Skype account hijack vulnerability fixed

Published: 2012-11-14
Last Updated: 2012-11-14 21:33:31 UTC
by Jim Clausing (Version: 1)
0 comment(s)

The folks over at Microsoft (who now owns Skype) fixed a bug earlier today that potentially would have allowed anyone to hijack a Skype account simply by knowing the e-mail address the account was associated with.  Apparently the vulnerability was found at least 3 months ago by a Russian researcher who claims that many users were affected.  I'm not aware of any procedures in place to reclaim a Skype ID that was hijacked, but if anyone knows of one please let us know either by leaving a comment or contacting us via the contact page.  Trend Micro[1] has a pretty good writeup, so I won't rehash the whole thing here and Microsoft has responded[2].




Jim Clausing, GIAC GSE #26
jclausing --at-- isc [dot] sans (dot) edu

Keywords: hijack Skype
0 comment(s)
November 2012 OUCH! - Two-Factor Authentication
ISC StormCast for Wednesday, November 14th 2012


Diary Archives