Slashdot Mirror

← Back to Stories (view on slashdot.org)

Researcher Finds Dangerous Vulnerability In Skype

Posted by Soulskill on from the so-we-blame-microsoft-right dept.

alphadogg writes "A security consultant has notified Skype of a cross-site scripting flaw that could be used to change the password on someone's account, according to details posted online. The consultant, Levent Kayan, based in Berlin, posted details of the flaw on his blog on Wednesday and notified Skype a day later. He said on Friday he hasn't heard a response yet. The problem lies in a field where a person can input their mobile phone number. Kayan wrote that a malicious user can insert JavaScript into the mobile phone field of their profile." Skype has confirmed the flaw, but calls it 'minor,' saying it only affects people who communicate with a potential attacker on a regular basis. A fix is planned for next week.

25 of 42 comments (clear)

  1. Typical XSS response by funnyguy · · Score: 1

    I love how companies always downplay XSS. They figure it can only be used in the way shown and assume there is no other way to weaponize a vulnerability other than as presented.

    1. Re:Typical XSS response by ircmaxell · · Score: 1

      Exactly. Especially since almost any XSS vulnerability automatically becomes a CSRF vulnerability.

      If I can inject JS into your browser, I can do anything that you can do on that site...

      --
      If a man isn't willing to take some risk for his opinions, either his opinions are no good or he's no good
  2. spin baby, spin by sqlrob · · Score: 1

    calls it 'minor,' saying it only affects people who communicate with a potential attacker on a regular basis.

    Like say, a skilled phisher / social engineer?

    1. Re:spin baby, spin by Riceballsan · · Score: 1

      Yeah it's a minor flaw, you are perfectly safe as long as you don't talk with people. I mean who skypes with someone without getting a long detailed background check and ensuring that they don't currently and won't ever have anything against you.

    2. Re:spin baby, spin by Caesar+Tjalbo · · Score: 1

      calls it 'minor,' saying it only affects people who communicate with a potential attacker on a regular basis.

      Like say, a skilled phisher / social engineer?

      Well the guy who found the flaw is still wondering why they haven't contacted him.

      --
      "I'm not much interested in interoperability. I want substitutability. I want to be able to throw your software out."
    3. Re:spin baby, spin by HappyPsycho · · Score: 1

      U mean like a jealous / paranoid spouse?

  3. Dangerous by Normal+Dan · · Score: 1

    Just how dangerous is this flaw? Are we talking about holing an antenna during a thunderstorm dangerous, or giving my kid a loaded gun as a toy dangerous, or what?

    Just curious is all.

    --
    A unique way to learn a language: http://languageloom.com
  4. 'tis but a flesh wound by cultiv8 · · Score: 1

    Skype has confirmed the flaw, but calls it 'minor,' saying it only affects people who communicate with a potential attacker on a regular basis.

    Phew, good news. This is the same security model I use on my web server, I think Sony does too, thankfully there ain't no haxxors visiting my sites!

    --
    sysadmins and parents of newborns get the same amount of sleep.
  5. Skype doesn't care by jtara · · Score: 3, Insightful

    Skype doesn't care. But maybe their new robot overlo.... er, Microsoft will.

    A friend of mine started harassing me with text messages after he "found" an iPhone on the floor of a bar (no, seriously! no, not a prototype...) and I wouldn't help him reset it. (Actually I did - I said "Google it, it's easy".

    I had to add a blocking service from ATT, but then he switched to bombing me SMS messages from Skype. So, I attempted to contact Skype to get it stopped. Ever try to contact Skype? Like, a live person on the phone? I never managed to figure that out, but at least I did manage to get some clueless person at Skype to email me.

    It turns out there is a standard for stopping unwanted SMS messages from 5-digit codes. (The messages came from Skype's 5-digit code). You text back STOP and they are supposed to stop sending you SMSs. Guess what? Skype doesn't bother.

    I went around and around with the clueless rep over email, and they basically told me "we can't do this, contact your carrier". I tried to explain that I'd already talked to a rep from the carrier, and they told it was Skype's responsibility to do this. I tried to tell them that their "STOP" system was broken/nonexistent. They just never "got it".

