🕵 How your LinkedIn profile can make hacker attacks easier

From personal information exposed on Facebook to passwords revealed on Twitter, there are many more forms of disclosure that are being used maliciously by hackers. There is an aspect of your online identity that you may not know can help these attacks: your face.

The revelation was made this week by a journalist, in joint work with IBM's Cybersecurity Department. During a video call that was part of the test, the multinational's professionals held a laptop and, as soon as the camera took a photo of the reporter and recognised it by comparing it with the LinkedIn profile photo, that computer would be infected with a benign version of the WannaCry malware. This is where facial recognition came into play in alliance with cybercrime.

The concept is simple but effective: if hackers want to hit a specific person, in this case a journalist, they can find all the images they want through social media. Then they can infect a computer network and start an attack the moment the target's face is detected by the camera. The same can be done with voice recognition or any other physical aspect of a person, as long as it is recorded by a computer.

This attack, a test only, is part of an artificial-intelligence malware created by IBM called DeepLocker. "DeepLocker is a new class of cyber attacks that are highly evasive and have specific targets and that stand out, for that reason, from the rest," explained Marc Ph. Stoecklin, the scientist leading this study on cognitive cybersecurity. Besides the face and the voice, geolocation can also be one of the ways of being attacked.

Stoecklin also says that the future "will be artificial intelligence versus artificial intelligence", and that is why he is running this study, which may lead to a greater understanding of what is still to come when it comes to online security.

With colleagues Dhilung Kirat and Jiyong Jang, the scientist has been studying how to combine AI and cybersecurity.

Social Mapper

There are other ways to use LinkedIn photos maliciously, using facial-recognition technologies. The Social Mapper tool, for example, collects photos from this social network and uses them to quickly find similar photos on other platforms such as Facebook, Google Plus and Twitter.

The main aim of this software, which became open source this Wednesday, is to help ethical hackers who work in network security companies. The creator admits that the tool is not always reliable or fast. Social Mapper takes about 24 hours to go through an organisation of a thousand people, for example. And, with the current settings, reliability is about 70%.

The tool has even been used in a contest in Toronto, where hackers used their skills to help in missing-person cases.

The only way to prevent this kind of attack is not to use photographs on any website, the specialists say.

As far as we know, at least in Portugal, none of this malware has been seen yet.