Flash Alert: LinkedIn Data Exposure

Flash Alert: LinkedIn Data Exposure

On 22 June 2021, a well-regarded cyber threat actor on a popular English-language Deep Web forum began advertising the public exposure of an alleged 700 million LinkedIn users. Preliminary analysis suggests that the actor abused the official LinkedIn API to obtain the dataset, then compiled and enriched the data to be sold on the forum in question. Based on sample data the actor provided, ZeroFOX assesses that the data includes user information from 2021 and was not compromised as result of any known vulnerabilities in LinkedIn infrastructure.

Standing Intelligence Requirements

For the most up to date list of ZeroFOX Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Recommendations

• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks. 2FA allows for verification of an individual through two methods: a password or personal identification number (PIN) and a token (usually from a mobile device). A token is typically a one-time generated code that can be retrieved from an authenticator application, device, or text message. 2FA increases security by ensuring an account will remain protected even if the password is compromised
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
• Control your visibility and consider limiting the contact information you share in your profile. Even if you do not have contact information in your public profile, there is a lot of potentially sensitive information that threat actors can misuse. Do not include your email address, home address, or phone number in your profile's Summary
• Review your privacy control settings and make changes as needed. Consider limiting access to your feed and setting the “anonymous” profile viewing mode. Please check this section every so often for new privacy options that may be added in the future
• Since LinkedIn offers the ability to contact users via its InMail internal message service, having this functionality enabled could allow threat actors to contact you directly. The risk of social engineering is thus greatly increased
• Consider a LinkedIn Premium subscription, as it would allow you to monitor who viewed your profile. The Who Viewed Your Profile feature displays your profile visitors in the last 90 days, and can provide additional trends and insights about viewers
• Be skeptical of invites you receive from unknown contacts. A common scheme by cyber criminals is the creation of fictional personas on LinkedIn that can be used for corporate espionage. Threat actors can approach executives posing as customer prospects, job recruiters, or former colleagues. Once accepted into the executive's LinkedIn network, the threat actor can send a spear-phishing email or attempt to extract proprietary information and monitor the executive's new connections and clients
• Be aware of fake users. Take the time to verify and look for warning signs. In addition to keyword stuffing and scraped photos, a user with a small number of connections should be viewed as suspicious, as should an incomplete profile and poor spelling. LinkedIn encourages users to report bogus accounts using the drop-down arrow next to that user's profile

Details

The actor is seeking USD $5,000 for the entire dataset and has not disclosed any sales on the forum, as of 30 June. “TomLiner” has been active since February 2021 with a relatively high reputation for the few threads they have created. They most notably were responsible for uploading scraped Facebook data for 533 million users on April 3, 2021, that was collected around August 2019.

Figure 1: Screenshot of actor “TomLiner” post of the alleged compromised data set

Although this data did not include passwords, which could potentially be leveraged in account takeovers or credential stuffing attacks, the data is believed to be valuable in the facilitation of other malicious activity--such as spamming operations, phishing, etc. Although it would be possible to obtain said data through OSINT practices from the LinkedIn platform, the aggregation of the data enables would-be attackers to readily identify and target organization personnel contained therein. While not including passwords, the scraped data included the following fields:

• Email Addresses
• Full names
• Phone numbers
• Physical Addresses
• Geolocation records
• LinkedIn username and profile URL
• Personal, professional experience and background
• Genders
• Other social media accounts and usernames

Responding to this incident, LinkedIn posted a blog on June 29th, stating:

“Our teams have investigated a set of alleged LinkedIn data that has been posted for sale. We want to be clear that this is not a data breach and no private LinkedIn member data was exposed. Our initial investigation has found that this data was scraped from LinkedIn and other various websites and includes the same data reported earlier this year in our April 2021 scraping update.”