11 ms·

Skype vulnerability allowing hijacking of an account if you know just the email

362 points by jtraub 14y ago

kokoge 14y ago
OP at http://habrahabr.ru/post/158545/ http://habrahabr.ru/post/158545/ (russian) says that he reported this vulnerability about 3 month ago. The lack of any reaction is unbelievable. Hint: you can change your email to something like user+skype@gmail.com to avoid registration of new email address.
- jtraub 14y ago
  Even now Skype reaction is unbelievable. They are "investigating the issue" for almost 2 hours.
  - vitalysh 14y ago
    Damn, it takes 2 minutes to "investigate the issue" if you simply follow the steps.
    - gingerlime 14y ago
      But probably a little longer to find a fix, test it and release it...
      - jtraub 14y ago
        I think they can just temporarily turn off password reset to prevent account stealing. After that they can take their time to fix the problem, test it and roll out to the public.
      - x-sam 14y ago
        yes, better to keep 0day working, and roll out fixes with the next release.
      - vitalysh 14y ago
        Block password reset. It is as simple as that.
        sondh 14y ago
        They have just done that.
      - entropy_ 14y ago
        Not really, no. Just stop the reset token from appearing in the client. Just send it by email like you're supposed to and that's it, vulnerability gone.
        mvzink 14y ago
        Yeah, but pushing a client fix takes time. They'll need an excuse in the meantime.
        aidos 14y ago
        You don't push the fix to the client. They have some notification system ou there that is sending the messages to the client. They just need to stop it from sending these kind of messages. Obviously I can't say how much work is involved in that - but they don't need to push an updated client.
        entropy_ 14y ago
        It's not a client-side fix. Just stop the server from sending the token/link to the clients. Sure, that might degrade the client experience a bit(assuming that the client isn't just displaying a webview in which case no degradation would occur) but it would fix the problem for now. Later on you can take your time rolling out a client fix if it's required, but a hotfix server-side is entirely possible, there's no excuse keeping this vulnerability possible when it's been made this public(step by step instructions to hack someone's account, with screenshots!) especially since you were contacted privately about it ~3 months ago.
        JabavuAdams 14y ago
        Right. There's one developer at Skype who can just do that and push it to production, without talking to anyone else, or getting approval from anyone else. Be realistic. If two people need to talk about it, it's going to take longer than 2 minutes.
        entropy_ 14y ago
  - Nux 14y ago
    Stop saying "Skype", use "Microsoft" instead, and it's not unbelievable at all.
    - ghshephard 14y ago
      Except that Microsoft has a pretty stellar reputation when it comes to security procedures. They're well known as being among the best in the industry.
      - jxi 14y ago
        Well, they've certainly cleaned up their act, but I definitely wouldn't say that they're known to be among the best in the industry.. I remember just a few year ago, you could get to ring0 in Windows and install a rootkit just via the registry.. Let's not forget all the hotmail vulnerabilities similar to this that have been active for an indeterminate amount of time..
        coolnow 14y ago
        A few years is an enormous period of time especially when it comes to tech and infosec.
      - papsosouid 14y ago
        No they don't. They have a reputation for taking months to respond to security issues, responding with "yeah whatever, we'll look into it" and then doing nothing for months, leaving software vulnerable to known exploits because "its not patch day yet", and similar bullshit.
    - drivebyacct2 14y ago
      Given what I've heard of Skype-as-Microsof-Skype, it would be inaccurate to act like Skype has been assimilated or would have much if any overlap with the people handling Windows vulnerabilities.
- gingerlime 14y ago
  something like +fi92is82ls8223 is probably better, i.e. something not predictable / guessable.
- deleted 14y ago
  [deleted]
ivan_krechetov 14y ago
I confirm. Just tested on Win7, Skype 6.0.0.120 The notification about the password reset token does appear in the Skype client, but no reset code is shown at first. Then I've pressed Ctrl+F5 on the home screen, skipped the Facebook thing, and here they are! http://www.xiag.ch/share/2012-11-14_1021.png http://www.xiag.ch/share/2012-11-14_1021.png On OSX doesn't work, though. The password token notification doesn't come.
- suchitpuri 14y ago
  also it seems the password reset link, is not working for me.
  - jtraub 14y ago
    MS is fixing the problem right now. They turned off password recovery form few minutes ago.
gingerlime 14y ago
