7 ms·

Phishing with Linkedin's Intro

219 points by jwcrux 13y ago

wellboy 13y ago
Well done Jordan, this is a good example of how insincere company culture, which endorses email spam and dark design patterns, WILL backfire. In a company with great culture, this kind of project would have been caught by the various stakeholders of this project and it would not have been released. However, at Linkedin, the engineers and product managers having learned over the years that these kind of things are "fine" and can be looked over as long as the feature brings more engagement, more traffic --> more money, made this dodgy product slip through the cracks of Linkedin. I don't know how many times Linkedin has been on hackernews for email spam, when will they finally get it? I talked to the main growth hacker of Linkedin a while ago who does all the email marketing and asked him if it's not a bit dodgy what they are doing. He smirked and told me how much these strategies boost engagement at Linkedin and how much money they make. This is not something to be proud of, it's like being proud of having stolen 10 kids a lollipop today. Everybody can steal lollipops, build a drug cartel or big company with dodgy maneuvers, because then it is not about how gifted they were, it's how deceitful. That is just not impressive. However, it's insanely impressive to build a company without being dodgy, but just by making a great product that your users love. It's one of the most basic rules of growing a company that pursuing short-term gains (1-2 years) with dodgy maneuvers, directly translate into long-terms losses in the 10-fold numbers of the short term gains. This is not too hard to understand, is the executive team of Linkedin not intelligent enough to get that?
- raganwald 13y ago
  "It's one of the most basic rules of growing a company that pursuing short-term gains (1-2 years) with risky maneuvers, directly translate into long-terms losses in the 10-fold numbers of the short term gains." That may or may not be true, but my basic position is that I want to do business with people who don't care whether dodgy practices will or will not make money in the short, medium, or long term, they have scruples that outweigh their venality.
- hdevalence 13y ago
  If we really think that it's not something to be proud of, we could stop calling these people "growth hackers" and start calling them spammers. Edit: to clarify, "these people" refers to the type of people the parent was complaining about, who use deception and dark patterns, not to all people working on growth in general. Making the distinction is what I'm arguing for.
  - wellboy 13y ago
    Well you know there are also really great/impressive ways to growth hack, such as Noah Kagan who grew Appsumo with his really cool emails that people loved or the guy who made Dropbox go viral by giving 250MB additional data for each new person that signed up.
    - nwh 13y ago
      That being said, LinkedIn are neither of those. They are just spammers.
    - bobytables 13y ago
      Some would argue that Appsumo is sleazy, spammy and dark
  - bulatb 13y ago
    "Growth spammers" has a ring to it.
    - staringispolite 13y ago
      "Growth slackers", perhaps. You know, because rhyming :)
- jmathai 13y ago
  While I don't disagree in principal I'd wager to say that LinkedIn wouldn't have seen the success they have without using these tactics.
- HaloZero 13y ago
  So I'm still a bit confused, what is it exactly that's shady and spammy with "Intro". The basic idea is rapportive right? Get the linkein information about the person emailing you. Is the implementation that's shady/spammy? I don't see how Intro isn't useful for recruiters to instantly have the linkedin profile of the person their emailing available to them on their phone. That way it's a quick reference check.
  - priley 13y ago
    You can do that in secure ways too. We did that (another YC company) with Ark Mail: http://techcrunch.com/2013/09/13/ark-is-like-a-rapportive-mobile-app/ http://techcrunch.com/2013/09/13/ark-is-like-a-rapportive-mo...
    - girvo 13y ago
      That's actually a really neat way of tackling the problem, but it does require people to change habits and use Ark instead of Mail. So while Intro seems to have less friction, you have to give up privacy (HAH. Email and privacy always makes me laugh) to achieve it, which does suck. Shame there wasn't a cooler way to try and handle it by only using headers or something, rather than MITM the whole damned email stack. Ark is neat though. Out of curiosity, how do you handle double notifications? As in, I get a new email, now I've got a notification in Mail and Ark? Or does Ark replace Mail entirely?
  - dsl 13y ago
    The shady part: The way they implemented it allows them to read every single email you send and receive, and that is not obvious to the average user. The spammy part: They toss LinkedIn ads on your emails to other people after you hit send.
    - girvo 13y ago
      Well, in fairness, so can Google (assuming Gmail), etc. etc. The ads bit is a bit shit though.
- cmccabe 13y ago
  For some reason, a few people at HN seem to have a hard-on for criticizing LinkedIn. I never hear the same criticism of Facebook or Twitter here, even though their privacy policies are just as bad, or worse in many cases, and they also send bulk email. I get spammed by all the social networks I've joined, and even by a few that I didn't join. I get mail from every newspaper or magazine I've ever subscribed to, and many that I never have. Condemning one business for doing this while praising another is just hypocrisy.
  - DanBC 13y ago
    > I never hear the same criticism of Facebook [...] here Facebook is regularly criticised, often fiercely, for their invasive privacy policies.
    - austinz 13y ago
      As are Google and Apple (albeit not always for privacy). I think the only oft-mentioned companies I've seen that consistently get better-than-neutral sentiment are Tesla and SpaceX, although there are probably others I'm forgetting.
      - girvo 13y ago
        And that's because Musk is the closest we can get to a tech "rock-star" (ignoring the Blizzard guys who are actual rock-stars and play in a sweet metal band).
  - deleted 13y ago
    [deleted]
  - grey-area 13y ago
    I never hear the same criticism of Facebook or Twitter here, even though their privacy policies are just as bad, or worse in many cases, and they also send bulk email. Intercepting email and inserting content is quantitatively different from sending bulk email. I think this programme is being criticised because it intercepts people's mail and inserts content - that's very different from receiving mail and leads to insecurity on several levels (they see your mail, sharing passwords, getting used to inserted content which can then be imitated for phishing). Also people do criticise FB and Twitter here too, but the objection is not spamming.
- pclark 13y ago
  I really don't understand how you can connect the dots of LinkedIn's (admittedly crappy) marketing emails and Intro existing. It seems quite simple really: People loved Rapportive, people wanted Rapportive outside of GMail, Rapportive delivered. > It's one of the most basic rules of growing a company that pursuing short-term gains (1-2 years) with dodgy maneuvers, directly translate into long-terms losses in the 10-fold numbers of the short term gains. This is not too hard to understand, is the executive team of Linkedin not intelligent enough to get that? http://www.businessinsider.com/linkedin-stock-performance-2012-8 http://www.businessinsider.com/linkedin-stock-performance-20... Amazingly you've managed to crap not only on the Intro team, not only on the Intro team and LinkedIn executives, but every single LinkedIn employee – please tell me more about how to build this great culture you champion.
  - pinaceae 13y ago
    don't be evil.
    - tonyplee 13y ago
      The company that used that slogan had felt "the power of the dark side." :-)
  - dsl 13y ago
    I've said it before on HN (and was attacked for it), but I will say it again. LinkedIn is not a tech company, it is a bunch of business people who hired technologists to build a website. Sure, lots of good tech has been open sourced by LinkedIn employees, but none of them sit in decision making capacities (or Intro would not exist). THAT is the culture problem.
    - PakG1 13y ago
      You seem to be implying that tech companies can have a higher moral ground. They're still run by people. Technologists can still be culpable even if they're in positions of authority precisely because they are people. Any other way of thinking is a gross over-generalization of people's ability and desire to do the right thing. Besides, even if they aren't in the positions of authority, technologists can still be culpable. I thought we already had enough examples in history of culpable people who were "simply following orders" to render such types of discussions moot.
- afterburner 13y ago
  "It's one of the most basic rules of growing a company that pursuing short-term gains (1-2 years) with dodgy maneuvers" They're just copying the people in the financial industry. And the people involved made very nice sums of money, so their intelligence was successfully used to their own personal benefit. Maybe the stock runup has made it such that they think they're just squeezing the last few drops out of this before they fully cash out. This is pure speculation of course, but I gather this scenario is a risk with any company that has a lot of hype and such employee exit paths.
  - wellboy 13y ago
    Good point, it's probably that no one is there anymore who cares about the long-term mission of Linkedin. Reid Hoffman is rich now anyway why would he care. The reason for that is probably also though that Linkedin is not a passion product. It's not that their employees/founders are super passionate about connecting employees to employers, they are passionate about it making money. It's a bit understandable though, it's not easy to have a really strong passion for Linkedin or its mission.
- newman314 13y ago
  So who is this "main growth hacker"? Sidebar: What the heck does "main growth hacker" even supposed to mean? It blows my mind when people start coming up with new names for what they do. "Senior sanitation engineer" etc.
_anshulk 13y ago
I am not a linkedin employee but I wonder what an employee should do or in this case have done when business was insisting on developing such a feature?
- wellboy 13y ago
  Stir the debate, escalate it to management, make your co-workers aware of the wrongdoing. If it's shoved under the carpet, leave, maybe write a blog post. However, most people care more about their job than their values and for that reason, remain quiet. As long as the paycheck's comin' in, u kno. You've probably heard of a story like this before recently, just on a bigger scale.
  - colinbartlett 13y ago
    I'd argue that software engineers are some of the most resistant people in the workforce to these kinds of moral high-wire acts. That's simply because they have way more job security than others. They can pick and choose companies with which they are in moral agreement and jump ship when something they disagree with is forced upon them.
    - wellboy 13y ago
      You'd think so, but it took a decade until Snowden was the first one of these 10,000 engineers to speak up.
      - jonny_eh 13y ago
        That's because it's super easy to rationalize things like this. From the outside, hearing about Intro for the first time, our initial reaction may be "WTF?". But from inside the company it was a slow boil. You know that you mean no harm, and the people you work with are good people, and they mean no harm either. And hey, you're taking all these precautions like using separate servers, and getting security audit checks. And hey, isn't this a clever way to add a cool feature? Before you know it, it's too late to say "no". Something that may have started as a good idea has transformed into a monster. Human cognitive biases will then kick into action and save you from admitting to yourself that you're part of the problem.
cmccabe 13y ago
Based on everything I've read, LinkedIn didn't develop this technology. They bought it when they acquired Rapportive (which, by the way, was a Y Combinator startup). Can someone explain the technical details here a little more? I feel like a few steps are missing in the explanation. Why does Rapportive/Intro need a separate IMAP account attached to the device? How could LinkedIn ever think email could be secure? Email is a plain-text protocol based on trust. Can't people just spoof source addresses and inject whatever they want into the next email server in the chain?
- wellboy 13y ago
  Well if Rapportive was acquired by Linkedin, Linkedin will have had a big influence on this project.
- jwcrux 13y ago
  Sorry - I tried to keep the post to a reasonable length. I'll be following up with a more detailed post later. :) The separate IMAP account is likely so that they wouldn't ever touch the user's Gmail credentials. This way, they do everything via the OAuth token they retrieve. Also, I'm not sure if they can know for sure that the user has synced their Gmail account to their iPhone or not. I don't know how Linkedin thought this was a good idea. This is clearly one of those cases where the functionality benefits are greatly outweighed by the security risks. This shouldn't have been made. Thanks for reading!
  - colinsidoti 13y ago
    I don't know the details of IMAP well enough, but isn't the proxy what allows them to inject HTML into the email that iPhone's Mail app sees, but not any other client?
    - jwcrux 13y ago
      Yes - they need to perform what's called a Man in the Middle Attack (MiTM) to inject HTML into your email. Normally, your iPhone (and other clients) retrieve email from Gmail's servers using the IMAP protocol. To inject content, Linkedin setup a security profile which placed themselves in the middle so you connect via IMAP to their servers, they fetch the content using IMAP from Google, inject their content, and feed it back to you. This is why the email is not permanently changed. Only changed en route to your iPhone.
colinsidoti 13y ago
I'm going to venture against the grain here: this is a really cool hack by LinkedIn. The OP's phishing attacks are equally cool - basically just HTML injection that leverages a vulnerability in LinkedIn's message rewriter. LinkedIn should be able to patch it relatively easily, just as they would on their website.
- jwcrux 13y ago
  That's the thing, though. I didn't try it, but my guess would be that even if they patch the CSS issue, I believe it would still be possible to set the visibility to hidden (notice they never set the visibility :), and use absolute positioning to set the new content on top of the old. Also, I saw some different results as to where the content is injected. In some cases, it was right in the middle of my content - which seemed weird. Obviously, if they aren't consistently making sure their's has the last say, then it becomes easy to override their settings. Of course - my CSS skills are awful, so someone please feel free to correct me on that.
