Researcher Finds Dangerous Vulnerability In Skype 42
alphadogg writes "A security consultant has notified Skype of a cross-site scripting flaw that could be used to change the password on someone's account, according to details posted online. The consultant, Levent Kayan, based in Berlin, posted details of the flaw on his blog on Wednesday and notified Skype a day later. He said on Friday he hasn't heard a response yet. The problem lies in a field where a person can input their mobile phone number. Kayan wrote that a malicious user can insert JavaScript into the mobile phone field of their profile."
Skype has confirmed the flaw, but calls it 'minor,' saying it only affects people who communicate with a potential attacker on a regular basis. A fix is planned for next week.
Typical XSS response (Score:1)
I love how companies always downplay XSS. They figure it can only be used in the way shown and assume there is no other way to weaponize a vulnerability other than as presented.
Re: (Score:2)
If I can inject JS into your browser, I can do anything that you can do on that site...
spin baby, spin (Score:2)
Like say, a skilled phisher / social engineer?
Re: (Score:2)
Re: (Score:1)
U mean like a jealous / paranoid spouse?
Re: (Score:1)
Like say, a skilled phisher / social engineer?
Well the guy who found the flaw is still wondering why they haven't contacted him.
Re: (Score:2)
Dangerous (Score:2)
Just curious is all.
'tis but a flesh wound (Score:2)
Skype has confirmed the flaw, but calls it 'minor,' saying it only affects people who communicate with a potential attacker on a regular basis.
Phew, good news. This is the same security model I use on my web server, I think Sony does too, thankfully there ain't no haxxors visiting my sites!
Skype doesn't care (Score:4, Insightful)
Skype doesn't care. But maybe their new robot overlo.... er, Microsoft will.
A friend of mine started harassing me with text messages after he "found" an iPhone on the floor of a bar (no, seriously! no, not a prototype...) and I wouldn't help him reset it. (Actually I did - I said "Google it, it's easy".
I had to add a blocking service from ATT, but then he switched to bombing me SMS messages from Skype. So, I attempted to contact Skype to get it stopped. Ever try to contact Skype? Like, a live person on the phone? I never managed to figure that out, but at least I did manage to get some clueless person at Skype to email me.
It turns out there is a standard for stopping unwanted SMS messages from 5-digit codes. (The messages came from Skype's 5-digit code). You text back STOP and they are supposed to stop sending you SMSs. Guess what? Skype doesn't bother.
I went around and around with the clueless rep over email, and they basically told me "we can't do this, contact your carrier". I tried to explain that I'd already talked to a rep from the carrier, and they told it was Skype's responsibility to do this. I tried to tell them that their "STOP" system was broken/nonexistent. They just never "got it".
Catch-22.
Re: (Score:3)
Oh, yea, even figuring out how to contact Skype by email is a hassle. They have a web form for this. Only problem is, you have to be a Skype customer. Why, nobody who isn't a Skype customer would ever need to contact Skype, right?
Catch-22.
Aside: pretty dismayed over how hard big companies try to hide from consumers these days.
Re: (Score:2)
This is quite common today. Many social media websites offer no way to contact their support department for people who do not have an account themselves.
When I want to contact linkedin, facebook, twitter, hyves or whatever to ask them to stop sending mail to some address, to remove a customer who has deceased, or whatever, the first thing they ask for is my username and password.
But I don't have and don't want accounts on sites like that. I only want to report events in a role as a system administrator.
No
Re: (Score:2)
Sorry, couldn't help the pun ;)
Re: (Score:1)
Re: (Score:1)
Are you an idiot? His ex-buddy is SMSing him the same way he can SMS any phone through Skype: by typing in the phone number and clicking send! No "giving Skype your main phone number" involved.
Re: (Score:3, Insightful)
Sounds the issue is your choice of "friends", not any technical issue with skype or SMS.
Re: (Score:1)
Skype should care, given they're about to see their market share disappear down the toilet once people discover that rather than the two inherently unreliable (given their track record) companies Microsoft and Facebook, they can instead use Google+.
Re: (Score:1)
Re: (Score:2)
My wife's sister was doing something similar once. Quick call from the police stopped that.
Dont worry. Skype has been bought by Microsoft (Score:2)
Re: (Score:1)
So when did the federal approval go through?
Re: (Score:2)
So when did the federal approval go through?
About a month ago: Microsoft gets antitrust approval to buy Skype [reuters.com]
What do you expect? (Score:1)
Waiting for the wooshes...
You don't need to worry about it (Score:3)
Because we said so.
Re: (Score:1)
This is like a steel plate a mile wide, which has a hole in it that's a half inch wide covered in matching tin foil.
So, all an attacker has to do is use the Force?
Asshole (Score:5, Informative)
Asshole.
Phew (Score:2)
Got me worried for a moment. But it says it right there, all I have to do is ask my Skype partner whether he is a hacker and cease contact if he answers in the positive.
Dear Skype security "experts": Whether someone is communicating with a "potential attacker" is something they learn usually a few seconds after an attack. If at all.