I think it's a good practice to always use unique, unpredictable email addresses when signing for online services. 1. Most people use the same or similar password, so once one account gets hacked, the attacker is probably able to use many other accounts on different services with the same email address/password combo. 2. It's easier to spot services that spam, or that leak your email address (I became aware of a leak of email addresses on Box... luckily it was only emails that got leaked, at least according to Box support). 3. It's easier to block spam, once a service misbehaves or gives away the email. I wrote a little more about using it as a "passwordless password manager" at http://blog.gingerlime.com/2011/passwordless-password-manager/ http://blog.gingerlime.com/2011/passwordless-password-manage... update: (if blog post is too long...) this does not mean setting up hundreds of different email accounts. On most services like hotmail, google and yahoo you can simply append some unique string to your email address, e.g. john+f820938422@gmail.com. Making this unpredictable is important however, so appending +facebook and +twitter is not helping much though...
- bruceboughton 14y ago
  So now you need a password manager to remember the email addresses instead of the password. What problem are you solving?
  - gingerlime 14y ago
    The problem I was trying to solve is of many people who use the same password and email everywhere, and who won't use a password manager or feel it's too complicated to install or use etc. The email addresses are not as sensitive as passwords. Sure. If someone gets hold of all of them AND your master password you're in trouble. But same goes to getting your password manager file and the password for it. The difference is you don't need a password manager software. You can store this list anywhere which is reasonably safe.
    - bruceboughton 14y ago
      Your scheme is no easier to implement than having a different password for each website. You have effectively moved part of the password out of the password and into the email address.
andybak 14y ago
Didn't work for me on the Mac version of the Skype client. Will retry on Win7.
sondh 14y ago
After successfully exploited this on my own account, tried again with my SO's account and https://login.skype.com/account/password-reset-request https://login.skype.com/account/password-reset-request has been blocked. Pretty good emergency reaction. It should be noted that after my account password is changed, I tried to login with the old password, the Windows Skype app told me the username and password combination is wrong but it still let me logged in. This may be a different bug in caching? Hope we can get a postmortem report out of this...
- happyfreud 14y ago
  Apparently, https://login.skype.com/account/password-automation https://login.skype.com/account/password-automation still works.
  - Smirnoff 14y ago
    It only works if the account had a credit card on file and/or made purchases in the past. Unless you know the credit card number or the purchase ticket number, this link isn't much help. Can't believe Skype has been ignoring this issue up until in got to the top of Hacker News and HabraHabr.
frontsideair 14y ago
I think as a precaution, you can change your Gmail address, using the + operator. In case you didn't know, you can receive emails sent to yourusername+anystring@gmail.com
lucian1900 14y ago
It's even worse! Their website is so broken you can't change your password (new password fields are disabled) and you can't set a new email address as primary (the "make primary" button only appears when the new email address field is empty). Also, if you first add a new email address, save, then set it to primary, it disappears. Wtf. I see no recourse other than closing my account, if that's still possible. [edit] No, not even that is possible.
- frontsideair 14y ago
  I'm having the exactly same problem, and I can't believe they're doing it. They won't even let us protect ourselves. Could they botch worse than that?
- jtraub 14y ago
  I guess it was done to prevent account stealing while Microsoft works on appropriate fix
- TobbenTM 14y ago
  Never use enter to complete forms, use the mouse. That works for me.
- anonymoushn 14y ago
  This appears to be a bug. After adding the email address and clicking save, logging out, and logging in, I found the email address was successfully added. At this point I could change it to the primary one, click save, paste my password, and click the button on the password prompt to successfully change my primary email address. If I tried to add the email and make it primary in one session, it would not work. If I entered my password and hit enter, it would not work.
  - jrabone 14y ago
    Doesn't work for me - I can add a new email address, but when I sign out and back in it's vanished. Feels like they might have disabled parts of the account management system.
mtgx 14y ago
