Slashdot Mirror
Researcher Finds Dangerous Vulnerability In Skype
alphadogg writes "A security consultant has notified Skype of a cross-site scripting flaw that could be used to change the password on someone's account, according to details posted online. The consultant, Levent Kayan, based in Berlin, posted details of the flaw on his blog on Wednesday and notified Skype a day later. He said on Friday he hasn't heard a response yet. The problem lies in a field where a person can input their mobile phone number. Kayan wrote that a malicious user can insert JavaScript into the mobile phone field of their profile."
Skype has confirmed the flaw, but calls it 'minor,' saying it only affects people who communicate with a potential attacker on a regular basis. A fix is planned for next week.
As written in original paper it appears that any user you talked with can reset your password....
I love how companies always downplay XSS. They figure it can only be used in the way shown and assume there is no other way to weaponize a vulnerability other than as presented.
Like say, a skilled phisher / social engineer?
inb4 any comments blaming Microsoft.
Just how dangerous is this flaw? Are we talking about holing an antenna during a thunderstorm dangerous, or giving my kid a loaded gun as a toy dangerous, or what?
Just curious is all.
A unique way to learn a language: http://languageloom.com
Skype has confirmed the flaw, but calls it 'minor,' saying it only affects people who communicate with a potential attacker on a regular basis.
Phew, good news. This is the same security model I use on my web server, I think Sony does too, thankfully there ain't no haxxors visiting my sites!
sysadmins and parents of newborns get the same amount of sleep.
Skype doesn't care. But maybe their new robot overlo.... er, Microsoft will.
A friend of mine started harassing me with text messages after he "found" an iPhone on the floor of a bar (no, seriously! no, not a prototype...) and I wouldn't help him reset it. (Actually I did - I said "Google it, it's easy".
I had to add a blocking service from ATT, but then he switched to bombing me SMS messages from Skype. So, I attempted to contact Skype to get it stopped. Ever try to contact Skype? Like, a live person on the phone? I never managed to figure that out, but at least I did manage to get some clueless person at Skype to email me.
It turns out there is a standard for stopping unwanted SMS messages from 5-digit codes. (The messages came from Skype's 5-digit code). You text back STOP and they are supposed to stop sending you SMSs. Guess what? Skype doesn't bother.
I went around and around with the clueless rep over email, and they basically told me "we can't do this, contact your carrier". I tried to explain that I'd already talked to a rep from the carrier, and they told it was Skype's responsibility to do this. I tried to tell them that their "STOP" system was broken/nonexistent. They just never "got it".
Catch-22.
They can now say 'its not a bug, its a feature', and get it over with.
Read radical news here
a troll, to annoy people
Copyright (C) 2011 Anonymous Coward
This troll is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
This troll is distributed in the hope that it will be annoying,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this troll. If not, see <http://www.gnu.org/licenses/>.
GNU GENERAL PUBLIC LICENSE
Version 3, 29 June 2007
Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>
Everyone is permitted to copy and distribute verbatim copies
of this license document, but changing it is not allowed.
Preamble
The GNU General Public License is a free, copyleft license for
software and other kinds of works.
The licenses for most software and other practical works are designed
to take away your freedom to share and change the works. By contrast,
the GNU General Public License is intended to guarantee your freedom to
share and change all versions of a program--to make sure it remains free
software for all its users. We, the Free Software Foundation, use the
GNU General Public License for most of our software; it applies also to
any other work released this way by its authors. You can apply it to
your programs, too.
When we speak of free software, we are referring to freedom, not
price. Our General Public Licenses are designed to make sure that you
have the freedom to distribute copies of free software (and charge for
them if you wish), that you receive source code or can get it if you
want it, that you can change the software or use pieces of it in new
free programs, and that you know you can do these things.
To protect your rights, we need to prevent others from denying you
these rights or asking you to surrender the rights. Therefore, you have
certain responsibilities if you distribute copies of the software, or if
you modify it: responsibilities to respect the freedom of others.
For example, if you distribute copies of such a program, whether
gratis or for a fee, you must pass on to the recipients the same
freedoms that you received. You must make sure that they, too, receive
or can get the source code. And you must show them these terms so they
know their rights.
Developers that use the GNU GPL protect your rights with two steps:
(1) assert copyright on the software, and (2) offer you this License
giving you legal permission to copy, distribute and/or modify it.
For the developers' and authors' protection, the GPL clearly explains
that there is no warranty for this free software. For both users' and
authors' sake, the GPL requires that modified versions be marked as
changed, so that their problems will not be attributed erroneously to
authors of previous versions.
Some devices are designed to deny users access to install or run
modified versions of the software inside them, although the manufacturer
can do so. This is fundamentally incompatible with the aim of
protecting use
I just tried this on the skype.com edit your profile mobile number field.
Firstly i had to remove the field length limit, after i did this and posted the
"><iframe src='' onload=alert('mphone')>
the page reloaded with only the "> stored and these had been changed to their html values ">
or am i missing something?
Bah! What do you expect to happen? It's crappy Microsoft software, of course it has security vulnerabilities.
.
.
.
.
.
Waiting for the wooshes...
Because we said so.
Join the Slashcott! Feb 10 thru Feb 17!
When I first read the headline, I thought the problem was in Skype itself. It should be noted this is not the case - the flaw is in a page on Skype's Account Management site. We're not talking about the app that users run almost 24/7. We're talking about the site they log into maybe, MAYBE once a month to refill time.
The ease with which this can be exploited has been understated by Skype, however the researcher has greatly overstated the attack vector itself. This is like a steel plate a mile wide, which has a hole in it that's a half inch wide covered in matching tin foil. That is, it's insanely easy to exploit, but the only time you can hit it is when the user is actively logged into Skype's site, which for most users will be basically never.
So yeah...they're kinda both wrong.
a.k.a. the end-user.
Asshole.
Got me worried for a moment. But it says it right there, all I have to do is ask my Skype partner whether he is a hacker and cease contact if he answers in the positive.
Dear Skype security "experts": Whether someone is communicating with a "potential attacker" is something they learn usually a few seconds after an attack. If at all.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.