus Injecting Malicious Code in Windows Executable Files to Steal the Victim’s Bank & Personal Data

You're hearing the term "Virus" instead of malware after a long time right!! Yes,...

The Olpair Virus – how to get rid of it

Olpair occasionally referred to as Openload.co Pair is a pop-up virus attributed to the...

Top 10 Dangerous Computer Viruses of All Time

1. Storm WormThe latest virus on our list is the dreaded Storm Worm. It...