LinkedIn security flaws allow account hijacking

LinkedIn users are in danger of having their their account hijacked when accessing it over insecure Wi-Fi networks or public computers, says independent security researcher Rishi Narang, and it’s all due to session and authentications cookies with an unnaturally long lifespan and LinkedIn’s failure to remove them once the user logs out.

The cookies in question are JSESSIONID and LEO_AUTH_TOKEN, and are available even after the session initiated by the user has been terminated.

They are also set to expire only after one solid year, and this fact allowed the researcher to access a number of active accounts of various individuals from all over the world during a period of many months. “They would have login/logged out many a times in these months but their cookie was still valid,” he says.

In addition to all of that, those two cookies and the others that the welcome page stores are transmitted in clear text over HTTP, because they don’t have a secure flag set. “If the secure flag is set on a cookie, then browsers will not submit the cookie in any requests that use an unencrypted HTTP connection, thereby preventing the cookie from being trivially intercepted by an attacker monitoring network traffic,” explains Narang.

According to him, until LinkedIn makes some changes, the only way to “expire” the cookies is for the users to change their password and then authenticate themselves with the new credentials. This could be a stopgap measure if you know that someone has stolen those cookies and is accessing your account, but won’t new cookies be created after the password change and authentication?

It seems to me that the only solution to this problem is for LinkedIn to effect some changes, and according to Reuters, they are planning to offer “opt-in” SSL support for the entire site in the coming months (and that would encrypt the cookies in questions), but have not commented on the fact that the cookies have such a long lifespan.