LinkedIn iOS app also vulnerable to plist identity theft

Following the recent findings by Gareth Wright about Facebook iOS app storing authentication keys in a plain text file that is easily accessible even on non-jailbroken devices (allowing it to simply be copied to another device to grant access to that account) we have just discovered the same security flaw is also present in the latest version of LinkedIn iPhone app and you can also easily extract these plist files from iTunes backups.

Using a free app (in this case iExplorer) to browse the contents of your iPhone if you navigate to Apps/LinkedIn/Library/Preferences you will find a file named com.linkedin.LinkedIn.plist and this is the file in question.

Simply copying the com.linkedin.LinkedIn.plist file from one device to another and then relaunching the LinkedIn app will automatically log the user is using the account details from the cloned plist file.

I “nabbed” a copy of Gareth Wright’s LinkedIn plist (he emailed it to me) and dropped it onto my own non-jailbroken iPhone and relaunched LinkedIn.

I was instantly into Gareth’s LinkedIn Profile, I could browse all his personal messages, invitations, contacts, edit his profile and even sent myself an invite to join his network! In my opinion, they should spend a little less on app marketing and more on security developments.

Here was my LinkedIn screen prior to copying the plist file over

and here it was after copying the plist and relaunching the app. At no point did it prompt me to re-enter my password or authenticate

I was able to navigate his LinkedIn profile without any issues, view all his messages, invitations, connections and even created an invitation and sent it to myself.

and here is the invitation I received

iPhone 3G ringer/silent switch broken [after 48 hours]

As an owner of the original iPhone, I patiently waited for the white iPhone 3G to be made available as an upgrade option from my network operator. 2 days ago I noticed my network operator (O2) had stock of the white iPhone 3G (44 days after its launch) so I headed to my local store and half an hour later I walked out with my new white iPhone 3G and tossed my original iPhone to one side [i.e. gave it to my girlfriend].

48 hours later and it’s already broken, the little ringer/vibrate switch has snapped and fallen off. I did notice the switch was much stiffer than my original iPhone, which I thought was a good thing as it would prevent mistaken switching of modes but unfortunately when I flicked it across the button popped off and landed on the street somewhere, never to be seen again. Continue reading “iPhone 3G ringer/silent switch broken [after 48 hours]”