Skype fixes account hijacking vulnerability

Skype has temporarily disabled its password reset function while it was investigating reports about a vulnerability that has been misused to hijack users’ accounts, but the function is now available again as they claim to have fixed the problem.

The attack was easy to execute – the only thing the attacker needed was the email address the victim had used to open his Twitter account.

Armed with this information, the attacker could have used the same email address to open another account, then request a password reset. With the password reset token, which is sent to the attacker’s Skype client, he could enter the victim’s account and lock him out.

According to the BBC, the details about the vulnerability have been posted two months ago on a Russian forum, but have remained unknown to the general populace until they were shared on Reddit.

The attack was reproduced both by The Next Web and heise Security, and Skype has been notified about the existence of the flaw.

“We are reaching out to a small number of users who may have been impacted to assist as necessary,” shared Skype engineer Leonas Sendrauskas.