    Catch-22.

    1. Re:Skype doesn't care by jtara · · Score: 2

      Oh, yea, even figuring out how to contact Skype by email is a hassle. They have a web form for this. Only problem is, you have to be a Skype customer. Why, nobody who isn't a Skype customer would ever need to contact Skype, right?

      Catch-22.

      Aside: pretty dismayed over how hard big companies try to hide from consumers these days.

    2. Re:Skype doesn't care by gomiam · · Score: 1
      STOP

      Sorry, couldn't help the pun ;)

    3. Re:Skype doesn't care by trum4n · · Score: 1

      Break his iPhone. If he calls the cops, tell them its stolen anyway.

    4. Re:Skype doesn't care by Anonymous Coward · · Score: 1

      Are you an idiot? His ex-buddy is SMSing him the same way he can SMS any phone through Skype: by typing in the phone number and clicking send! No "giving Skype your main phone number" involved.

    5. Re:Skype doesn't care by mcmonkey · · Score: 2, Insightful

      Sounds the issue is your choice of "friends", not any technical issue with skype or SMS.

    6. Re:Skype doesn't care by Threni · · Score: 1

      Skype should care, given they're about to see their market share disappear down the toilet once people discover that rather than the two inherently unreliable (given their track record) companies Microsoft and Facebook, they can instead use Google+.

    7. Re:Skype doesn't care by Bengie · · Score: 1

      My wife's sister was doing something similar once. Quick call from the police stopped that.

    8. Re:Skype doesn't care by laurelraven · · Score: 1

      From what I understand, that was the storage set aside for notifications...and this is Google, they have an ungodly amount of storage space they could call upon, and now know to watch for that. That's why it's in beta, so they can find and fix these problems before going "live" (or, as Google calls it, "Open beta").

      --
      RTFA is Known to the State of California to cause cancer.
    9. Re:Skype doesn't care by pe1chl · · Score: 1

      This is quite common today. Many social media websites offer no way to contact their support department for people who do not have an account themselves.
      When I want to contact linkedin, facebook, twitter, hyves or whatever to ask them to stop sending mail to some address, to remove a customer who has deceased, or whatever, the first thing they ask for is my username and password.
      But I don't have and don't want accounts on sites like that. I only want to report events in a role as a system administrator.
      No way to do it. They don't publish mail addresses, and the ones you may guess yourself or derive from whois are just black holes or return autoreplies that you have to use the form on their website. Which you can only access after logging in.

      Clueless idiots.

  6. Dont worry. Skype has been bought by Microsoft by unity100 · · Score: 2

    They can now say 'its not a bug, its a feature', and get it over with.

    --
    Read radical news here
    1. Re:Dont worry. Skype has been bought by Microsoft by bkaul01 · · Score: 1

      So when did the federal approval go through?

      About a month ago: Microsoft gets antitrust approval to buy Skype

  7. Re:inb4 microsoft by ArhcAngel · · Score: 1

    Rats...I was too slow.

    --
    "A person is smart. People are dumb, panicky dangerous animals and you know it." - K
  8. You don't need to worry about it by sl4shd0rk · · Score: 2

    Because we said so.

    --
    Join the Slashcott! Feb 10 thru Feb 17!
  9. Asshole by alexo · · Score: 4, Informative

    The consultant, Levent Kayan, based in Berlin, posted details of the flaw on his blog on Wednesday and notified Skype a day later.

    Asshole.

  10. Re:Skype Web Site, not Skype by laurelraven · · Score: 1

    This is like a steel plate a mile wide, which has a hole in it that's a half inch wide covered in matching tin foil.

    So, all an attacker has to do is use the Force?

    --
    RTFA is Known to the State of California to cause cancer.
  11. Phew by Opportunist · · Score: 1

    Got me worried for a moment. But it says it right there, all I have to do is ask my Skype partner whether he is a hacker and cease contact if he answers in the positive.

    Dear Skype security "experts": Whether someone is communicating with a "potential attacker" is something they learn usually a few seconds after an attack. If at all.

    --
    We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.