You can't even delete your Skype account if you want to. You can only change some of the information: https://support.skype.com/en/faq/FA142/can-i-delete-my-skype-account https://support.skype.com/en/faq/FA142/can-i-delete-my-skype...
- celebdor 14y ago
  If you contact support you can set the account as deleted. So that screenname becomes unavailable (or at least that is what they told me when I did it).
dchest 14y ago
In August I received an email from Skype thanking me for registering an account. But I already had an account, I didn't register this one. After comparing the new account name with part of my email, I came to the conclusion that someone mistyped their email address, and registered an account on my address. I contacted their live support, here's the conversation: George A: Hello! Welcome to Skype Live Support! My name is George. How may I help you? me: Recently I have received an email welcoming me to Skype (not phishing, I verified). The problem is that I didn't create the account mentioned in the email. The account name was "[NEW SKYPE ACCOUNT]" and my email is [MY EMAIL 1], so I think that user mistyped his email address, and then Skype sent a welcome message to me. Doesn't skype verifies email addresses before sending a welcome message? George A: I understand that you are concerned about your email address being used to setup a Skype account, I'll be happy to help you with that. May I please have your Skype Name? me: [MY SKYPE ACCOUNT] George A: I would also need the email address, please. me: [MY EMAIL 1]. let me check that this address in on my Skype account... ok, my email on file in Skype is [MY EMAIL 2]. and a few other too, all mine :) George A: Well, I see that there is only Skype Name registered under that email address, the Skype Name is [NEW SKYPE ACCOUNT] me: Yes, for my account ([MY SKYPE ACCOUNT]) the primary email is [MY EMAIL 2], but other emails on profile are [MY EMAIL 1], [MY EMAIL 2], [MY EMAIL 3]. George A: May I please ask you to confirm which Skype Name that you do not authorize? me: Does Skype sends verification message before assigning the email to account? The Skype name which I didn't create is [NEW SKYPE ACCOUNT] George A: May I also have the email address that was used? me: [MY EMAIL 1] George A: Well, I would need to send you a confirmation to that email address. I would kindle need you to reply back to that email. me: Please do George A: Then, we will be able to delete that Skype Name for you. me: thank you George A: You are most welcomed, please expect me email within 10 minutes. Is there anything else I can help you with today? me: Could you tell me if email accounts that are registered with Skype are being verified by sending a message to them? If so, maybe there's bug in your system? George A: We send a welcome email to the registered email address whenever a new account is set up using that email. me: OK, that's what I received. And then you also send other emails with offers to the same account. So, basically, anyone can create an account for any email. Why don't you verify emails? George A: Please understand that all of us here at Skype take our customers' privacy and confidentiality very seriously me: OK. Thank you. George A: You are most welcomed. It's been a pleasure speaking with you today. Thank you for contacting Skype Live Support, have a great day. We value your feedback. Please be aware that we will ask you a few questions after closing the chat window about your experience with us today. Once you are ready please click on the "Exit" button. me: I suggest adding a link to Welcome email that says "I didn't create this account". Bye! Realizing that there's nothing this support person can do about this, I sent email to their "security" people. I received no reply. And now this failure to verify emails leads to the linked vulnerability. Nice.
jtraub 14y ago
Password recovery form was disabled and as of now the vulnerability can not be exploited. See announcement http://community.skype.com/t5/Security-Privacy-Trust-and/Password-vulnerability/m-p/1207232 http://community.skype.com/t5/Security-Privacy-Trust-and/Pas...
scrrr 14y ago
And they said I'm crazy to create an extra email address just for Skype back then..
timf 14y ago
Microsoft reports they have disabled password resets during the investigation: http://heartbeat.skype.com/2012/11/security_issue.html http://heartbeat.skype.com/2012/11/security_issue.html
- timf 14y ago
  That text was replaced, here is the old text: We have had reports of a new security vulnerability issue. As a precautionary step we have temporarily disabled password reset as we continue to investigate the issue further. We apologize for the inconvenience but user experience and safety is our first priority
fromITroom 14y ago
Forgot password no longer working, seems like they switched the function for now. Step in right direction.
davidwparker 14y ago
I'm genuinely curious- what's keeping people on Skype? There are better alternatives out there now (Google+ Hangouts, for example). Will this push any of you Skype users over?
