LinkedIn has taken down several fake accounts of chief information security officers (CISO) created by unknown threat actors. While fake profiles are being monitored by the LinkedIn’s team, cybersecurity experts have sought a more robust process to address this concern to prevent the exploitation of employees, companies as well as job seekers.
Some of the fake accounts on the online platform posed as CISOs of global companies like Chevron, ExxonMobil, and Biogen. Out of the many, a phony profile made in the name of “Jennie Biller”, who claimed to be the chief information security officer at Biogen, had some notable errors that helped differentiate it from genuine accounts. It had a picture of a woman with the male pronoun ‘he’ used to share personal and employment details. Moreover, the profile only had 18 connections on the platform. Although these pointers need not always be termed as reasons to question the authenticity of an account holder, they can help draw attention to something that may be amiss.
Interestingly, some of the other fake accounts copy-pasted profile details from other genuine CISO account holders to look more authentic. Such is the case of a certain “Maryann Robles” whose profile claimed to be a CISO at ExxonMobil. The details on Robles’ account matched that of Frank Domizio, who is the deputy chief information security officer at Centers for Medicare & Medicaid Services.
While Domizio’s “About” section described him as “an old school nerd” along with text that states that his “love for technology started in the 1980s playing Tradewars with the 300 baud modem attached to my Tandy 1000 and continues today as Deputy CISO for the largest health plan on the planet.”
Robles describes herself as an “Old-school geek” while paraphrasing Domizio’s description in her about section that reads, “Since playing Tradewars on my Tandy 1000 with a 300 baud modem in the early ’90s, I’ve had a lifelong passion for technology, which I’ve carried with me as Deputy CISO of the world’s largest health plan.” As per sources, the fake account managed to convince Cybercrime Magazine by Cybersecurity Ventures to include her in the CISO 500 listing that enlists the current CISOs.
Fake accounts tackled last year
A community report published by LinkedIn shed light on the number of fake accounts found, reported, and taken down during a six-month period from July 1 to December 31, 2021. As per the report, the automated defense system blocked 96% of fake accounts.
The company recorded 11.9 million accounts that were stopped right at the point of registering, 4.4 million fake accounts were restricted before a member reported about them, and 127,000 fake accounts were restricted after other members reported them. The gravity of damage or danger posed by these fake CISO accounts on LinkedIn is not known yet. However, some LinkedIn members have been fooled into believing the information shared on these phoney profiles.
Though many such fake accounts may crop up from time to time, there are some ways that may give them away like grammatical errors, typos, errors in details, having only a few connections, and not having any legitimate recommendations. These profile holders are known to not respond to queries or requests to become a connection, as reported in a cybersecurity blog, KrebsOnSecurity.
