Gaping security hole in Microsoft’s Skype patched today

by Mark Tyson on 14 November 2012, 19:00

Tags: Skype, Microsoft (NASDAQ:MSFT)

Quick Link: HEXUS.net/qabo7v

Add to My Vault: x

Microsoft has today plugged a simply exploitable flaw in Skype’s password reset facility. The password recovery flaw was discussed on a Russian security forum two or three months ago but it has taken until today, as the story was picked up by many western media, for Microsoft to pull out its finger and fix the issue.

According to the Russian forum, and verified in a test by TNW earlier today, the Skype password recovery flaw was alarmingly simple to exploit. All a would-be hacker needed was knowledge of the victim’s email address with which they had signed up to Skype originally. Many times that may be a user’s main and very public email address.

To take over a Skype account all that the attacker had to do was create a new Skype account using the intended target’s email address. Now the two Skype accounts were linked to that email address and it was possible, up until a few hours ago, to get a password reset token sent to the Skype app as well as the sign-up email. The victim would get an email notification of the password change request but if the attacker didn’t delay they could easily lock out the original account holder and take over the account by then.

Microsoft first disabled the password reset ability today and have now done one better and properly plugged the security hole. A statement sent to TNW said “Early this morning we were notified of user concerns surrounding the security of the password reset feature on our website. This issue affected some users where multiple Skype accounts were registered to the same email address. We suspended the password reset feature temporarily this morning as a precaution and have made updates to the password reset process today so that it is now working properly.” If you were unlucky enough to have your Skype account swiped the statement explains further that “We are reaching out to a small number of users who may have been impacted to assist as necessary. Skype is committed to providing a safe and secure communications experience to our users and we apologize for the inconvenience.”

Microsoft worked quickly once the western media reported the flaw but seems to have dragged its feet overall since it was apparently warned by the Russian forum participants two or three months ago. At least for now your Skype ID and cash credit is safe from known hacks.



HEXUS Forums :: 7 Comments

Login with Forum Account

Don't have an account? Register today!
Doesn't it just blow your mind when these huge companies seem to not give a damn about its users.

A third grader could ‘hack’ into an account if it was that easy, Jeebus if I had known if was that simple I would have disabled my Skype account until they fixed it. Ugggh come on Microsoft, sometimes I wish there was some real competition to Microsoft. I like Windows cos it works with everything, there's nothing else out there that can come even close with compatibility and Pc Games and devices and all that..
Does security really matter if Microsoft is happy to sell your details to 3rd parties? It seems that the real big security hole is the lack of ethical standards of companies these days.
We could see a brand new version of Skype when MSN Messenger is turned off in March. Seeing MSN Messenger go is a shame because some of the features that are free cost money in other apps including Skype. I'd turn to YIM if it wasn't for the fact their security track record is worse than Microsofts and no-one I know above the age of 20 uses it.
aidanjt
Does security really matter if Microsoft is happy to sell your details to 3rd parties? It seems that the real big security hole is the lack of ethical standards of companies these days.

Can they do that?! I make sure to check the do-not-share-my-info box when signing up to things…
brasco
Can they do that?! I make sure to check the do-not-share-my-info box when signing up to things…
They think they can, and apparantly permissibility checkboxes are about as much use as a politician's promise: http://www.h-online.com/security/news/item/Report-Skype-disclosed-user-data-to-security-firm-1745235.html