- frabcus 14y ago
  As far as I know, Google+ Hangouts doesn't let you call people. Is there a way to actually just phone somebody with it, the phone on their computer rings, and they answer it? Preferably with a standalone client, as I can't guarantee I'd remember to open and leave open a browser tab.
- bmj 14y ago
  Tons of folks (think: grandmothers and parents and other potentially non-tech-savvy folks) have been using Skype to communicate with family members across the globe for many years. Simply expecting them to switch to Google Hangouts is a tall order.
- tjaerv 14y ago
  The existing user base. When you communicate daily with a ton of customers using Skype, switching to something else seems a remote prospect at best.
- LaGrange 14y ago
  Because I don't want to sign up for Google+. I dislike the idea of bundling their social data mining solution with just about anything, like a less obvious and impossible to opt-out version of whatever-toolbar bundled with software years ago.
  - DannyBee 14y ago
    and you strangely believe microsoft isn't doing the same thing with skype's data?
    - LaGrange 14y ago
      They are way, way worse at it than Google. Which is good for me.
boingy 14y ago
Not quite as bad but it is also possible to get a user's IP address just by sending them a friend request. This has been known about and exploited for months, possibly over a year. It's meant that high profile users of Skype on sites like youtube or twitch.tv have to keep their skype private and/or connect to it specifically with a proxy to avoid getting DDOSed
danso 14y ago
Any idea the period of time this bug has been present? I remember the login process being inconsistent (especially among the iOS apps) when I signed up four years ago, but I attributed it to me just being unfamiliar with the service.
- lostlogin 14y ago
  Yes. Wow yes. The interface is getting better, but its still awful. At least you can now return a missed call without going out the page, into contacts, and hunting the caller down. The OSX client is a whole other world of pain. FaceTime briefly looked like a promising replacement, but no.
davedx 14y ago
It looks like they've fixed it now. https://twitter.com/Skype https://twitter.com/Skype
timf 14y ago
Skype reports this has been resolved: http://heartbeat.skype.com/2012/11/security_issue.html http://heartbeat.skype.com/2012/11/security_issue.html [UPDATE:14/11/2012@15:28GMT] Early this morning we were notified of user concerns surrounding the security of the password reset feature on our website. This issue affected some users where multiple Skype accounts were registered to the same email address. We suspended the password reset feature temporarily this morning as a precaution and have made updates to the password reset process today so that it is now working properly. We are reaching out to a small number of users who may have been impacted to assist as necessary. Skype is committed to providing a safe and secure communications experience to our users and we apologize for the inconvenience.
- meritt 14y ago
  Good to hear they fixed it but it was responsibly disclosed a month ago and Skype did nothing whatsoever. We really need a better way to hold a company accountable for appropriately reacting to proven security threats without requiring a public disclosure.
jere 14y ago
By the way, Skype's registration page has inexplicable password rules. aaaaa1 - strength: medium aaaaa12345 - strength: poor =aStu!et$aQ@212345 - strength: poor
- lambda 14y ago
  Yeah, at my last job, someone implemented a password strength checking feature that would actually reject stronger passwords. It required: 1. At least 3 out of the 4 categories uppercase, lowercase, digit, special character 2. No character could be repeated more than two times 3. No sequence of 3 or more increasing or decreasing letters or numbers could be present (and not even consecutive: "ta/Tbs#cz" would be rejected because it contains "abc"). 4. No English words or names could be present. 5. It must be at least 8 characters There may have been other restrictions too, I don't recall the exact details. This meant that perfectly reasonable passphrases (like "correct horse battery staple") would be rejected. Even if you tried to come up with a good password that met the rule, you might fail by accident because "89cRbcThe*)" has the word "The" in it. You would generally have to come up with a password, then whittle it down slowly until you passed all of the rules, usually making it weaker in the process.
  - mikegioia 14y ago
    So... were ANY passwords created? I could see the success rate on this at like 1%.
  - smsm42 14y ago
    They must have really dedicated customers. That, or their users are required to use their system under the pain of multi-year imprisonment. I see no other way why would anyone agree to suffer through this.
leke 14y ago
Nice work MicroSoft.

