Security experts warn against using LinkedIn app for Apple iPhone

App embeds link to an email sender's profile and could compromise security of the device

The new LinkedIn iPhone app that embeds a link to an email sender's profile on the professional network presents a number of security risks and should not be used, experts warned.

[LinkedIn joins two-factor login bandwagon to keep hackers out]

Criticism of the app, called Intro, started soon after its release last week. The first to slam LinkedIn was security consultancy Bishop Fox, which accused the site of "hijacking email."

Over the weekend, Jordan Wright, a security engineer at CoNetrix, said he was able to spoof Intro profile information, using a technique that a criminal could easily replicate for a phishing attack.

On Monday, Neohapsis, which does penetration testing and risk assessment for mobile apps, got into the act, saying Intro users were taking on serious risks for a "marginal convenience feature at best."

"I can't think of a situation where a user would agree to a reduced level of transport security of their emails in exchange for the novelty of being able to instantly view their LinkedIn contact's details in the iPhone email client," Gene Meltser, technical director at Neohapsis Labs, said.

LinkedIn has defended Intro, saying the criticism is based on "inaccuracies and misperceptions."

Wright's spoofing experiment started with the interception of the security profile Intro inserts into iOS. He then found the username and password used to log into the LinkedIn service and grabbed the first email to look closely at what LinkedIn injects.

His investigation found that he could remove the Intro data and replace it with his own, thereby commandeering the Intro profile tab to show whatever information he wanted.

While his proof-of-concept would be benign to an email recipient, "it would be just as easy to attach a malicious payload, request sensitive information, etc.," Wright said.

Fox compared Intro to a "man-in-the-middle" attack, because all messages go through LinkedIn servers and are analyzed and scraped for data "pertaining to whatever they feel like it."

Also, by pushing a security profile to the iOS device, so LinkedIn can re-route emails, posed the risk of having the profile used to wipe a phone, install apps, delete apps and restrict functionality.

"You are effectively putting your trust in LinkedIn to manage your users' device security," Fox said.

[20 security and privacy apps for Androids and iPhones]

From a privacy standpoint, sending a message through a third party could waive protections that courts apply only to messages a person tries to keep confidential, Fox said. For people who use their iOS devices for work, Intro would likely violate their companies' security policy, if it bars employees from disclosing sensitive data to a third party.

LinkedIn outlined a number of security measures it took with Intro. For example, "mail content" going through the Intro service is encrypted and deleted once the user has retrieved the mail. However, LinkedIn does store metadata, according to Fox.

LinkedIn also said the iOS device's security profile is not changed, as Fox contended. Instead, the Intro service adds an email account to communicate to its server.

"The profile also sets up a certificate to communicate with the Intro Web endpoint through a Web shortcut on the device," LinkedIn said.

[Twitter admits storing iPhone contact data]

Security consultancy iSEC Partners performed a line-by-line code review of Intro's credential handling and mail parsing/insertion code, LinkedIn said.

"When the LinkedIn security team was presented with the core design of Intro, we made sure we built the most secure implementation we believed possible," the company said.

LinkedIn has suffered security breaches before. Last year, 6.5 million member passwords taken from a LinkedIn server were posted on a Russian hacker forum. The passwords were easily decrypted because the company had used only a rudimentary hashing algorithm that was far weaker than the industry standard.

Join the CSO newsletter!

Error: Please check your email address.

Tags mobile applicationsLinkedInmobile

More about Neohapsis

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Antone Gonsalves

Latest Videos

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

  • 150x50

    IDG Live Webinar:The right collaboration strategy will help your business take flight

    Speakers - Mike Harris, Engineering Services Manager, Jetstar - Christopher Johnson, IT Director APAC, 20th Century Fox - Brent Maxwell, Director of Information Systems, THE ICONIC - IDG MC/Moderator Anthony Caruana

    Play Video

More videos

Blog Posts