30

I was sent this kind of link from presumably compromised Skype account, via a skype message (do not click unless you have a sandbox or something to protect you):

https://www.linkedin.com/slink?code=e4ig_yU#56287=myskypeusername

Where the myskypeusername is, well yes, my skype user name.

Clicking that, the URL would take you through a series of redirects and finally to a page selling some "miracle Brain IQ pills" claiming to boost, double, whatever one's mental capabilities... so clearly SPAM.

Does anyone know what the /slink... etc. URLs are used by LinkedIn? Google brought up nothing, except a few other cases where LinkedIn has been used to redirect users to SPAM.

I contacted LinkedIn about this and their "Safety support specialist" basically said they cannot do anything about it given it's not a message sent by linkedin user... go figure.

UPDATE: After I reiterated the problem to LinkedIn support, I got back the following:

Thank you for your response. We will look into this issue further and take necessary action based on our results. Thanks for your assistance in keeping LinkedIn a professional and trustworthy site.

Hopefully that's more than just words; we'll see I guess.

  • 1
    Linkedin support thread isn't any help either: linkedin.com/help/linkedin/forum/question/353714 – hd. May 6 '16 at 16:11
  • 4
    Seems like the /slink part is used for linkedin internal url directs and linkedin.com/slink?code=e4ig_yU redirects to some page which now 301 redirects you spam. Also the stuff after the # is probably ignored by the server and is there so you will click on it as its got your skype username in it. – rtn May 6 '16 at 16:27
  • 4
    Looks like either an open redirect vulnerability (but with the target URL stored in the Linkedin DB rather then in the URL itself) or an XSS vulnerability on the Linkedin page. – André Borie May 19 '16 at 23:14
  • I first suspected that the Skype name was there so that they could keep track of who clicks the link through the referer header, but since its over HTTPS I don't think it will be set? – Anders May 20 '16 at 7:54
  • @Anders – I'm guessing the extras are all passed to the redirection target, so they'll be able to track you just fine. It's also possible that the data is used by some internal LinkedIn tracker related to further stats akin to bitly's metrics. – Adam Katz May 24 '16 at 0:24
18

So I just stumbled upon this today and got a similar message:

https://www.linkedin.com/slink?code=eiurEkp?61778=myname

First I tried the first part: https://www.linkedin.com/slink?code=eiurEkp

This ends here: http://281-inteligen.thiscontentedmotion.com/de/ihel/inteligen/ - a scammy article about somebody saying that someone said that this pill will just change the whole world...... But well, it looks like a normal news-paper website and the source-code actually looks semantically clean.

So if linkedin might check the destination's source-code it would be okay in this case and to this point.

But when entering: https://www.linkedin.com/slink?code=eiurEkp?61778 (with the second search-param) - it seems by reading over there obfuscated JavaScripts, that they check for search/hash-params in the URL and redirect properly if found.

And this is probably not being checked by the linkedin-team. I mean how should they? This is hard because it is happening in an obfuscated JS. If they have some automated slink-checker they are scanning the code but likely don't execute the scripts.


Long story short: The slink?code=####### part redirects to a shared link from linkedin and appends any given hash or search parameter to this redirect. On the redirected destination this is then checked and used for a further redirect.

6

Well, just by testing /slink?code=0 (a 404 error) and /slink?code=1 (LinkedIn Business Marketing Solutions), I'm guessing it's reserved for customers of LinkedIn Business Solutions.

That said, I don't think it's that frequently used. I don't see much email traffic using it (I see more traffic using Hashcash, which is extraordinarily obscure.) This type of link seems to represent 0.03% of the email traffic linking to the www.linkedin.com CDN. This redirector is so infrequently used that I cannot determine how spammy it is.

To answer the question of how spammers are abusing this: Presumably, a spammer registers a phony account at LinkedIn and then uses this redirection service just like any other. It's a bit risky since LinkedIn is no stranger to resolving abuse (e.g. they're a key backer of DMARC) and there are so many other redirection services out there, but perhaps there's some illusion of legitimacy to using this instead.

A direct posing of this question to LinkedIn resulted in Franck Martin (one of their key DMARC advocates) saying:

This email was not sent by Linkedin.
Linkedin uses several lists to ensure the redirection does not end up to a known bad site. In all cases, please report it to abuse [at] linkedin (as well as the major URL anti-phishing lists) and we will take the appropriate actions.

(As noted in this thread on the SpamAssassin Users mailing list.)

Note that just because the specific sample that Franck saw wasn't sent by LinkedIn doesn't mean that there isn't any abuse of this shortener, but I do trust that they police it well. There's merely little they can do to control the emails they're not in control of (unless the email forges sending from @linkedin.com because it is protected by a DMARC p=reject policy. This policy instructs recipients to reject policy violations).

If you report the message to them, they should at least be able to break the redirector, which is the case for this link (as noted in another answer to this question). If their infrastructure did send the mail, they can chase it down further and take action against the customer.

  • 1
    It seems you incorrectly assume in your answer that I received the spam link via email. – Petri May 24 '16 at 9:53
  • You are correct, I had not realized this was spim. Ignore the DMARC parts then. LinkedIn obviously had nothing to do with the IM. They accepted your report, reviewed it, and nuked the redirection mapping. – Adam Katz May 24 '16 at 15:47
2

It looks like your link is dead as it now redirects to https://www.linkedin.com/static?key=incomplete_request_error

I'm not sure if there is a builtin mechanism that would specifically support user redirects in linkedin, but if the spammer injected HTML, they may have used meta tags to accomplish this.

e.g.

<meta http-equiv="refresh" content="5;URL=target_link_here">

protected by Community Oct 27 '16 at 9:26

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.