362 points by jtraub 14y ago

OP at http://habrahabr.ru/post/158545/ http://habrahabr.ru/post/158545/ (russian) says that he reported this vulnerability about 3 month ago. The lack of any reaction is unbelievable. Hint: you can change your email to something like user+skype@gmail.com to avoid registration of new email address.

jtraub 14y ago
Even now Skype reaction is unbelievable. They are "investigating the issue" for almost 2 hours.
- vitalysh 14y ago
  Damn, it takes 2 minutes to "investigate the issue" if you simply follow the steps.
  - gingerlime 14y ago
    But probably a little longer to find a fix, test it and release it...
    - jtraub 14y ago
      I think they can just temporarily turn off password reset to prevent account stealing. After that they can take their time to fix the problem, test it and roll out to the public.
    - x-sam 14y ago
      yes, better to keep 0day working, and roll out fixes with the next release.
    - vitalysh 14y ago
      Block password reset. It is as simple as that.
      - sondh 14y ago
        They have just done that.
    - entropy_ 14y ago
      Not really, no. Just stop the reset token from appearing in the client. Just send it by email like you're supposed to and that's it, vulnerability gone.
      - mvzink 14y ago
        Yeah, but pushing a client fix takes time. They'll need an excuse in the meantime.
        aidos 14y ago
        You don't push the fix to the client. They have some notification system ou there that is sending the messages to the client. They just need to stop it from sending these kind of messages. Obviously I can't say how much work is involved in that - but they don't need to push an updated client.
        entropy_ 14y ago
        It's not a client-side fix. Just stop the server from sending the token/link to the clients. Sure, that might degrade the client experience a bit(assuming that the client isn't just displaying a webview in which case no degradation would occur) but it would fix the problem for now. Later on you can take your time rolling out a client fix if it's required, but a hotfix server-side is entirely possible, there's no excuse keeping this vulnerability possible when it's been made this public(step by step instructions to hack someone's account, with screenshots!) especially since you were contacted privately about it ~3 months ago.
        JabavuAdams 14y ago
        Right. There's one developer at Skype who can just do that and push it to production, without talking to anyone else, or getting approval from anyone else. Be realistic. If two people need to talk about it, it's going to take longer than 2 minutes.
        entropy_ 14y ago
- Nux 14y ago
  Stop saying "Skype", use "Microsoft" instead, and it's not unbelievable at all.
  - ghshephard 14y ago
    Except that Microsoft has a pretty stellar reputation when it comes to security procedures. They're well known as being among the best in the industry.
    - jxi 14y ago
      Well, they've certainly cleaned up their act, but I definitely wouldn't say that they're known to be among the best in the industry.. I remember just a few year ago, you could get to ring0 in Windows and install a rootkit just via the registry.. Let's not forget all the hotmail vulnerabilities similar to this that have been active for an indeterminate amount of time..
      - coolnow 14y ago
        A few years is an enormous period of time especially when it comes to tech and infosec.
    - papsosouid 14y ago
      No they don't. They have a reputation for taking months to respond to security issues, responding with "yeah whatever, we'll look into it" and then doing nothing for months, leaving software vulnerable to known exploits because "its not patch day yet", and similar bullshit.
  - drivebyacct2 14y ago
    Given what I've heard of Skype-as-Microsof-Skype, it would be inaccurate to act like Skype has been assimilated or would have much if any overlap with the people handling Windows vulnerabilities.
gingerlime 14y ago
something like +fi92is82ls8223 is probably better, i.e. something not predictable / guessable.
deleted 14y ago
[deleted]

ivan_krechetov 14y ago

I confirm. Just tested on Win7, Skype 6.0.0.120 The notification about the password reset token does appear in the Skype client, but no reset code is shown at first. Then I've pressed Ctrl+F5 on the home screen, skipped the Facebook thing, and here they are! http://www.xiag.ch/share/2012-11-14_1021.png http://www.xiag.ch/share/2012-11-14_1021.png On OSX doesn't work, though. The password token notification doesn't come.

