LinkedIn data breach COMPROMISES LinkedIn
The incident was a breach of LinkedIn's network and user database.
Explicit Confidence 99% · Jack Rhysider EP 86 Details
“LinkedIn had just been breached but they didn’t know it yet”
Incident
incident:linkedin_data_breach
Also: LinkedIn breach, The LinkedIn Incident
The 2012 compromise in which LinkedIn user records, including usernames, email addresses, and password hashes, were stolen.
The 2012 compromise in which LinkedIn user records, including usernames, email addresses, and password hashes, were stolen.
“LinkedIn had just been breached but they didn’t know it yet”
“a hacker stole 117 million user details from LinkedIn”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | COMPROMISES | Explicit | 86 | |
| outgoing | INITIAL_ACCESS_VIA | VPN | Explicit | 86 |
| outgoing | INVOLVES | cockeyed.com | Explicit | 86 |
| outgoing | INVOLVES | madnez.php | Explicit | 86 |
| outgoing | INVOLVES | brute-force password attack | Explicit | 86 |
| outgoing | INVOLVES | virtual machine escape | Explicit | 86 |
| outgoing | INVOLVES | Public-key authentication | Explicit | 86 |
| outgoing | INVOLVES | Password hash cracking | Explicit | 86 |
| outgoing | INVOLVES | User-agent fingerprinting | Explicit | 86 |
| outgoing | INVOLVES | Sputnik user agent | Explicit | 86 |
| outgoing | INVOLVES | SSH | Explicit | 86 |
| outgoing | RELATED_TO | Dropbox breach | Explicit | 86 |
| outgoing | RELATED_TO | Formspring breach | Explicit | 86 |
| outgoing | ASSOCIATED_WITH | Yevgeniy Nikulin | Explicit | 86 |
LinkedIn data breach COMPROMISES LinkedIn
The incident was a breach of LinkedIn's network and user database.
Explicit Confidence 99% · Jack Rhysider EP 86 Details
“LinkedIn had just been breached but they didn’t know it yet”
LinkedIn data breach INITIAL_ACCESS_VIA VPN
The hacker gained direct access to LinkedIn through an employee's VPN profile and credentials.
Explicit Confidence 99% · Jack Rhysider EP 86 Details
“connected directly into LinkedIn’s VPN server”
LinkedIn data breach INVOLVES cockeyed.com
The hacker used access to cockeyed.com, hosted at the engineer's residence, as a path toward the engineer's computer and LinkedIn access.
Explicit Confidence 94% · Jack Rhysider EP 86 Details
“The hacker got shell access to the website cockeyed.com”
LinkedIn data breach INVOLVES madnez.php
The hacker uploaded and executed a malicious PHP file named madnez.php while compromising the web server.
Explicit Confidence 99% · Jack Rhysider EP 86 Details
“he uploaded a couple malicious PHP files. One was specifically called madnez.php”
LinkedIn data breach INVOLVES brute-force password attack
The hacker brute-forced the iMac login by trying thousands of passwords against a guessed username.
Explicit Confidence 99% · Jack Rhysider EP 86 Details
“he just started hammering away, trying thousands and thousands of passwords”
LinkedIn data breach INVOLVES virtual machine escape
After compromising a virtual machine, the hacker escaped to the iMac host computer through the virtual IP interface.
Explicit Confidence 99% · Jack Rhysider EP 86 Details
“the hacker got into the virtual machine and then got into the host computer from there”
LinkedIn data breach INVOLVES Public-key authentication
The hacker stole the engineer's private key, which was used for public-key authentication to LinkedIn systems.
Explicit Confidence 99% · Jack Rhysider EP 86 Details
“he found a private key to LinkedIn”
LinkedIn data breach INVOLVES Password hash cracking
The stolen LinkedIn password hashes were posted for help cracking, and the hacker later used cracked passwords to access accounts.
Explicit Confidence 99% · Jack Rhysider EP 86 Details
“the hacker wanted to find a way to crack these passwords”
LinkedIn data breach INVOLVES User-agent fingerprinting
Investigators used the hacker's distinctive user agent to correlate activity across IP addresses and services.
Explicit Confidence 98% · Jack Rhysider EP 86 Details
“if there was a matching user agent, then you could know that that’s probably the same person”
LinkedIn data breach INVOLVES Sputnik user agent
The hacker's user agent included the unusual string Sputnik, which investigators used as an identifying indicator.
Explicit Confidence 99% · Jack Rhysider EP 86 Details
“The hacker’s user agent was unique. It actually had the word Sputnik in the end”
LinkedIn data breach INVOLVES SSH
The hacker accessed the LinkedIn database server using SSH and then ran database queries.
Explicit Confidence 96% · Jack Rhysider EP 86 Details
“they did. There were logs of the hacker logging into the database server and then accessing the database”
LinkedIn data breach RELATED_TO Dropbox breach
The FBI linked the LinkedIn and Dropbox incidents through matching IP addresses, user agents, and related account activity.
Explicit Confidence 99% · Jack Rhysider EP 86 Details
“Someone had breached LinkedIn, Dropbox, and Formspring all from the same IPs and same user agents with a trail connecting it all”
LinkedIn data breach RELATED_TO Formspring breach
The LinkedIn, Dropbox, and Formspring cases shared indicators of compromise, including IP addresses, user agents, browsers, and operating systems.
Explicit Confidence 99% · Jack Rhysider EP 86 Details
“In all three attacks they found similar IOCs, or indicators of compromise; the same IPs, the same user agents, the same browser and OS”
LinkedIn data breach ASSOCIATED_WITH Yevgeniy Nikulin
Yevgeniy Nikulin was associated with the LinkedIn breach through multiple investigative trails, and the jury later found him guilty on all nine counts involving LinkedIn, Dropbox, and Formspring.
Explicit Confidence 98% · Jack Rhysider EP 86 Details
“The jury found him guilty on all nine counts”