Skype 0-Day Vulnerability Allowed Hackers To Change The Password Of Any Account

snoopy · Nov 17, 2012

November 16th, 2012, 15:56 GMT · By Eduard Kovacs
Skype 0-Day Vulnerability Allowed Hackers to Change the Password of Any Account

Security researchers have identified a couple of critical vulnerabilities in Skype. One of them allowed an attacker to reset the usernames and passwords of any Skype account, and the other one could have been leveraged to bypass session token protections.

The ones responsible for finding the security hole are Vulnerability Lab researchers Benjamin Kunz Mejri and Chokri Ben Achour who have once again demonstrated their impressive bug-finding skills. In the past, they managed to find flaws not only in commercial products utilized by millions of users worldwide – including MSN, PayPal and Barracuda –, but also in applications or services used by government and military organizations.

One noteworthy fact is that the password reset vulnerability is different from the one found a few days ago on some Russian forum. These security holes were reported to Skype at the beginning of October and they were addressed by the company a few weeks later. Initially, we believed that they were one and the same because Skype representatives failed to notify Vulnerability Lab that the issues they had reported were fixed.

The experts found that a remote attacker could compromise any account by exploiting a flaw in the account recovery function available on the official Skype website. The most worrying part was that no user interaction was required to exploit the remote bug.
Click to expand...

Read more plus screen shots & video here: http:/ ews.softpedia.com ews/Skype-0Day-Vulnerability-Allowed-Hackers-to-Change-the-Password-of-Any-Account-Video-307672.shtml

snoopy · Nov 17, 2012

Skype fixes e-mail security flaw
Skype has resolved a nasty e-mail and password security bug and reinstated its password reset page.

Revealed by Skype earlier today, the vulnerability allowed someone to create a Skype account using the same e-mail address as that of the intended victim. That person was then able to reset the password for all accounts associated with that address, thereby locking out the account owner from Skype.

As a precaution, Skype earlier today took down its password reset page to prevent hackers from taking advantage of the flaw.
Click to expand...

More here: http:/ ews.cnet.com/8301-1009_3-57549687-83/skype-fixes-e-mail-security-flaw/

Log in or Sign up

Skype 0-Day Vulnerability Allowed Hackers To Change The Password Of Any Account

snoopy Registered Members

snoopy Registered Members

Share This Page

Log in or Sign up

Skype 0-Day Vulnerability Allowed Hackers To Change The Password Of Any Account

snoopy Registered Members

snoopy Registered Members

Share This Page

Useful Searches