  - colinsidoti 13y ago
    I see HTML/CSS injection as a cat-and-mouse game that the owner usually wins, not the attacker. It'll probably take them a while to catch everything. They could easily kill any CSS that's hitting the #rapportive ID with regex, or by making the ID a unique random string on each email. I believe placing all the original content in a "position:relative; overflow: hidden;" would fix your overlay concerns. Definitely an annoying cat-and-mouse game, but since they're ultimately writing the email that ends up in your inbox, they should be able to consistently prevent this kind of attack.
    - hamburglar 13y ago
      The main problem is that it's a cat and mouse game that really should not be happening in people's email. Saying, "hey, it's no big deal that we're clumsily wanking with your email contents/security because we'll easily be able to fix any problems that arise" is less comforting than simply not clumsily wanking with your email contents/security in the first place.
bcx 13y ago
It seems that this same exploit would work for anyone using apple mail. Isn't Linkedin-Intro is just exploiting the fact that Apple Mail renders HTML.
- forsaken 13y ago
  It's the expectation of the user that this is hacking. Inserting the HTML into a non-Intro user's email wouldn't make sense. But sense the user is expecting that data, and for it to be validated, spoofing it becomes much more valuable.
- coldcode 13y ago
  You have to manually accept the profile that allows this. Of course many people have no idea what a bad thing this is.
deleted 13y ago
[deleted]
amolsarva 13y ago
Perhaps a bit naive of me, but can't ANY email sender just include html/css of this type in their spam or regular mail to me? Can't any email sender spoof the sender identity in various ways, e.g., from name, signature, and sure this picture badge thing?
- deno 13y ago
  With SPF and DKIM you cannot spoof the envelope address and the “From:” header email address. If SPF would actually be required instead of optional (or even ignored), we could be free of 99% of SPAM and phising emails maybe as soon as 2009! Anyway the point of the post is that if you just add the badge thing you will end up with two different badges, which the user would obviously find suspicious. Instead, the way LinkedIn rewrites messages is exploited to get only a single badge but manipulate its content (and/or the message content). Since the message looks authentic (it’s been filtered by LinkedIn) it gives the user a false sense of security, which makes a naïve phising attempt into a very effective one. After all the point of the message rewriting was to give the impression that LinkedIn Intro is an extension to the actual email client.
joeblau 13y ago
Does this look like a man in the middle attack to anyone else?
- galonk 13y ago
  I wouldn't say "looks like".
unlogic 13y ago
This reminds me of Caller ID spoofing. It was nicely described in Kevin Mitnick's book "The Art of Deception".
pilif 13y ago
One of the things that really scares me about this is the configuration profile thing. Yes. These profiles might contain just an email account. But the UI you get when the profile also contains, say, a new root certificate is the exact same UI. As a user there's no way to see whether the profile you just accepted is just adding an email configuration or whether it's setting a global proxy server that even does SSL interception because the profile also contained that proxies root certificate. Worse, by accepting one of these, you could also (again, same UI) accept whoever sent you the profile to use MDN functionality on your device, allowing to track the devices location (GPS accuracy) and to remotely wipe it. For these reasons, I would never, ever, ever accept a configuration profile and I would recommend you don't accept one either. This isn't just for linkedin either - a grocery store chain here allows for easy camera based self-scanning. The only thing you have to do is to accept their configuration profile so the phone can join a special in-store WiFi and I suspect other companies do the same crap. Accepting one of these is as close to installing malware as you can get.
general_failure 13y ago
I cannot believe they bought this tech for 15m. Think about it : 15m. I have said this many times before but I really need to get off my ass and just do something. Looks like anything sells these days. Especially a spectacle. Just do something that attracts attention. Sell it. Retire. This is not about tech. /grumpy me
- driverdan 13y ago
  You don't seem to understand Rapportive. This is a new thing they built as members of LI, not the product they bought. Rapportive is a great tool that's extremely useful. If anything $15m was low.
staringispolite 13y ago
Thanks for the article. It seems unlikely that you could scale the first step: harvesting the iPhone profiles in the first place. I was under the impression this is a one-time download. Is there any realistic way to get a significant number of these?

