Skip to main content

Gaping security hole in Microsoft's Skype patched today

posted onNovember 14, 2012
by l33tdawg

Microsoft has today plugged a simply exploitable flaw in Skype’s password reset facility. The password recovery flaw was discussed on a Russian security forum two or three months ago but it has taken until today, as the story was picked up by many western media, for Microsoft to pull out its finger and fix the issue.

According to the Russian forum, and verified in a test by TNW earlier today, the Skype password recovery flaw was alarmingly simple to exploit. All a would-be hacker needed was knowledge of the victim’s email address with which they had signed up to Skype originally. Many times that may be a user’s main and very public email address.

To take over a Skype account all that the attacker had to do was create a new Skype account using the intended target’s email address. Now the two Skype accounts were linked to that email address and it was possible, up until a few hours ago, to get a password reset token sent to the Skype app as well as the sign-up email. The victim would get an email notification of the password change request but if the attacker didn’t delay they could easily lock out the original account holder and take over the account by then.

Source

Tags

Skype Security

You May Also Like

Recent News

Friday, November 1st

Tuesday, July 9th

Wednesday, July 3rd

Friday, June 28th

Thursday, June 27th

Thursday, June 13th

Wednesday, June 12th

Tuesday, June 11th

Friday, June 7th

Thursday, June 6th