Skype security issue allows to steal any account

#1

Post by amima » Wed, Nov 14, 2012, 1:50 AM UTC

Skype security issue allows to steal any account
qbakanet.tumblr.com

Re: Skype security issue allows to steal any account

#2

Post by ivan_krechetov » Wed, Nov 14, 2012, 7:47 AM UTC

Has anyone bothered actually checking this? Is there a proof video or smth?

Re: Skype security issue allows to steal any account

#3

Post by [deleted] » Wed, Nov 14, 2012, 7:48 AM UTC

[deleted]

Re: Skype security issue allows to steal any account

#4

Post by poser » Wed, Nov 14, 2012, 7:49 AM UTC

ivan_krechetov wrote: post #2

Has anyone bothered actually checking this? Is there a proof video or smth?

I sort of tried and it worked well until I got to the part about the marker or whatever.

Re: Skype security issue allows to steal any account

#5

Post by ivan_krechetov » Wed, Nov 14, 2012, 8:10 AM UTC

I've just tried on OS X, Skype v6.0.0.2946. The password marker doesn't appear in the Skype client under the new account; only in the Inbox.

UPD: Tested on Windows 7, Skype v6.0.0.120. The notification about the password reset token does appear in the Skype client, but no reset code is shown. And I couldn't figure out making it visible or click-able.

Verdict: can't reproduce.

Re: Skype security issue allows to steal any account

#6

Post by aw3c2 » Wed, Nov 14, 2012, 8:30 AM UTC

A Google translate version of the original report was on the frontpage but now has vanished. Weird!

Re: Skype security issue allows to steal any account

#7

Post by amima » Wed, Nov 14, 2012, 8:41 AM UTC

ivan_krechetov wrote: post #2

Has anyone bothered actually checking this? Is there a proof video or smth?

Lots of people already tried, several of my friends did experienced account hijacking. And I also tried myself (tested on my good friend account just to make sure). It is working. At least it was two hours ago. And as far as I know, it is still the issue.

Re: Skype security issue allows to steal any account

#8

Post by amima » Wed, Nov 14, 2012, 9:05 AM UTC

ivan_krechetov wrote: post #5

I've just tried on OS X, Skype v6.0.0.2946. The password marker doesn't appear in the Skype client under the new account; only in the Inbox. UPD: Tested on Windows 7, Skype v6.0.0.120. The notification about the password reset token does appear in the Skype client, but no reset code is shown. And I couldn't figure out making it visible or click-able. Verdict: can't reproduce.

Try refreshing the welcome page in Skype client to see Facebook page, close it, and then you will see the password marker.

Re: Skype security issue allows to steal any account

#9

Post by ivan_krechetov » Wed, Nov 14, 2012, 9:22 AM UTC

amima wrote: post #8

ivan_krechetov wrote: post #5

I've just tried on OS X, Skype v6.0.0.2946. The password marker doesn't appear in the Skype client under the new account; only in the Inbox. UPD: Tested on Windows 7, Skype v6.0.0.120. The notification about the password reset token does appear in the Skype client, but no reset code is shown. And I couldn't figure out making it visible or click-able. Verdict: can't reproduce.

Try refreshing the welcome page in Skype client to see Facebook page, close it, and then you will see the password marker.

OMG! You're totally right! I've pressed Ctrl+F5 on the home screen, skipped the Facebook thing, and here they are! http://www.xiag.ch/share/2012-11-14_1021.png