suchitpuri 14y ago
also it seems the password reset link, is not working for me.
- jtraub 14y ago
  MS is fixing the problem right now. They turned off password recovery form few minutes ago.

gingerlime 14y ago

I think it's a good practice to always use unique, unpredictable email addresses when signing for online services. 1. Most people use the same or similar password, so once one account gets hacked, the attacker is probably able to use many other accounts on different services with the same email address/password combo. 2. It's easier to spot services that spam, or that leak your email address (I became aware of a leak of email addresses on Box... luckily it was only emails that got leaked, at least according to Box support). 3. It's easier to block spam, once a service misbehaves or gives away the email. I wrote a little more about using it as a "passwordless password manager" at http://blog.gingerlime.com/2011/passwordless-password-manager/ http://blog.gingerlime.com/2011/passwordless-password-manage... update: (if blog post is too long...) this does not mean setting up hundreds of different email accounts. On most services like hotmail, google and yahoo you can simply append some unique string to your email address, e.g. john+f820938422@gmail.com. Making this unpredictable is important however, so appending +facebook and +twitter is not helping much though...

bruceboughton 14y ago
So now you need a password manager to remember the email addresses instead of the password. What problem are you solving?
- gingerlime 14y ago
  The problem I was trying to solve is of many people who use the same password and email everywhere, and who won't use a password manager or feel it's too complicated to install or use etc. The email addresses are not as sensitive as passwords. Sure. If someone gets hold of all of them AND your master password you're in trouble. But same goes to getting your password manager file and the password for it. The difference is you don't need a password manager software. You can store this list anywhere which is reasonably safe.
  - bruceboughton 14y ago
    Your scheme is no easier to implement than having a different password for each website. You have effectively moved part of the password out of the password and into the email address.

andybak 14y ago

Didn't work for me on the Mac version of the Skype client. Will retry on Win7.

sondh 14y ago

After successfully exploited this on my own account, tried again with my SO's account and https://login.skype.com/account/password-reset-request https://login.skype.com/account/password-reset-request has been blocked. Pretty good emergency reaction. It should be noted that after my account password is changed, I tried to login with the old password, the Windows Skype app told me the username and password combination is wrong but it still let me logged in. This may be a different bug in caching? Hope we can get a postmortem report out of this...

happyfreud 14y ago
Apparently, https://login.skype.com/account/password-automation https://login.skype.com/account/password-automation still works.
- Smirnoff 14y ago
  It only works if the account had a credit card on file and/or made purchases in the past. Unless you know the credit card number or the purchase ticket number, this link isn't much help. Can't believe Skype has been ignoring this issue up until in got to the top of Hacker News and HabraHabr.

frontsideair 14y ago

I think as a precaution, you can change your Gmail address, using the + operator. In case you didn't know, you can receive emails sent to yourusername+anystring@gmail.com

lucian1900 14y ago

It's even worse! Their website is so broken you can't change your password (new password fields are disabled) and you can't set a new email address as primary (the "make primary" button only appears when the new email address field is empty). Also, if you first add a new email address, save, then set it to primary, it disappears. Wtf. I see no recourse other than closing my account, if that's still possible. [edit] No, not even that is possible.

frontsideair 14y ago
I'm having the exactly same problem, and I can't believe they're doing it. They won't even let us protect ourselves. Could they botch worse than that?
jtraub 14y ago
I guess it was done to prevent account stealing while Microsoft works on appropriate fix
TobbenTM 14y ago
Never use enter to complete forms, use the mouse. That works for me.
anonymoushn 14y ago
This appears to be a bug. After adding the email address and clicking save, logging out, and logging in, I found the email address was successfully added. At this point I could change it to the primary one, click save, paste my password, and click the button on the password prompt to successfully change my primary email address. If I tried to add the email and make it primary in one session, it would not work. If I entered my password and hit enter, it would not work.
- jrabone 14y ago
  Doesn't work for me - I can add a new email address, but when I sign out and back in it's vanished. Feels like they might have disabled parts of the account management system.

mtgx 14y ago

You can't even delete your Skype account if you want to. You can only change some of the information: https://support.skype.com/en/faq/FA142/can-i-delete-my-skype-account https://support.skype.com/en/faq/FA142/can-i-delete-my-skype...

