LinkedIn faces class action suit over password leak
People can take data from us, but not money
Agentless Backup is Not a Myth
LinkedIn is facing a class action suit over the security breach that saw millions of users' passwords posted online.
Illinois resident Katie Szpyrka leads the complaint, which alleges that LinkedIn failed to "properly safeguard its users' personally identifiable information".
The complaint filed in California accuses the business network of using a "weak encryption format" for users' information and not having crucial security measures in place.
A LinkedIn spokesperson told The Register that the class action suit's claims were "without merit".
"No member account has been breached as a result of the incident, and we have no reason to believe that any LinkedIn member has been injured," the company said. "Therefore, it appears that these threats are driven by lawyers looking to take advantage of the situation.
"We believe these claims are without merit, and we will defend the company vigorously against suits trying to leverage third-party criminal behaviour."
The 6.5 million user passwords hacked and posted online were in hashed format, but the biz site evidently had not applied any salts. Salting adds extra arbitrary data to a password when it is hashed, thwarting pre-generated tables and making life more difficult for password crackers. The class action suit claims that hashing without salting is not an "industry standard protocol" as promised by LinkedIn's privacy policy.
"Despite its contractual obligation to use best practices in storing user data, LinkedIn failed to utilise basic industry standard encryption methods. In particular, LinkedIn failed to adequately protect user data because it stored passwords in unsalted SHA1 hashed format," the filing said, branding SHA1 "outdated".
The case also latches on to reports that LinkedIn was hacked through an SQL injection attack, which uses weaknesses in a company's website to get into its back-end systems.
"If true, LinkedIn's failure to adequately protect its website against SQL injection attacks - in conjunction with improperly securing its users' personally identifiable information - would demonstrate that the company employed a troubling lack of security measures," the complaint said.
Naturally, the class action suit is looking for attorney fees and damages for US members of LinkedIn. ®
COMMENTS
Re: Definitions - are you sure?
Actually a decent system would use a different salt for each password, which would be randomly generated (aka arbitrary), and therefore require a different rainbow table for each password and so make life a lot more difficult for password crackers.
Re: Definitions - are you sure?
In a decent system:
. There's a system salt which is in the code not the database. This ensures you need access to both code and db to get anywhere.
. There's a salt stored alongside _each_ password in the database. This means that an attacker performing a dictionary attack has to regenerate his entire dictionary for each password in the database.
. When I say "password" above, I mean encrypted, double salted password.
. The encryption hash used is run multiple times. If I decide it's acceptable to my users that it takes a second to check their password, that means, on a comparable system, each entry in the attacker's dictionary takes a second to build.
Remember that there's no such thing as a secure system. The aim of the security is to slow the attacker down enough for action to be taken.
No one was injured. Inconvenienced, yes. I don't use the same password anywhere else that I did on Linked-In, but I still felt it advisable to make a survey of all my accounts and update any passwords which were even remotely similar. So there went a half day of my life. I don't understand how a company with the resources commensurate with hundreds of millions of users cannot even adequately protect things like the user database. Of course the lawsuit is just an opportunistic attempt by the equivalent of ambulance chasing lawyers to milk an already victimized company for some money.
IT infrastructure monitoring strategies
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
Cloud based data management
Enabling efficient data center monitoring
Agentless Backup is Not a Myth