219 points by jwcrux 13y ago

Well done Jordan, this is a good example of how insincere company culture, which endorses email spam and dark design patterns, WILL backfire. In a company with great culture, this kind of project would have been caught by the various stakeholders of this project and it would not have been released. However, at Linkedin, the engineers and product managers having learned over the years that these kind of things are "fine" and can be looked over as long as the feature brings more engagement, more traffic --> more money, made this dodgy product slip through the cracks of Linkedin. I don't know how many times Linkedin has been on hackernews for email spam, when will they finally get it? I talked to the main growth hacker of Linkedin a while ago who does all the email marketing and asked him if it's not a bit dodgy what they are doing. He smirked and told me how much these strategies boost engagement at Linkedin and how much money they make. This is not something to be proud of, it's like being proud of having stolen 10 kids a lollipop today. Everybody can steal lollipops, build a drug cartel or big company with dodgy maneuvers, because then it is not about how gifted they were, it's how deceitful. That is just not impressive. However, it's insanely impressive to build a company without being dodgy, but just by making a great product that your users love. It's one of the most basic rules of growing a company that pursuing short-term gains (1-2 years) with dodgy maneuvers, directly translate into long-terms losses in the 10-fold numbers of the short term gains. This is not too hard to understand, is the executive team of Linkedin not intelligent enough to get that?