celebdor 14y ago
If you contact support you can set the account as deleted. So that screenname becomes unavailable (or at least that is what they told me when I did it).

dchest 14y ago

In August I received an email from Skype thanking me for registering an account. But I already had an account, I didn't register this one. After comparing the new account name with part of my email, I came to the conclusion that someone mistyped their email address, and registered an account on my address. I contacted their live support, here's the conversation: George A: Hello! Welcome to Skype Live Support! My name is George. How may I help you? me: Recently I have received an email welcoming me to Skype (not phishing, I verified). The problem is that I didn't create the account mentioned in the email. The account name was "[NEW SKYPE ACCOUNT]" and my email is [MY EMAIL 1], so I think that user mistyped his email address, and then Skype sent a welcome message to me. Doesn't skype verifies email addresses before sending a welcome message? George A: I understand that you are concerned about your email address being used to setup a Skype account, I'll be happy to help you with that. May I please have your Skype Name? me: [MY SKYPE ACCOUNT] George A: I would also need the email address, please. me: [MY EMAIL 1]. let me check that this address in on my Skype account... ok, my email on file in Skype is [MY EMAIL 2]. and a few other too, all mine :) George A: Well, I see that there is only Skype Name registered under that email address, the Skype Name is [NEW SKYPE ACCOUNT] me: Yes, for my account ([MY SKYPE ACCOUNT]) the primary email is [MY EMAIL 2], but other emails on profile are [MY EMAIL 1], [MY EMAIL 2], [MY EMAIL 3]. George A: May I please ask you to confirm which Skype Name that you do not authorize? me: Does Skype sends verification message before assigning the email to account? The Skype name which I didn't create is [NEW SKYPE ACCOUNT] George A: May I also have the email address that was used? me: [MY EMAIL 1] George A: Well, I would need to send you a confirmation to that email address. I would kindle need you to reply back to that email. me: Please do George A: Then, we will be able to delete that Skype Name for you. me: thank you George A: You are most welcomed, please expect me email within 10 minutes. Is there anything else I can help you with today? me: Could you tell me if email accounts that are registered with Skype are being verified by sending a message to them? If so, maybe there's bug in your system? George A: We send a welcome email to the registered email address whenever a new account is set up using that email. me: OK, that's what I received. And then you also send other emails with offers to the same account. So, basically, anyone can create an account for any email. Why don't you verify emails? George A: Please understand that all of us here at Skype take our customers' privacy and confidentiality very seriously me: OK. Thank you. George A: You are most welcomed. It's been a pleasure speaking with you today. Thank you for contacting Skype Live Support, have a great day. We value your feedback. Please be aware that we will ask you a few questions after closing the chat window about your experience with us today. Once you are ready please click on the "Exit" button. me: I suggest adding a link to Welcome email that says "I didn't create this account". Bye! Realizing that there's nothing this support person can do about this, I sent email to their "security" people. I received no reply. And now this failure to verify emails leads to the linked vulnerability. Nice.

jtraub 14y ago

Password recovery form was disabled and as of now the vulnerability can not be exploited. See announcement http://community.skype.com/t5/Security-Privacy-Trust-and/Password-vulnerability/m-p/1207232 http://community.skype.com/t5/Security-Privacy-Trust-and/Pas...

scrrr 14y ago

And they said I'm crazy to create an extra email address just for Skype back then..

timf 14y ago

Microsoft reports they have disabled password resets during the investigation: http://heartbeat.skype.com/2012/11/security_issue.html http://heartbeat.skype.com/2012/11/security_issue.html

timf 14y ago
That text was replaced, here is the old text: We have had reports of a new security vulnerability issue. As a precautionary step we have temporarily disabled password reset as we continue to investigate the issue further. We apologize for the inconvenience but user experience and safety is our first priority

fromITroom 14y ago

Forgot password no longer working, seems like they switched the function for now. Step in right direction.

davidwparker 14y ago

I'm genuinely curious- what's keeping people on Skype? There are better alternatives out there now (Google+ Hangouts, for example). Will this push any of you Skype users over?

