New LinkedIn Data Leak Leaves 700M Users Exposed
restoreprivacy.com
restoreprivacy.com
A few years back Hotmail/Outlook were returning people's Twitter/LinkedIn handles for emails sent/received. It had been noticed you could scrape that fairly easily at scale. With one email account you could check up to 30000 email addresses before being flagged by Outlook.
Slightly longer ago you could simply iterate 1...n on LinkedIn URLs to find someone's profile, by converting the number to base12, you'd be redirected to the person's public URL.
Also their bulk contact upload. Take any data leak of email addresses, bulk upload them as contacts and then correlate email addresses to social profiles.
Facebook, Twitter and LinkedIn are all bad in that regard on the last method, though Facebook at least do not return people's URLs along with your contact upload (you're expected to know the person's face/name to decide whether you'd want to connect). The take away is that once you sign up, whatever information you put on your profile/account is pretty much available to anyone who wants it enough - and clearly there are plenty bad actors who want it. Obviously these social networks want to expand their network, but they also make it much more easy for data harvesting at unprecedented scale.
This is one of those functionality aspects all these social/networking sites fall foul of one way or another, be email or phone number relational suggestions. That and the aspect of this scraping of phone numbers or emails - even with the users permission, kinda moots the owner of those email and phone details. But does seem that once you give anybody your email or phone number, it kinda one way or another falls into the public domain level of privacy. Heck how many contact details via email or phone numbers do these sites hold on people who never even held an account with them.
Be nice if the law and data privacy had some global standards as this region/country by country aspect does nobody any good and in a World in which taxation works with the same model, do we really want to let data protection end up with data havens in much the same way as tax does.
> He claims the data was obtained by exploiting the LinkedIn API to harvest information that people upload to the site.
> our initial analysis indicates that the dataset includes information scraped from LinkedIn as well as information obtained from other sources. This was not a LinkedIn data breach and our investigation has determined that no private LinkedIn member data was exposed.
If the attacker is telling the truth, Then somehow the attacker has gained access to privileged API of LinkedIn which gives out more fields than those listed in the official LinkedIn API doc[1].
If LinkedIn is telling the truth, Then the source of breach is most likely one of the many data brokers who have been breached several times in the past[2].
[1] https://docs.microsoft.com/en-us/linkedin/shared/references/...
Barest of bones. Removing all connections, photos, posts, personal details. (I know the damage is already done. The aggregators never really delete anything.)
Why not just out right delete my profiles? I'm squatting. To ensure they're not used as socket puppets.
After a beloved coworker passed, their profile got highjacked. Ten years later, I'm still so angry about it that I could just spit.
sock puppets :)
Done much network programming lately?
[0] https://www.thefreedictionary.com/doxx [1] https://en.wikipedia.org/wiki/Doxing#Etymology
Sort of. Data that is 5+ years old is pretty stale. How many things don't change over that period of time and how can you be sure that they haven't changed? The most valuable things are phone numbers and email addresses. We expect those to be maintained so we can re-establish contact with old friends.
Relocate yourself to another city/state/country in your profile. Daily make posts about things occurring in that new location. Make those posts in sync with local time. Of course using a VPN endpoint that correlates.
From the redact.dev FAQ page:
Why don't you support anything made by Google or Apple? At this time, we are reliant on both Google and Apple to be listed in their respective app stores. As such, we have been advised that in order to remain in good standing we should not offer support for these services.
At this point, I just don't add anything new. If they're going to host my content ad infinitum, I might as well use their storage space and bandwidth.
I guess it probably would be worth ditching LinkedIn. There's no good reason why a [worthwhile] prospective employer would require it.
Your past self, current self, and your future self are different people. Don't give in to sunk cost fallacy here.
Good idea. I've noticed more of those popping up. My wife has an Instagram impersonator that constantly spams some kind of essential oils crap or other beauty product snake oil.
It was literally just some idiot binging on drugs who thought it was really funny until i ran over to his place and kicked his door in. I had people ask me what the hell that was about for YEARS afterwards. How do you explain to all these people at parties or whatever that you just happen to know stupider people than they do?
