4 ms·

I'm going to venture against the grain here: this is a really cool hack by LinkedIn. The OP's phishing attacks are equally cool - basically just HTML injection

I'm going to venture against the grain here: this is a really cool hack by LinkedIn. The OP's phishing attacks are equally cool - basically just HTML injection that leverages a vulnerability in LinkedIn's message rewriter. LinkedIn should be able to patch it relatively easily, just as they would on their website.

jwcrux 13y ago
That's the thing, though. I didn't try it, but my guess would be that even if they patch the CSS issue, I believe it would still be possible to set the visibility to hidden (notice they never set the visibility :), and use absolute positioning to set the new content on top of the old. Also, I saw some different results as to where the content is injected. In some cases, it was right in the middle of my content - which seemed weird. Obviously, if they aren't consistently making sure their's has the last say, then it becomes easy to override their settings. Of course - my CSS skills are awful, so someone please feel free to correct me on that.
- colinsidoti 13y ago
  I see HTML/CSS injection as a cat-and-mouse game that the owner usually wins, not the attacker. It'll probably take them a while to catch everything. They could easily kill any CSS that's hitting the #rapportive ID with regex, or by making the ID a unique random string on each email. I believe placing all the original content in a "position:relative; overflow: hidden;" would fix your overlay concerns. Definitely an annoying cat-and-mouse game, but since they're ultimately writing the email that ends up in your inbox, they should be able to consistently prevent this kind of attack.
  - hamburglar 13y ago
    The main problem is that it's a cat and mouse game that really should not be happening in people's email. Saying, "hey, it's no big deal that we're clumsily wanking with your email contents/security because we'll easily be able to fix any problems that arise" is less comforting than simply not clumsily wanking with your email contents/security in the first place.
  - newman314 13y ago
    Replace "HTML/CSS injection" with the word spam and reread it again. If things were true, spam would have died out by now. Admittedly, companies like Gmail do a good job of controlling but sufficiently large volumes of spam get through to the point where it's being opened and clicked where spammers still consider this a viable business. So not, it's not a cat-and-mouse game where the owner wins. A sufficiently determined attacker will still get in. If your thesis were true, we would have built an unhackable computer by now.
- c23gooey 13y ago
  If you've got access to the HTML, then you will be able to override any statement in CSS. Without access to the HTML, you have the chance to get ridiculously specific, eg: * html body div#rapportive...
jyap 13y ago
Let me ask. Is it also a "cool hack" when hotels inject ads into free WiFi? ... Because it is basically the same concept but worse because you just gave up the privacy of your inbox to be data mined and sold. All for some minor conveniences masquerading as a "cool hack". I don't think that's cool at all.
- jmduke 13y ago
  ... Because it is basically the same concept but worse because you just gave up the privacy of your inbox to be data mined and sold. All for some minor conveniences masquerading as a "cool hack". My father's a B2B salesman who spends a lot of time using LinkedIn for lead acquisition. He's thrilled for this thing because he spends "way too much time fiddling with the iPhone browser to try and get this info." I'm not saying the underlying security issues aren't valid, but to say it's a "minor convenience" is a failure of perspective.
- girvo 13y ago
  And I dislike the basic premise of it too. But I can see a lot of other people being okay with the trade-offs needed... just like ads in my hotel WiFi. I don't get why people say it shouldn't be made... it should be made, but they should educate the users as to all of the trade-offs needed. As it stands, I think people are going to be weirded out (as we are) about LinkedIn reading your email. The regular user doesn't love them that much, I'd think, so I think it's likely Intro will fail.

jwcrux 13y ago

That's the thing, though. I didn't try it, but my guess would be that even if they patch the CSS issue, I believe it would still be possible to set the visibility to hidden (notice they never set the visibility :), and use absolute positioning to set the new content on top of the old. Also, I saw some different results as to where the content is injected. In some cases, it was right in the middle of my content - which seemed weird. Obviously, if they aren't consistently making sure their's has the last say, then it becomes easy to override their settings. Of course - my CSS skills are awful, so someone please feel free to correct me on that.

colinsidoti 13y ago
I see HTML/CSS injection as a cat-and-mouse game that the owner usually wins, not the attacker. It'll probably take them a while to catch everything. They could easily kill any CSS that's hitting the #rapportive ID with regex, or by making the ID a unique random string on each email. I believe placing all the original content in a "position:relative; overflow: hidden;" would fix your overlay concerns. Definitely an annoying cat-and-mouse game, but since they're ultimately writing the email that ends up in your inbox, they should be able to consistently prevent this kind of attack.
- hamburglar 13y ago
  The main problem is that it's a cat and mouse game that really should not be happening in people's email. Saying, "hey, it's no big deal that we're clumsily wanking with your email contents/security because we'll easily be able to fix any problems that arise" is less comforting than simply not clumsily wanking with your email contents/security in the first place.
- newman314 13y ago
  Replace "HTML/CSS injection" with the word spam and reread it again. If things were true, spam would have died out by now. Admittedly, companies like Gmail do a good job of controlling but sufficiently large volumes of spam get through to the point where it's being opened and clicked where spammers still consider this a viable business. So not, it's not a cat-and-mouse game where the owner wins. A sufficiently determined attacker will still get in. If your thesis were true, we would have built an unhackable computer by now.
c23gooey 13y ago
If you've got access to the HTML, then you will be able to override any statement in CSS. Without access to the HTML, you have the chance to get ridiculously specific, eg: * html body div#rapportive...

jyap 13y ago

Let me ask. Is it also a "cool hack" when hotels inject ads into free WiFi? ... Because it is basically the same concept but worse because you just gave up the privacy of your inbox to be data mined and sold. All for some minor conveniences masquerading as a "cool hack". I don't think that's cool at all.

jmduke 13y ago
... Because it is basically the same concept but worse because you just gave up the privacy of your inbox to be data mined and sold. All for some minor conveniences masquerading as a "cool hack". My father's a B2B salesman who spends a lot of time using LinkedIn for lead acquisition. He's thrilled for this thing because he spends "way too much time fiddling with the iPhone browser to try and get this info." I'm not saying the underlying security issues aren't valid, but to say it's a "minor convenience" is a failure of perspective.
girvo 13y ago
And I dislike the basic premise of it too. But I can see a lot of other people being okay with the trade-offs needed... just like ads in my hotel WiFi. I don't get why people say it shouldn't be made... it should be made, but they should educate the users as to all of the trade-offs needed. As it stands, I think people are going to be weirded out (as we are) about LinkedIn reading your email. The regular user doesn't love them that much, I'd think, so I think it's likely Intro will fail.