Skype fixes account hijacking vulnerability
Posted on 14 November 2012.
Skype has temporarily disabled its password reset function while it was investigating reports about a vulnerability that has been misused to hijack users' accounts, but the function is now available again as they claim to have fixed the problem.


The attack was easy to execute - the only thing the attacker needed was the email address the victim had used to open his Twitter account.

Armed with this information, the attacker could have used the same email address to open another account, then request a password reset. With the password reset token, which is sent to the attacker's Skype client, he could enter the victim's account and lock him out.

According to the BBC, the details about the vulnerability have been posted two months ago on a Russian forum, but have remained unknown to the general populace until they were shared on Reddit.

The attack was reproduced both by The Next Web and heise Security, and Skype has been notified about the existence of the flaw.

"We are reaching out to a small number of users who may have been impacted to assist as necessary," shared Skype engineer Leonas Sendrauskas.






Spotlight

Patching: The least understood line of defense

Posted on 29 August 2014.  |  How many end users, indeed how many IT pros, truly get patching? Sure, many of us see Windows install updates when we shut down our PC and think all is well. Itís not.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  

DON'T
MISS

Tue, Sep 2nd
    COPYRIGHT 1998-2014 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //