Your LinkedIn profile can be a very good source of hacker attacks
An IT security expert was recently asked:
“If you were a criminal hacker trying to exploit a company – causing irreparable harm through a breach – what is the first thing you would do?” The answer was short and easy: I would hit LinkedIn. LinkedIn is a treasure trove of easily accessible information and company IT data.
But why is LinkedIn so attractive to hackers?
To answer this question, it would be beneficial to examine LinkedIn through the eyes of a hacker.
Searching for a specific company on LinkedIn will bring up all the profiles of professionals working for that company, some of which will include the person’s professional email address. Once a hacker has seen a few email addresses for the same company, they have learned the company’s email address structure (for example: firstname.lastname@companyname.com) and can build an email list of employees to target. In fact, hackers can successfully guess 50-60% of all employee email addresses using this method.
The hacker will then devise a phishing or social engineering plan. Using their knowledge of the company's IT platforms, their plan could take the form of an email that directs their unsuspecting victims to a website that requires them to enter their username and password, for example.
The hacker will avoid including IT staffers on his list, as it would be too risky for him to be exposed. But customer service, accounting, marketing, and human resources are all very attractive targets. The hacker will create a sense of urgency in his message. And, finally, he will send out his bait, fish out his victims, and voila: he has just taken the first step to getting the access he needs to breach the network and steal valuable credit card data, social security, or other data files. A company’s worst nightmare has just begun
