Skype fixes account hijacking vulnerability
Posted on 14 November 2012.
Skype has temporarily disabled its password reset function while it was investigating reports about a vulnerability that has been misused to hijack users' accounts, but the function is now available again as they claim to have fixed the problem.


The attack was easy to execute - the only thing the attacker needed was the email address the victim had used to open his Twitter account.

Armed with this information, the attacker could have used the same email address to open another account, then request a password reset. With the password reset token, which is sent to the attacker's Skype client, he could enter the victim's account and lock him out.

According to the BBC, the details about the vulnerability have been posted two months ago on a Russian forum, but have remained unknown to the general populace until they were shared on Reddit.

The attack was reproduced both by The Next Web and heise Security, and Skype has been notified about the existence of the flaw.

"We are reaching out to a small number of users who may have been impacted to assist as necessary," shared Skype engineer Leonas Sendrauskas.






Spotlight

A data security guy's musings on the OPM data breach train wreck

There is still way too much apathy when it comes to data-centric security. Given the sensitive data the OPM was tasked with protecting, it should have had state-of-the-art data protection, but instead it has become the poster child for IT security neglect.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  
DON'T
MISS

Tue, Jul 28th
    COPYRIGHT 1998-2015 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //