Categories: Virus

New Vulnerability Discovered in LinkedIn Messenger That Allow to Spread Malware and Compromise the Victims PC

World’s largest professional network  LinkedIn That has more than 500 Million Registered users. LinkedIn messenger Platform Vulnerability Allows attacker spread Malware into victims by taking advantage of LinkedIn’s security restrictions Flow.

LinkedIn messenger is the Mostly used Future Platform which helps for professional Community to Share their skills, Messenger easily sends resumes, transfer academic research and share job descriptions from the LinkedIn community.

Normally, LinkedIn security restrictions scan the Malicious activities of the attached File when user send valid files via messenger.

But this LinkedIn messenger Flow allows attacker bypass the LinkedIn security restriction and send a Malicious file which normally looks like a legitimate file but actually its Malicious one.

Based on the LinkedIn Security Restriction, following file format allow to upload and attach to a message.

  • Documents – csv, xls, xlsx, doc, docx, ppt, pptx, pdf, txt.
  • Images– gif, jpeg, jpg, png.

Also Read: Bypass an Anti-Virus Detection with Encrypted Payloads using VENOM Tool

How Does This  Vulnerability Works

This Vulnerability Allows to Attacker upload any Malicious file into LinkedIn messenger by Modifying the file Extension of the Malicious file.

According to Checkpoint Research, A PowerShell script was uploaded into LinkedIn messenger by modifying the Malicious file Extension as .pdf .

Malicious File uploading into LinkedIn

Later, Attacker Successfully sends the Malicious file by controls the name of the file (Name parameter), the format of the file (MediaType parameter), and the file extension.

In this Below Response , we could see that LinkedIn Security Restriction will be allowed(Virus Not Detected) to upload the Malicious file because of Modifying the File Extension.

LinkedIn Virus Check ByPassed

so Finally Malicious File will be successfully uploaded without detecting by the LinkedIn security restrictions and once Victims click the file then it will be triggered and successfully infect the victim’s Machine.

Video Demo For Malware Upload into Messenger

Also Abuse the DOCX, XLSM file with embedded Malicious Macro then uploaded successfully to LinkedIn’s CDN, passing the virus check and sent to the victim.later Victims will be Compromised by the Malware.

Checkpoint Reported to LinkedIn Security on 14 June 2017 and LinkedIn Successfully Fixed the Issue.

Balaji

BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Recent Posts

LightSpy iOS Malware Enhanced with 28 New Destructive Plugins

The LightSpy threat actor exploited publicly available vulnerabilities and jailbreak kits to compromise iOS devices.…

1 day ago

ATPC Cyber Forum to Focus on Next Generation Cybersecurity and Artificial Intelligence Issues

White House National Cyber Director, CEOs, Key Financial Services Companies, Congressional and Executive Branch Experts…

3 days ago

New PySilon RAT Abusing Discord Platform to Maintain Persistence

Cybersecurity experts have identified a new Remote Access Trojan (RAT) named PySilon. This Trojan exploits…

3 days ago

Konni APT Hackers Attacking Organizations with New Spear-Phishing Tactics

The notorious Konni Advanced Persistent Threat (APT) group has intensified its cyber assault on organizations…

3 days ago

Google Chrome Security, Critical Vulnerabilities Patched

Google has updated its Chrome browser, addressing critical vulnerabilities that posed potential risks to millions…

4 days ago

Notorious WrnRAT Delivered Mimic As Gambling Games

WrnRAT is a new malware attack that cybercriminals have deployed by using popular gambling games…

4 days ago