Friday, April 12, 2024

New Vulnerability Discovered in LinkedIn Messenger That Allow to Spread Malware and Compromise the Victims PC

World’s largest professional network  LinkedIn That has more than 500 Million Registered users. LinkedIn messenger Platform Vulnerability Allows attacker spread Malware into victims by taking advantage of LinkedIn’s security restrictions Flow.

LinkedIn messenger is the Mostly used Future Platform which helps for professional Community to Share their skills, Messenger easily sends resumes, transfer academic research and share job descriptions from the LinkedIn community.

Normally, LinkedIn security restrictions scan the Malicious activities of the attached File when user send valid files via messenger.

But this LinkedIn messenger Flow allows attacker bypass the LinkedIn security restriction and send a Malicious file which normally looks like a legitimate file but actually its Malicious one.

Based on the LinkedIn Security Restriction, following file format allow to upload and attach to a message.

  • Documents – csv, xls, xlsx, doc, docx, ppt, pptx, pdf, txt.
  • Images– gif, jpeg, jpg, png.

Also Read: Bypass an Anti-Virus Detection with Encrypted Payloads using VENOM Tool

How Does This  Vulnerability Works

This Vulnerability Allows to Attacker upload any Malicious file into LinkedIn messenger by Modifying the file Extension of the Malicious file.

According to Checkpoint Research, A PowerShell script was uploaded into LinkedIn messenger by modifying the Malicious file Extension as .pdf .

LinkedIn Messenger

Malicious File uploading into LinkedIn

Later, Attacker Successfully sends the Malicious file by controls the name of the file (Name parameter), the format of the file (MediaType parameter), and the file extension.

In this Below Response , we could see that LinkedIn Security Restriction will be allowed(Virus Not Detected) to upload the Malicious file because of Modifying the File Extension.

LinkedIn Messenger

LinkedIn Virus Check ByPassed

so Finally Malicious File will be successfully uploaded without detecting by the LinkedIn security restrictions and once Victims click the file then it will be triggered and successfully infect the victim’s Machine.

Video Demo For Malware Upload into Messenger

Also Abuse the DOCX, XLSM file with embedded Malicious Macro then uploaded successfully to LinkedIn’s CDN, passing the virus check and sent to the victim.later Victims will be Compromised by the Malware.

Checkpoint Reported to LinkedIn Security on 14 June 2017 and LinkedIn Successfully Fixed the Issue.

Website

Latest articles

6-year-old Lighttpd Flaw Impacts Intel And Lenovo Servers

The software supply chain is filled with various challenges, such as untracked security vulnerabilities...

Hackers Employ Deepfake Technology To Impersonate as LastPass CEO

A LastPass employee recently became the target of an attempted fraud involving sophisticated audio...

Sisence Data Breach, CISA Urges To Reset Login Credentials

In response to a recent data breach at Sisense, a provider of data analytics...

DuckDuckGo Launches Privacy Pro: 3-in-1 service With VPN

DuckDuckGo has launched Privacy Pro, a new subscription service that promises to enhance user...

Cyber Attack Surge by 28%:Education Sector at High Risk

In Q1 2024, Check Point Research (CPR) witnessed a notable increase in the average...

Midnight Blizzard’s Microsoft Corporate Email Hack Threatens Federal Agencies: CISA Warns

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an emergency directive concerning a...

Taxi App Vendor Data Leak: 300K Passengers Data Exposed

Around 300,000 taxi passengers' personal information was left exposed on the internet, causing concern...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Top 3 SME Attack Vectors

Securing the Top 3 SME Attack Vectors

Cybercriminals are laying siege to small-to-medium enterprises (SMEs) across sectors. 73% of SMEs know they were breached in 2023. The real rate could be closer to 100%.

  • Stolen credentials
  • Phishing
  • Exploitation of vulnerabilities

Related Articles