Say no to LinkedIn stranger requests. They might be scams
Social network warns users to accept only ‘ trusted connections’
Most of us have done it: Eager to build professional leads that might open a door to the next job or sales deal, we’ve accepted that LinkedIn request from an unknown contact. Wrong move. A go- to staple for professionals, LinkedIn can pose dangers to unsuspecting users because people have come to have confidence in it and by extension, implicit faith that all accounts on the platform are legitimate.
Enter the hackers. Cybersecurity firms say criminals have figured out how to subvert the network by posing as authentic, boring, cubicle- office dwellers.
“It’s got trust built into it, and hackers leverage that trust to their own nefarious purposes,” said Allison Wikoff, a senior researcher with the counter threat unit at Secure Works, an Atlantabased security company.
Last month, hackers stole and posted more than 3 terabytes of files from the music video site Vevo — a breach that began with a single phishing attack through LinkedIn. A group called OurMine claimed responsibility.
Once part of a user’s network, a LinkedIn contact can see another’s email address ( if the user has made that available). He or she also has established a personal connection that makes it more likely the target will open an email that contains malware.
“They can really tailor the phishing email to the person’s profile, based on what they do for a living, what type of job they have, all of which makes it so much easier to trick them into clicking a link,” Wikoff said.
The social network, wary of losing its credibility, has tried to stamp out these hoax users and warn its 500 million users to do the same.
“The most important thing LinkedIn members can do to protect themselves is to only accept requests from people they know or recommended contacts from a trusted connection,” said Paul Rockwell, head of LinkedIn’s trust and safety unit.
The company also has an entire team dedicated to finding and rooting out fake accounts, which it says make up a tiny portion of its users, and offers a website to report fake or co- opted accounts.
Acquired by Microsoft in 2016, LinkedIn has become the de facto repository of most people’s occupational lives, a place where their résumé lives and where the world — and potential employers — can find out about their professional abilities.
That’s why you should investigate before you click “Accept,” said J. D. Gershbein, CEO of Owlish Communications, a Chicago-
based company that helps professionals hone their LinkedIn profiles. He only accepts about one out of every five invitations that come his way.
Sometimes attackers simply are trying to harvest email addresses to send spam to. But as in the Vevo case, LinkedIn also can be used as a way to lure the unwary into clicking on phishing emails.
Once the recipient clicks on a link or opens a document that contains malware, the malicious software infiltrates their computer.
Wikoff’s team at SecureWorks spent a year tracking a group it dubbed Cobalt Gypsy, which had created a fake LinkedIn profile for a non- existent photographer named “Mia Ash.” The group targeted telecommunications, government, defense, oil and financial services organizations with links to the Middle East, SecureWorks says. It believes the group was associated with Iranian governmentdirected cyber operations.
The Mia Ash persona used a photo of an attractive young woman, a photographer in Romania with a different name, and the mainly male victims it targeted all too often agreed to connect with her.
Some wonder why it would be worth anyone’s time to target them. But the stakes are low for attackers, say experts.
“It doesn’t cost much. If they run 100 attempts and only two work, it’s a great success rate,” said Joseph Steinberg, with Secure My Social, a firm that works with companies on social media problems.