raganwald 13y ago
"It's one of the most basic rules of growing a company that pursuing short-term gains (1-2 years) with risky maneuvers, directly translate into long-terms losses in the 10-fold numbers of the short term gains." That may or may not be true, but my basic position is that I want to do business with people who don't care whether dodgy practices will or will not make money in the short, medium, or long term, they have scruples that outweigh their venality.
hdevalence 13y ago
If we really think that it's not something to be proud of, we could stop calling these people "growth hackers" and start calling them spammers. Edit: to clarify, "these people" refers to the type of people the parent was complaining about, who use deception and dark patterns, not to all people working on growth in general. Making the distinction is what I'm arguing for.
- wellboy 13y ago
  Well you know there are also really great/impressive ways to growth hack, such as Noah Kagan who grew Appsumo with his really cool emails that people loved or the guy who made Dropbox go viral by giving 250MB additional data for each new person that signed up.
  - nwh 13y ago
    That being said, LinkedIn are neither of those. They are just spammers.
  - bobytables 13y ago
    Some would argue that Appsumo is sleazy, spammy and dark
- bulatb 13y ago
  "Growth spammers" has a ring to it.
  - staringispolite 13y ago
    "Growth slackers", perhaps. You know, because rhyming :)
jmathai 13y ago
While I don't disagree in principal I'd wager to say that LinkedIn wouldn't have seen the success they have without using these tactics.
HaloZero 13y ago
So I'm still a bit confused, what is it exactly that's shady and spammy with "Intro". The basic idea is rapportive right? Get the linkein information about the person emailing you. Is the implementation that's shady/spammy? I don't see how Intro isn't useful for recruiters to instantly have the linkedin profile of the person their emailing available to them on their phone. That way it's a quick reference check.
- priley 13y ago
  You can do that in secure ways too. We did that (another YC company) with Ark Mail: http://techcrunch.com/2013/09/13/ark-is-like-a-rapportive-mobile-app/ http://techcrunch.com/2013/09/13/ark-is-like-a-rapportive-mo...
  - girvo 13y ago
    That's actually a really neat way of tackling the problem, but it does require people to change habits and use Ark instead of Mail. So while Intro seems to have less friction, you have to give up privacy (HAH. Email and privacy always makes me laugh) to achieve it, which does suck. Shame there wasn't a cooler way to try and handle it by only using headers or something, rather than MITM the whole damned email stack. Ark is neat though. Out of curiosity, how do you handle double notifications? As in, I get a new email, now I've got a notification in Mail and Ark? Or does Ark replace Mail entirely?
- dsl 13y ago
  The shady part: The way they implemented it allows them to read every single email you send and receive, and that is not obvious to the average user. The spammy part: They toss LinkedIn ads on your emails to other people after you hit send.
  - girvo 13y ago
    Well, in fairness, so can Google (assuming Gmail), etc. etc. The ads bit is a bit shit though.
cmccabe 13y ago
For some reason, a few people at HN seem to have a hard-on for criticizing LinkedIn. I never hear the same criticism of Facebook or Twitter here, even though their privacy policies are just as bad, or worse in many cases, and they also send bulk email. I get spammed by all the social networks I've joined, and even by a few that I didn't join. I get mail from every newspaper or magazine I've ever subscribed to, and many that I never have. Condemning one business for doing this while praising another is just hypocrisy.
- DanBC 13y ago
  > I never hear the same criticism of Facebook [...] here Facebook is regularly criticised, often fiercely, for their invasive privacy policies.
  - austinz 13y ago
    As are Google and Apple (albeit not always for privacy). I think the only oft-mentioned companies I've seen that consistently get better-than-neutral sentiment are Tesla and SpaceX, although there are probably others I'm forgetting.
    - girvo 13y ago
      And that's because Musk is the closest we can get to a tech "rock-star" (ignoring the Blizzard guys who are actual rock-stars and play in a sweet metal band).
- deleted 13y ago
  [deleted]
- grey-area 13y ago
  I never hear the same criticism of Facebook or Twitter here, even though their privacy policies are just as bad, or worse in many cases, and they also send bulk email. Intercepting email and inserting content is quantitatively different from sending bulk email. I think this programme is being criticised because it intercepts people's mail and inserts content - that's very different from receiving mail and leads to insecurity on several levels (they see your mail, sharing passwords, getting used to inserted content which can then be imitated for phishing). Also people do criticise FB and Twitter here too, but the objection is not spamming.
pclark 13y ago
I really don't understand how you can connect the dots of LinkedIn's (admittedly crappy) marketing emails and Intro existing. It seems quite simple really: People loved Rapportive, people wanted Rapportive outside of GMail, Rapportive delivered. > It's one of the most basic rules of growing a company that pursuing short-term gains (1-2 years) with dodgy maneuvers, directly translate into long-terms losses in the 10-fold numbers of the short term gains. This is not too hard to understand, is the executive team of Linkedin not intelligent enough to get that? http://www.businessinsider.com/linkedin-stock-performance-2012-8 http://www.businessinsider.com/linkedin-stock-performance-20... Amazingly you've managed to crap not only on the Intro team, not only on the Intro team and LinkedIn executives, but every single LinkedIn employee – please tell me more about how to build this great culture you champion.
- pinaceae 13y ago
  don't be evil.
  - tonyplee 13y ago
    The company that used that slogan had felt "the power of the dark side." :-)
- dsl 13y ago
  I've said it before on HN (and was attacked for it), but I will say it again. LinkedIn is not a tech company, it is a bunch of business people who hired technologists to build a website. Sure, lots of good tech has been open sourced by LinkedIn employees, but none of them sit in decision making capacities (or Intro would not exist). THAT is the culture problem.
  - PakG1 13y ago
    You seem to be implying that tech companies can have a higher moral ground. They're still run by people. Technologists can still be culpable even if they're in positions of authority precisely because they are people. Any other way of thinking is a gross over-generalization of people's ability and desire to do the right thing. Besides, even if they aren't in the positions of authority, technologists can still be culpable. I thought we already had enough examples in history of culpable people who were "simply following orders" to render such types of discussions moot.
afterburner 13y ago
"It's one of the most basic rules of growing a company that pursuing short-term gains (1-2 years) with dodgy maneuvers" They're just copying the people in the financial industry. And the people involved made very nice sums of money, so their intelligence was successfully used to their own personal benefit. Maybe the stock runup has made it such that they think they're just squeezing the last few drops out of this before they fully cash out. This is pure speculation of course, but I gather this scenario is a risk with any company that has a lot of hype and such employee exit paths.
- wellboy 13y ago
  Good point, it's probably that no one is there anymore who cares about the long-term mission of Linkedin. Reid Hoffman is rich now anyway why would he care. The reason for that is probably also though that Linkedin is not a passion product. It's not that their employees/founders are super passionate about connecting employees to employers, they are passionate about it making money. It's a bit understandable though, it's not easy to have a really strong passion for Linkedin or its mission.
newman314 13y ago
So who is this "main growth hacker"? Sidebar: What the heck does "main growth hacker" even supposed to mean? It blows my mind when people start coming up with new names for what they do. "Senior sanitation engineer" etc.

