Following LinkedIn's large password leak, I have seen a dangerous thought spread to friends and colleagues:
"so what if my LinkedIn password has leaked? What can they do? Look for a job for me?"
That is based on wrong assumptions about what an attacker wants and can do. And it is mistaking the low value you get from a service with the value of your data. Your data is PRECIOUS. Maybe not to you. But everything can be sold, and you'll always find someone interested to buy it. Let's see a few creative uses of your Linkedin account:
Analyze your data
You might think that what you share is of no use to anyone except potential recruiters, but by mixing your resume, shared links, private messages, all the data you put on the website, I could build a nice profile and sell it to advertisers. Did you put your address and phone number somewhere in your profile? Awesome! I have a lot of targeted advertisements for you!
Obtain access to your other accounts(email, Facebook, Twitter, Viadeo...)
With your email address and your password, I could probably guess the password for other services. Almost nobody has strong and different passwords for every service. Would you like to see your Facebook or Twitter account compromised? I don't think so.
Oh, remember to use a strong password, or even two factor authenticatiob for email. A lot of password recovery systems sues emails, so if your mailbox is compromised, your accounts will be compromised.
Spam/SEO
Nothing ca be done with your account? oh, you have contacts. And maybe, a well referenced profile. I'd be able to send spam links to all your contacts with the user feed, and put them in your profile, to improve the ranking of my websites. Sure, there's no harm to you, if you don't care about losing credibility or annoying your contacts.
Using the contact list
Oh, yes, I could sell your contact list, that's easy money!
While I'm at it, I could have fun with your friends and colleagues:
- ask them for money, nude pictures, confidential information, etc.
- tell them that your email account has been compromised, and that they must address their emails to another address controlled by me
- obtain access to their accounts with social engineering