After the constant scandals related to data protection, people would think that Facebook is the most insecure social platform, although unfortunately the application owned by Mark Zuckerberg has serious competitors when it comes to poor security practices.
A couple of weeks ago it was reported that a threat actor was selling about 500 million LinkedIn profiles on an illegal forum on the dark web.
The seller announced that a sample of the information compromise for only two dollars could be for sale to demonstrate the legitimacy of the incident, further notes that the 500 million records will be for sale for millions of dollars.
This leak was already serious on its own, although apparently things can always get much worse. This week a seller was detected on the dark web offering more than 800 million LinkedIn profiles in exchange for $7,000 USD. It should be mentioned that currently this networking platform has fewer than 750 million users, so it is obvious that there are thousands of duplicate or deciduous records in this database.
The seller divided this information into 7 different groups, in addition to mentioning that the records exposed should be the same as those sold by the previous hacker. The cybercriminal also mentioned that it is selling a group of 327 million data.
While there are multiple methods for extracting sensitive information from these platforms, a report from the security firm eSentire notes that there is a method that allows hackers to steal information in bulk. This method, first used by a group identified as Golden Chickens, is based on sending fake job offers to specific users.
These fake offerings include zip attachments that when opened by users will open a folder to automatically install a Trojan on the compromised system. The Trojan collects sensitive information with the operators of the attack.
Microsoft, a company that owns LinkedIn, has already said: “Millions of people use LinkedIn to build work networks and search for jobs, processes that are protected by security mechanisms on the platform so that those involved are certain to be interacting with an authentic profile.” The company adds that such activities are not allowed on the platform and automatic security mechanisms are used for detection and containment.
Finally, the company added that accounts associated with any malicious activity are blocked by the platform. To learn more about information security risks, malware variants, vulnerabilities and information technologies, feel free to access the International Institute of Cyber Security (IICS) websites.
He is a well-known expert in mobile security and malware analysis. He studied Computer Science at NYU and started working as a cyber security analyst in 2003. He is actively working as an anti-malware expert. He also worked for security companies like Kaspersky Lab. His everyday job includes researching about new malware and cyber security incidents. Also he has deep level of knowledge in mobile security and mobile vulnerabilities.