_anshulk 13y ago

I am not a linkedin employee but I wonder what an employee should do or in this case have done when business was insisting on developing such a feature?

wellboy 13y ago
Stir the debate, escalate it to management, make your co-workers aware of the wrongdoing. If it's shoved under the carpet, leave, maybe write a blog post. However, most people care more about their job than their values and for that reason, remain quiet. As long as the paycheck's comin' in, u kno. You've probably heard of a story like this before recently, just on a bigger scale.
- colinbartlett 13y ago
  I'd argue that software engineers are some of the most resistant people in the workforce to these kinds of moral high-wire acts. That's simply because they have way more job security than others. They can pick and choose companies with which they are in moral agreement and jump ship when something they disagree with is forced upon them.
  - wellboy 13y ago
    You'd think so, but it took a decade until Snowden was the first one of these 10,000 engineers to speak up.
    - jonny_eh 13y ago
      That's because it's super easy to rationalize things like this. From the outside, hearing about Intro for the first time, our initial reaction may be "WTF?". But from inside the company it was a slow boil. You know that you mean no harm, and the people you work with are good people, and they mean no harm either. And hey, you're taking all these precautions like using separate servers, and getting security audit checks. And hey, isn't this a clever way to add a cool feature? Before you know it, it's too late to say "no". Something that may have started as a good idea has transformed into a monster. Human cognitive biases will then kick into action and save you from admitting to yourself that you're part of the problem.

cmccabe 13y ago

Based on everything I've read, LinkedIn didn't develop this technology. They bought it when they acquired Rapportive (which, by the way, was a Y Combinator startup). Can someone explain the technical details here a little more? I feel like a few steps are missing in the explanation. Why does Rapportive/Intro need a separate IMAP account attached to the device? How could LinkedIn ever think email could be secure? Email is a plain-text protocol based on trust. Can't people just spoof source addresses and inject whatever they want into the next email server in the chain?

wellboy 13y ago
Well if Rapportive was acquired by Linkedin, Linkedin will have had a big influence on this project.
jwcrux 13y ago
Sorry - I tried to keep the post to a reasonable length. I'll be following up with a more detailed post later. :) The separate IMAP account is likely so that they wouldn't ever touch the user's Gmail credentials. This way, they do everything via the OAuth token they retrieve. Also, I'm not sure if they can know for sure that the user has synced their Gmail account to their iPhone or not. I don't know how Linkedin thought this was a good idea. This is clearly one of those cases where the functionality benefits are greatly outweighed by the security risks. This shouldn't have been made. Thanks for reading!
- colinsidoti 13y ago
  I don't know the details of IMAP well enough, but isn't the proxy what allows them to inject HTML into the email that iPhone's Mail app sees, but not any other client?
  - jwcrux 13y ago
    Yes - they need to perform what's called a Man in the Middle Attack (MiTM) to inject HTML into your email. Normally, your iPhone (and other clients) retrieve email from Gmail's servers using the IMAP protocol. To inject content, Linkedin setup a security profile which placed themselves in the middle so you connect via IMAP to their servers, they fetch the content using IMAP from Google, inject their content, and feed it back to you. This is why the email is not permanently changed. Only changed en route to your iPhone.

colinsidoti 13y ago

I'm going to venture against the grain here: this is a really cool hack by LinkedIn. The OP's phishing attacks are equally cool - basically just HTML injection that leverages a vulnerability in LinkedIn's message rewriter. LinkedIn should be able to patch it relatively easily, just as they would on their website.

