Gaping security hole in Microsoft's Skype patched today
Microsoft has today plugged a simply exploitable flaw in Skype’s password reset facility. The password recovery flaw was discussed on a Russian security forum two or three months ago but it has taken until today, as the story was picked up by many western media, for Microsoft to pull out its finger and fix the issue.
According to the Russian forum, and verified in a test by TNW earlier today, the Skype password recovery flaw was alarmingly simple to exploit. All a would-be hacker needed was knowledge of the victim’s email address with which they had signed up to Skype originally. Many times that may be a user’s main and very public email address.
To take over a Skype account all that the attacker had to do was create a new Skype account using the intended target’s email address. Now the two Skype accounts were linked to that email address and it was possible, up until a few hours ago, to get a password reset token sent to the Skype app as well as the sign-up email. The victim would get an email notification of the password change request but if the attacker didn’t delay they could easily lock out the original account holder and take over the account by then.