None of this is publicly available.
None of this can even be downloaded by myself when I get a copy of all my data from linkedin...
https://www.linkedin.com/help/linkedin/answer/50191/download...
So I have no idea what information about myself was leaked in this hack
It’s likely that an API endpoint was found and all the data was siphoned off.
How do you know?
https://www.linkedin.com/help/linkedin/answer/4786/source-an...
>When we don’t have member-submitted data, salary insights are inferred using data between similar companies, job titles, location, and other job attributes.
With enough "job attributes", you can easily tie things down to an individual: who worked as <position> at <company> in <city> from <start_date> to <end_date>, doing <job_description> with <colleagues>?
https://restoreprivacy.com/linkedin-data-leak-700-million-us...
Even if you don't considered inferred salary directly tied to you as "personal data," surely you consider geo location personal data?
Also, aren't you even slightly outraged that you can't even download data that has been hacked and released into the wild?
Or outraged by the fact that you can only download data you have given directly to a service provider, but that the service provider will happily tell 3rd parties about your shadow profiles?
Is there anything that shows that it’s your actual geo location when you access LinkedIn?
I received message on WhatsApp from someone claiming to be my LinkedIn contact, I asked how that person got my mobile number and was told my number is visible on my profile.
I didn't remember ever adding my number there, So I dug around to find that LinkedIn published my phone number to all my contacts when I uploaded it for 2FA (LinkedIn didn't have TOTP that time. You needed to have premium account to prevent it from being shown to contacts. I removed the 2FA until LinkedIn got TOTP.
LinkedIn IMO[1] has received far less scrutiny on its practices and content when compared with other social networks while having disproportionately large influence on professional life.
Let me contribute with an anecdote from yesterday (slightly off-topic but I promise to get around to it at the end). So just yesterday I needed to create a Microsoft account to try out Teams which is supposedly free. (I have avoided it so far, but my GF has been asked to use it for an interview and we wanted to do a tech test run before). Of course, the UI on the website assumes (!) that you already have a Microsoft account. It will let you create a Teams account that will fail the login if you do not have a Microsoft account and then sends you around in a Byzantine loop without telling you: Look you need a Microsoft account to use Teams. It looks to me as it just creates a shallow alias or something without root reference. This is dark patterns all over the place.
Anyway, a bit more on topic, I am course using my spam email for this account, but then they ask for my phone number. This is really an issue, because except if I get a burner phone, my personal data is linked with an account of a company I do not trust. After witnessing then how bad teams is almost 1.5 years after everyone is working remotely, (wow their web client does not allow you to share webcam and a window/screen at the same time, while their native client makes it super hard to share content while still seeing the people who you present to), I realised
1. How privileged I am not having to use Microsoft products (need to remember to charge extra, whenever asks me do a job that involves Microsoft products)
2. How anti-competitive Microsoft still is (you cannot login to Teams, MS web auth, in Chromium incognito mode, and it needs a ton of cookie domains whitelisted, even then it does not work)
3. How (and this is not Microsoft specific) difficult it is to not hand over personal data to companies that provide a utility-like service that they pretend is free (so everybody can pretend they are inclusive when they use these services)
4. An then literally a day later it turns out I am not paranoid not trusting Microsoft (and I guess other companies, big or small) with my data, because they are going to loose it sooner or later.
Edit: I just logged back into this MS account. They dont even use the phone number as "2FA". They only send you a text when you register, not for subsequent logins. It looks to me as they just collect it to make sure they really have some personal data to loose..
https://cybernews.com/news/stolen-data-of-500-million-linked...
Or is this a follow on with the rest of the data?
Either way, it's pretty shoddy that they haven't put a stop to it
one of.
This is insane.
