Forgot your password?
typodupeerror
Bug Communications Security IT

Researcher Finds Dangerous Vulnerability In Skype 42

Posted by Soulskill
from the so-we-blame-microsoft-right dept.
alphadogg writes "A security consultant has notified Skype of a cross-site scripting flaw that could be used to change the password on someone's account, according to details posted online. The consultant, Levent Kayan, based in Berlin, posted details of the flaw on his blog on Wednesday and notified Skype a day later. He said on Friday he hasn't heard a response yet. The problem lies in a field where a person can input their mobile phone number. Kayan wrote that a malicious user can insert JavaScript into the mobile phone field of their profile." Skype has confirmed the flaw, but calls it 'minor,' saying it only affects people who communicate with a potential attacker on a regular basis. A fix is planned for next week.
This discussion has been archived. No new comments can be posted.

Researcher Finds Dangerous Vulnerability In Skype

Comments Filter:
  • I love how companies always downplay XSS. They figure it can only be used in the way shown and assume there is no other way to weaponize a vulnerability other than as presented.

    • Exactly. Especially since almost any XSS vulnerability automatically becomes a CSRF vulnerability.

      If I can inject JS into your browser, I can do anything that you can do on that site...
  • calls it 'minor,' saying it only affects people who communicate with a potential attacker on a regular basis.

    Like say, a skilled phisher / social engineer?

    • Yeah it's a minor flaw, you are perfectly safe as long as you don't talk with people. I mean who skypes with someone without getting a long detailed background check and ensuring that they don't currently and won't ever have anything against you.
    • calls it 'minor,' saying it only affects people who communicate with a potential attacker on a regular basis.

      Like say, a skilled phisher / social engineer?

      Well the guy who found the flaw is still wondering why they haven't contacted him.

  • Just how dangerous is this flaw? Are we talking about holing an antenna during a thunderstorm dangerous, or giving my kid a loaded gun as a toy dangerous, or what?

    Just curious is all.
  • Skype has confirmed the flaw, but calls it 'minor,' saying it only affects people who communicate with a potential attacker on a regular basis.

    Phew, good news. This is the same security model I use on my web server, I think Sony does too, thankfully there ain't no haxxors visiting my sites!

  • Skype doesn't care (Score:4, Insightful)

    by jtara (133429) on Friday July 15, 2011 @03:49PM (#36779330)

    Skype doesn't care. But maybe their new robot overlo.... er, Microsoft will.

    A friend of mine started harassing me with text messages after he "found" an iPhone on the floor of a bar (no, seriously! no, not a prototype...) and I wouldn't help him reset it. (Actually I did - I said "Google it, it's easy".

    I had to add a blocking service from ATT, but then he switched to bombing me SMS messages from Skype. So, I attempted to contact Skype to get it stopped. Ever try to contact Skype? Like, a live person on the phone? I never managed to figure that out, but at least I did manage to get some clueless person at Skype to email me.

    It turns out there is a standard for stopping unwanted SMS messages from 5-digit codes. (The messages came from Skype's 5-digit code). You text back STOP and they are supposed to stop sending you SMSs. Guess what? Skype doesn't bother.

    I went around and around with the clueless rep over email, and they basically told me "we can't do this, contact your carrier". I tried to explain that I'd already talked to a rep from the carrier, and they told it was Skype's responsibility to do this. I tried to tell them that their "STOP" system was broken/nonexistent. They just never "got it".

    Catch-22.

    • by jtara (133429)

      Oh, yea, even figuring out how to contact Skype by email is a hassle. They have a web form for this. Only problem is, you have to be a Skype customer. Why, nobody who isn't a Skype customer would ever need to contact Skype, right?

      Catch-22.

      Aside: pretty dismayed over how hard big companies try to hide from consumers these days.

      • by pe1chl (90186)

        This is quite common today. Many social media websites offer no way to contact their support department for people who do not have an account themselves.
        When I want to contact linkedin, facebook, twitter, hyves or whatever to ask them to stop sending mail to some address, to remove a customer who has deceased, or whatever, the first thing they ask for is my username and password.
        But I don't have and don't want accounts on sites like that. I only want to report events in a role as a system administrator.
        No

    • by gomiam (587421)
      STOP

      Sorry, couldn't help the pun ;)

    • by trum4n (982031)
      Break his iPhone. If he calls the cops, tell them its stolen anyway.
    • Re: (Score:3, Insightful)

      by mcmonkey (96054)

      Sounds the issue is your choice of "friends", not any technical issue with skype or SMS.

    • by Threni (635302)

      Skype should care, given they're about to see their market share disappear down the toilet once people discover that rather than the two inherently unreliable (given their track record) companies Microsoft and Facebook, they can instead use Google+.

    • by Bengie (1121981)

      My wife's sister was doing something similar once. Quick call from the police stopped that.

  • They can now say 'its not a bug, its a feature', and get it over with.
  • Bah! What do you expect to happen? It's crappy Microsoft software, of course it has security vulnerabilities.
    .
    .
    .
    .
    .
    Waiting for the wooshes...
  • by sl4shd0rk (755837) on Friday July 15, 2011 @04:14PM (#36779588)

    Because we said so.

  • Asshole (Score:5, Informative)

    by alexo (9335) on Friday July 15, 2011 @07:04PM (#36781216) Journal

    The consultant, Levent Kayan, based in Berlin, posted details of the flaw on his blog on Wednesday and notified Skype a day later.

    Asshole.

  • Got me worried for a moment. But it says it right there, all I have to do is ask my Skype partner whether he is a hacker and cease contact if he answers in the positive.

    Dear Skype security "experts": Whether someone is communicating with a "potential attacker" is something they learn usually a few seconds after an attack. If at all.

The flow chart is a most thoroughly oversold piece of program documentation. -- Frederick Brooks, "The Mythical Man Month"

Working...