jwcrux 13y ago
That's the thing, though. I didn't try it, but my guess would be that even if they patch the CSS issue, I believe it would still be possible to set the visibility to hidden (notice they never set the visibility :), and use absolute positioning to set the new content on top of the old. Also, I saw some different results as to where the content is injected. In some cases, it was right in the middle of my content - which seemed weird. Obviously, if they aren't consistently making sure their's has the last say, then it becomes easy to override their settings. Of course - my CSS skills are awful, so someone please feel free to correct me on that.
- colinsidoti 13y ago
  I see HTML/CSS injection as a cat-and-mouse game that the owner usually wins, not the attacker. It'll probably take them a while to catch everything. They could easily kill any CSS that's hitting the #rapportive ID with regex, or by making the ID a unique random string on each email. I believe placing all the original content in a "position:relative; overflow: hidden;" would fix your overlay concerns. Definitely an annoying cat-and-mouse game, but since they're ultimately writing the email that ends up in your inbox, they should be able to consistently prevent this kind of attack.
  - hamburglar 13y ago
    The main problem is that it's a cat and mouse game that really should not be happening in people's email. Saying, "hey, it's no big deal that we're clumsily wanking with your email contents/security because we'll easily be able to fix any problems that arise" is less comforting than simply not clumsily wanking with your email contents/security in the first place.

bcx 13y ago

It seems that this same exploit would work for anyone using apple mail. Isn't Linkedin-Intro is just exploiting the fact that Apple Mail renders HTML.

forsaken 13y ago
It's the expectation of the user that this is hacking. Inserting the HTML into a non-Intro user's email wouldn't make sense. But sense the user is expecting that data, and for it to be validated, spoofing it becomes much more valuable.
coldcode 13y ago
You have to manually accept the profile that allows this. Of course many people have no idea what a bad thing this is.

deleted 13y ago

[deleted]

amolsarva 13y ago

Perhaps a bit naive of me, but can't ANY email sender just include html/css of this type in their spam or regular mail to me? Can't any email sender spoof the sender identity in various ways, e.g., from name, signature, and sure this picture badge thing?

deno 13y ago
With SPF and DKIM you cannot spoof the envelope address and the “From:” header email address. If SPF would actually be required instead of optional (or even ignored), we could be free of 99% of SPAM and phising emails maybe as soon as 2009! Anyway the point of the post is that if you just add the badge thing you will end up with two different badges, which the user would obviously find suspicious. Instead, the way LinkedIn rewrites messages is exploited to get only a single badge but manipulate its content (and/or the message content). Since the message looks authentic (it’s been filtered by LinkedIn) it gives the user a false sense of security, which makes a naïve phising attempt into a very effective one. After all the point of the message rewriting was to give the impression that LinkedIn Intro is an extension to the actual email client.

joeblau 13y ago

Does this look like a man in the middle attack to anyone else?

galonk 13y ago
I wouldn't say "looks like".

unlogic 13y ago

This reminds me of Caller ID spoofing. It was nicely described in Kevin Mitnick's book "The Art of Deception".

pilif 13y ago

One of the things that really scares me about this is the configuration profile thing. Yes. These profiles might contain just an email account. But the UI you get when the profile also contains, say, a new root certificate is the exact same UI. As a user there's no way to see whether the profile you just accepted is just adding an email configuration or whether it's setting a global proxy server that even does SSL interception because the profile also contained that proxies root certificate. Worse, by accepting one of these, you could also (again, same UI) accept whoever sent you the profile to use MDN functionality on your device, allowing to track the devices location (GPS accuracy) and to remotely wipe it. For these reasons, I would never, ever, ever accept a configuration profile and I would recommend you don't accept one either. This isn't just for linkedin either - a grocery store chain here allows for easy camera based self-scanning. The only thing you have to do is to accept their configuration profile so the phone can join a special in-store WiFi and I suspect other companies do the same crap. Accepting one of these is as close to installing malware as you can get.

general_failure 13y ago

I cannot believe they bought this tech for 15m. Think about it : 15m. I have said this many times before but I really need to get off my ass and just do something. Looks like anything sells these days. Especially a spectacle. Just do something that attracts attention. Sell it. Retire. This is not about tech. /grumpy me

driverdan 13y ago
You don't seem to understand Rapportive. This is a new thing they built as members of LI, not the product they bought. Rapportive is a great tool that's extremely useful. If anything $15m was low.

staringispolite 13y ago

Thanks for the article. It seems unlikely that you could scale the first step: harvesting the iPhone profiles in the first place. I was under the impression this is a one-time download. Is there any realistic way to get a significant number of these?