If that email account was already linked to an existing account, a message reading "you already have a Skype account" would appear, but the attacker would still be able to create a new account linked to the old email address.Īfter that, there would be two different Skype accounts, with two different passwords, connected to a single email address. Microsoft is looking to integrate Skype and its Windows Live Messenger system in the next few months, pulling the instant messaging clients into Skype.Exploiting the vulnerability would begin by registering a new Skype account with the victim's known email address. We apologise for the inconvenience, but user experience and safety is our first priority." As a precautionary step, we have temporarily disabled password reset as we continue to investigate the issue further. Skype moved quickly to block the hole, and said in a statement: "We have had reports of a new security vulnerability issue. There are no details so far about how many accounts may have been hacked. Gaining control of a Skype account could let hackers use any credit to make calls, though the broader use is unclear. That page allowed people to reset a password without having access to the email account itself. The key flaw is a web page in the password reset system, to which a token is also sent when a password reset request is made. The step-by-step explanation of how to hack the accounts was posted on a blog early on Wednesday, and gave simple instructions which used the "disposable account" facility offered by Skype to take control of existing accounts. Skype, which was acquired by Microsoft in May 2011 for $8.5bn (£5.3bn), has more than 600 million registered users, and regularly sees more than 45 million online at any time. However, captured accounts may have had their primary emails changed by any hackers who have grabbed them. Anyone who has received an email asking them if they want to reset their Skype password should check that it has not been taken over – and should reset the password themselves using the account details they have if so.
0 kommentar(er)
