LinkedIn-based intelligence gathering campaign targets the security industry

Fake job recruiters have attempted to befriend security experts on LinkedIn over the past few weeks

For the past several weeks an intelligence-gathering campaign has been using fake LinkedIn recruiter profiles to map out the professional networks of IT security experts, researchers from F-Secure have discovered.

LinkedIn can be a great tool to establish new professional relationships and discover job opportunities. However, accepting connection requests from unknown people is a double-edged sword that can put both employees and the companies they work for at risk.

There are multiple cases where attackers have used fake LinkedIn profiles to gather sensitive information about organizations and their employees. Knowing who is the manager of a particular department in a company or who is a member of the organization's IT staff can be very useful in planning targeted attacks.

In 2012, a team of security experts created a LinkedIn profile for a fake new female hire at a U.S. government agency as part of a sanctioned test. By befriending multiple employees and establishing relationships, the team raised the credibility of their fake identity and eventually gained enough information to launch a successful attack against the organization's IT security manager, who did not even have a LinkedIn or other social media account.

People tend to expose a lot of information on LinkedIn about their work environments, colleagues, the company's infrastructure and even internal projects.

An organization called the Transparency Toolkit used LinkedIn to collect over 27,000 resumes from people working in the U.S. intelligence community. By analyzing them, it uncovered new surveillance programs, secret code words, companies that help with surveillance and, of course, personal information about signals intelligence analysts.

The suspicious LinkedIn recruiting campaign that targets security researchers was first mentioned on Twitter on Aug. 18 by Yonathan Klijnsma, a threat intelligence analyst at Dutch security firm Fox-IT.

Researchers from Finnish antivirus firm F-Secure decided to look into it after some of the company's own staff were targeted. They published their findings in a blog post Thursday.

The F-Secure researchers found multiple LinkedIn accounts of people claiming to work for a company called Talent Src, or Talent Sources. The accounts, most of which were for female identities, appeared to belong to recruiters for particular security industry specialties like malware analysis, embedded security, mobile security, cryptography, automotive security or digital forensics. Two accounts were specifically hunting security executives.

Reverse image searches revealed that the logo used by Talent Src had been copied from a different organization and had the company name added to it.

The profile pictures used by the fake recruiters were also copied from Instagram or legitimate LinkedIn profiles, but had been horizontally flipped to make reverse image searching harder, the F-Secure researchers said.

At least one of the fake recruiters, using the name Jennifer White, had received endorsements from new connections for skills that she clearly did not have based on her listed work history.

Such endorsements can establish an account's credibility and make it easier for attackers to score additional connections.

A person who endorsed Jennifer White and who works at a large U.S.-based defense contractor admitted that it was "a bad habit to give out such endorsements without really knowing the other person," the F-Secure researchers said.

The people behind the fake recruiting accounts only keep the fake identities they create for about a week and then remove the profile pictures and change the names associated with the accounts.

It's not clear what their end goal is. The campaign could be part of a research project about social media risks that someone plans to disclose at a later time or could be the work of hackers looking to gather information they could use to build targeted attacks against security companies.

According to reports based on documents leaked by former U.S. National Security Agency Edward Snowden, the U.K.'s GCHQ used fake LinkedIn profiles to target network engineers from Belgian telecommunications operator Belgacom in the past.

Regardless of whether this new intelligence gathering campaign is malicious or not, the incident should serve as a reminder to employees everywhere that accepting connection requests from unknown persons on social media can be dangerous and so is detailing your existing work duties in online resumes.

Join the PC World newsletter!

Error: Please check your email address.

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Cool Tech

Crucial Ballistix Elite 32GB Kit (4 x 8GB) DDR4-3000 UDIMM

Learn more >

Gadgets & Things

Lexar® Professional 1000x microSDHC™/microSDXC™ UHS-II cards

Learn more >

Family Friendly

Lexar® JumpDrive® S57 USB 3.0 flash drive 

Learn more >

Stocking Stuffer

Plox Star Wars Death Star Levitating Bluetooth Speaker

Learn more >

Christmas Gift Guide

Click for more ›

Most Popular Reviews

Latest News Articles

Resources

GGG Evaluation Team

Kathy Cassidy

STYLISTIC Q702

First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni

STYLISTIC Q572

For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Steph Mundell

LIFEBOOK UH574

The Fujitsu LifeBook UH574 allowed for great mobility without being obnoxiously heavy or clunky. Its twelve hours of battery life did not disappoint.

Andrew Mitsi

STYLISTIC Q702

The screen was particularly good. It is bright and visible from most angles, however heat is an issue, particularly around the Windows button on the front, and on the back where the battery housing is located.

Simon Harriott

STYLISTIC Q702

My first impression after unboxing the Q702 is that it is a nice looking unit. Styling is somewhat minimalist but very effective. The tablet part, once detached, has a nice weight, and no buttons or switches are located in awkward or intrusive positions.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?