So, in essence, this LinkedIn breach is also the same to me. Companies literally make you an attack target for hackers and don't even bother telling you. I don't know about you guys, I haven't received a single email from LinkedIn about this yet. How can we combat this dangerous behaviour of companies hiding their incompetencies from their customers? I thought of litigation and I almost sued Domino's, but who am I kidding? These cases could go on for years while they keep making people attack targets of hackers. And add to that corruption, and other variables. I don't know of what could be done to such companies. Boycotting helps, but imagine, more than half your customers don't know why the rest are boycotting and that's in your favor.
It is a fact that all this data is already being crawled by bot nets.
If all data is leaked at once, this is similar to a large scale successful crawling of the site. At least from a user perspective.
So I get what you are saying. It sounds more dramatic than it actually is. It is still a massive leak. But from a pool that scummy businesses have been thoroughly scooping from already anyway.
I'd be suspicious it was an employee with internal access to the data or someone who had hacked such an employee's computer. Of course they wouldn't admit such criminal act and risk getting caught, they'd claim a route anyone could use.
Not anymore, really. For years now you can't view someone's profile without logging in.
the leaking of semi-public data (over which we may have some control) alongside "inferred bits" and behavioral data (over which we don't) and combined with other legally or illegally obtained sources means that individuals are facing an information environment where long held assumptions about who knows what no longer hold.
lots of people still don't seem to realize what a crushing downgrade it is in all senses (economic, social, political) to be a transparent, mined entity with no sovereignty
never have 700M profiles in one place. decentralization by default - large scale centralization only when absolutely needed and with rigorous controls as a public (or highly regulated) good.
never create portable / tradeable behavioral profiles that can be linked to individuals. what can happen will happen and is happening.
never offer trivial free services in exchange for significant private data. establish a respectful and healthy client/user relation without hidden third parties in the loop
Also, keep in mind that LI has contact information and passwords people might re-use
As a thought experiment imagine that someone now builds a website called Linkedout and they post your profile with a layover animation resembling a big red stamp which reads 'Slacker'. I guess you are not OK with THAT information about you.
LinkedOut: A decentralized 'paid' job profile site for professionals, not recruiters. Where you decide who can see your profile/data and contact you.
I might just build this,but with a better name, lol
You can get it from 2019 FB leak of 533M accounts, dumped for free this April. My boss is in there and phone number is correct.
It is becoming a regular thing, almost part of the news cycle. "In other news, yesterday was the biannual data leak from Linkedin".
It is outrageous.
Possible the attacker slowly downloaded the whole database.
An actual data leak from a breach would contain password hashes and private messages.
It means somehow, people can access that "leaked" data anyway, either with APIs or by paying LinkedIn
I hope they didn't use their phone number to login to their bank, crypto exchange or other social media accounts.
Using phone numbers for login should be completely discouraged.
And it's not really just the phone number, but the combination of personal info that allows for social engineering - without having the existing customer confirm the transfer.
Why would you do that?
I find comments of the form "where are all the folks who were complaining..." to be tiresome. Asking "where are all the folks" suggest that "all the folks" don't exist because... you don't see them on Hacker News? ... because ... you want to make a dig at LinkedIn? ... because [reasons]?
Unless I'm missing something (let me know), this comment seems like a rant based on speculation. Why believe a hacker who says they got this from scraping?
I'm not defending LinkedIn, to be clear. I'm asking for more {elaboration, logic, specificity} and less rhetoric in the comments here.
The problem is the same as with Facebook: they pretend the data is private and secure, then let people siphon it away. Public and private networks are both fine, but huge corporations trying to mix both usually end up with the worst of both worlds.
LinkedIn is self advertising portal for newer better opportunities and that data is actually in public view and someone is selling it to get me better opportunities it sort of sounds fine..
What would be informational is if so called hacker comes and says how he used the data or the tech stack used.
I wish LinkedIn would just go away, it's turning less into a job specific site and more of another facebook full of idiotic political posts etc. I'd rather not have to deal with it at all but it seems employers still sort of expect you to use it.
It scrolljacks you from the beginning and shows a lot of cartoon characters and trite phrases.
It doesn't even do anything yet but ask me to join a waitlist. This is supposed to replace a social network with 700 million users?! It looks horrible.