LinkedIn Boosts Security With New Session Alert and Privacy Control Tools

With a need to give more controls in users’ hands, LinkedIn has introduced a few new security features that the company says will help users of the social network for professionals keep their accounts and data more secure. SESSION ALERTS Just like Google, Facebook, Yahoo and other online services...

Mozilla MDN Password Disclosure Affects 76,000 Developers

Some members of the Mozilla Developer Network are being advised to change their passwords after email addresses and encrypted credentials were disclosed on a public server. Mozilla director of developer relations Stormy Peters said the organization has been investigating the disclosure for 10 day...

LinkedIn User Account Handling

============================================= Varutra Consulting Responsible Vulnerability Disclosure - Vulnerability release date: November 11th, 2013 - Last revised: February 5th, 2014 - Discovered by: Kishor Sonawane, Varutra Consulting ============================================= 1...

LinkedIn Cross Site Request Forgery

============================================= Varutra Consulting Responsible Vulnerability Disclosure - Vulnerability release date: November 20th, 2013 - Last revised: May 4th, 2014 - Discovered by: Kishor Sonawane, Varutra Consulting ============================================= 1. VULNERABILITY...

Millions of LinkedIn Users at Risk of Man-in-the-Middle Attack

Two year back in 2012, one of the most popular online social networking sites Linkedin spent between $500,000 and $1 million on forensic work after millions of its users’ account passwords were compromised in a major security data breach. But, it seems that the company hasn't learned any lesson...

Nasty Covert Redirect Vulnerability found in OAuth and OpenID

After Heartbleed bug, a security flaw in widely used open-source software OpenSSL that puts countless websites at risk, another vulnerability has been found in popular authentication software OpenID and authorization software OAuth. Wang Jing, a Chinese mathematics Ph.D student at the Nanyang...

LinkedIn Hack Tool Exposes Users' Emails without Exploiting Any Vulnerability

A Free Chrome, Firefox and Safari web browser plugin floating around the web, called 'Sell Hack' allows users to view the hidden email address of any LinkedIn user, means anyone can grab email addresses that we use for professional purposes. When installed, the 'Sell Hack' plugin will pop up a...

LinkedIn Sends Cease-and-Desist to Sell Hack Plug-In Maker

UPDATE: The makers of the controversial Sell Hack browser plug-in responded this afternoon to a cease-and-desist order from LinkedIn and confirmed their extension no longer works on LinkedIn pages and that all of the publicly visible data it had processed from LinkedIn profiles has been deleted...

Qe 4.1.6 Cross Site Scripting

Exploit Title: Qe 4.1.6 Cross site scripting Date: 2014 18 March Author: Dr.3v1l Vendor Homepage: http://c97.net Version : 4.1.6 Tested on: Windows Category: webapps Google Dork: Open your eyeZ + Exploit : http:///qe4.1.6/install/install.php URL encoded GET input cmd was set to : "alert/xss/ The...

Chat2 Cross Site Scripting / SQL Injection

Exploit Title: Chat2 Blind SQL Injection Chat2 Cross site scripting Date: 2014 18 March Author: Dr.3v1l Tested on: Windows Category: webapps Google Dork: inurl:"/chatrooms.php" + Exploit SQL: http:///Chat2/jumpin.php URL encoded POST input userid was set to :...

LinkedIn Intro Service to Shut Down March 7

LinkedIn announced on Friday it was shuttering its four-month-old Intro service which stirred up a privacy meltdown shortly after its release in October. Intro was an integrated service for iOS which sat as a proxy between the built-in iOS mail client and the user’s email provider. Intro would...

LinkedIn shutting down its security-plagued INTRO app in Early March

Last October, the social network 'LinkedIn' launched a controversial Smartphone app called 'Intro' that intercepts and route all of your emails through LinkedIn servers to inject LinkedIn profiles of the sender directly into the mails. The app was released for Android, as well as iOS devices. Why...

HackerOne: LinkedIN URL should be HTTPS

Not really a security bug, but I think will be a good idea to add HTTPS on LinkedIN Share Button. Example page In the right side of page: https://hackerone.com/reports/547 LinkedIN redirect to HTTPS after click, but cookie is sent on the network before that. Thanks!...

NSA allegedly hacked Belgian Cryptography Expert with spoofed LinkedIn Profile

Cryptographer Professor Jean-Jacques Quisquater has become the part of a targeted attack by the US National Security Agency NSA and its British counterpart GCHQ, first reported on Saturday morning by De Standaard. A few months back in September 2013 it was revealed that, Belgacom, the largest...

[Social Password Decryptor v4.0] All-in-one Social Network Password Recovery Software

Social Password Decryptor is the FREE software to instantly recover Passwords for popular Social Networks such as Facebook, Twitter, Google Plus etc. It can automatically discover and recover all the social passwords stored by web browsers & messengers including Firefox, Chrome, IE, GTalk and mor...

LinkedIn iOS app HTML Message Parsing Vulnerability

LinkedIn's iOS application is prone to a vulnerability that may permit remote attackers to execute arbitrary code. Security Researcher Zouheir Abdallah has disclosed HTML parsing vulnerability in LinkedIn iOS an app, that can be used to phish for credentials or be escalated into a full blown...

Two Million stolen Facebook, Twitter login credentials found on 'Pony Botnet' Server

Security researchers at Trustwave's SpiderLabs found a Netherlands-based Pony Botnet Controller Server with almost two Million usernames and passwords, stolen by cybercriminals from users of Facebook, Twitter, Google, Yahoo and other websites. In a blog post, the researchers mentioned that after...

Pony Botnet Controller Has 2 Million Stolen, Weak Passwords

So what’s worse: Finding two million passwords harvested by a botnet, or learning that most of the stolen passwords are terribly weak? Researchers at Trustwave found another Pony botnet controller recently that oversees a trove of close to two million website logins, email account credentials, as...

CVE-2013-5065: Microsoft Windows XP and Server 2003 Privilege escalation Zero-Day exploit discovered

Researchers at FireEye have discovered a new privilege escalation vulnerability in Windows XP and Windows Server 2003. CVE-2013-5065, Local privilege escalation vulnerability is used in-the-wild in conjunction with an Adobe Reader exploit CVE-2013-3346 that appears to target a patched...

Blackhole and Cool Exploit Kits Nearly Extinct

When authorities in Russia arrested Paunch, the alleged creator of the Blackhole exploit kit, last month, security researchers and watchers of the malware underground predicted that taking him off the board would put a dent in the use of Blackhole and force its customers onto other platforms. Six...