frabcus 14y ago
As far as I know, Google+ Hangouts doesn't let you call people. Is there a way to actually just phone somebody with it, the phone on their computer rings, and they answer it? Preferably with a standalone client, as I can't guarantee I'd remember to open and leave open a browser tab.
bmj 14y ago
Tons of folks (think: grandmothers and parents and other potentially non-tech-savvy folks) have been using Skype to communicate with family members across the globe for many years. Simply expecting them to switch to Google Hangouts is a tall order.
tjaerv 14y ago
The existing user base. When you communicate daily with a ton of customers using Skype, switching to something else seems a remote prospect at best.
LaGrange 14y ago
Because I don't want to sign up for Google+. I dislike the idea of bundling their social data mining solution with just about anything, like a less obvious and impossible to opt-out version of whatever-toolbar bundled with software years ago.
- DannyBee 14y ago
  and you strangely believe microsoft isn't doing the same thing with skype's data?
  - LaGrange 14y ago
    They are way, way worse at it than Google. Which is good for me.

boingy 14y ago

Not quite as bad but it is also possible to get a user's IP address just by sending them a friend request. This has been known about and exploited for months, possibly over a year. It's meant that high profile users of Skype on sites like youtube or twitch.tv have to keep their skype private and/or connect to it specifically with a proxy to avoid getting DDOSed

danso 14y ago

Any idea the period of time this bug has been present? I remember the login process being inconsistent (especially among the iOS apps) when I signed up four years ago, but I attributed it to me just being unfamiliar with the service.

lostlogin 14y ago
Yes. Wow yes. The interface is getting better, but its still awful. At least you can now return a missed call without going out the page, into contacts, and hunting the caller down. The OSX client is a whole other world of pain. FaceTime briefly looked like a promising replacement, but no.

davedx 14y ago

It looks like they've fixed it now. https://twitter.com/Skype https://twitter.com/Skype

timf 14y ago

Skype reports this has been resolved: http://heartbeat.skype.com/2012/11/security_issue.html http://heartbeat.skype.com/2012/11/security_issue.html [UPDATE:14/11/2012@15:28GMT] Early this morning we were notified of user concerns surrounding the security of the password reset feature on our website. This issue affected some users where multiple Skype accounts were registered to the same email address. We suspended the password reset feature temporarily this morning as a precaution and have made updates to the password reset process today so that it is now working properly. We are reaching out to a small number of users who may have been impacted to assist as necessary. Skype is committed to providing a safe and secure communications experience to our users and we apologize for the inconvenience.

meritt 14y ago
Good to hear they fixed it but it was responsibly disclosed a month ago and Skype did nothing whatsoever. We really need a better way to hold a company accountable for appropriately reacting to proven security threats without requiring a public disclosure.

jere 14y ago

By the way, Skype's registration page has inexplicable password rules. aaaaa1 - strength: medium aaaaa12345 - strength: poor =aStu!et$aQ@212345 - strength: poor

lambda 14y ago
Yeah, at my last job, someone implemented a password strength checking feature that would actually reject stronger passwords. It required: 1. At least 3 out of the 4 categories uppercase, lowercase, digit, special character 2. No character could be repeated more than two times 3. No sequence of 3 or more increasing or decreasing letters or numbers could be present (and not even consecutive: "ta/Tbs#cz" would be rejected because it contains "abc"). 4. No English words or names could be present. 5. It must be at least 8 characters There may have been other restrictions too, I don't recall the exact details. This meant that perfectly reasonable passphrases (like "correct horse battery staple") would be rejected. Even if you tried to come up with a good password that met the rule, you might fail by accident because "89cRbcThe*)" has the word "The" in it. You would generally have to come up with a password, then whittle it down slowly until you passed all of the rules, usually making it weaker in the process.
- mikegioia 14y ago
  So... were ANY passwords created? I could see the success rate on this at like 1%.
- smsm42 14y ago
  They must have really dedicated customers. That, or their users are required to use their system under the pain of multi-year imprisonment. I see no other way why would anyone agree to suffer through this.

leke 14y ago

Nice work MicroSoft.