Microsoft has today plugged a simply exploitable flaw in Skype’s password reset facility. The password recovery flaw was discussed on a Russian security forum two or three months ago but it has taken until today, as the story was picked up by many western media, for Microsoft to pull out its finger and fix the issue.
According to the Russian forum, and verified in a test by TNW earlier today, the Skype password recovery flaw was alarmingly simple to exploit. All a would-be hacker needed was knowledge of the victim’s email address with which they had signed up to Skype originally. Many times that may be a user’s main and very public email address.
To take over a Skype account all that the attacker had to do was create a new Skype account using the intended target’s email address. Now the two Skype accounts were linked to that email address and it was possible, up until a few hours ago, to get a password reset token sent to the Skype app as well as the sign-up email. The victim would get an email notification of the password change request but if the attacker didn’t delay they could easily lock out the original account holder and take over the account by then.
Microsoft first disabled the password reset ability today and have now done one better and properly plugged the security hole. A statement sent to TNW said “Early this morning we were notified of user concerns surrounding the security of the password reset feature on our website. This issue affected some users where multiple Skype accounts were registered to the same email address. We suspended the password reset feature temporarily this morning as a precaution and have made updates to the password reset process today so that it is now working properly.” If you were unlucky enough to have your Skype account swiped the statement explains further that “We are reaching out to a small number of users who may have been impacted to assist as necessary. Skype is committed to providing a safe and secure communications experience to our users and we apologize for the inconvenience.”
Microsoft worked quickly once the western media reported the flaw but seems to have dragged its feet overall since it was apparently warned by the Russian forum participants two or three months ago. At least for now your Skype ID and cash credit is safe from known hacks.
