Skype account hijack technique may affect all users

http://community.skype.com/t5/Security-Privacy-Trust-and/URGENT-Skype-Support-Account-Security-Issue-CAN-AFFECT-ALL-USERS/td-p/1552372

by dewey • 13 years ago

265 66 13 years ago

community.skype.com

hmottestad• 13 years ago

Can anyone verify this story?

eksith2• 13 years ago

Something similar happened to a friend of mine 3 months ago, however I didn't have this much detail.

What I did know was that the person who took over his (my friend's) account didn't have his laptop or PC hacked but the hijacker used Skype support instead and involved, what I'm assuming, the same information that the OP's thread mentions.

Interestingly, there's no link to what the moderator was mentioning here :

"Dear All,

The post in question was deleted from this thread as the information was duplicate-posted elsewhere. The post did not directly contribute to the topic.

This thread has been escalated to those to whom I report.

Regards,

Elaine

Community Moderator"

I'm curious to find where that "elsewhere" is. I've never seen a legitimate case of posts being deleted because content was "duplicate-posted elsewhere." At the most, the thread will get locked with a link to wherever "elsewhere" resides.

hga• 13 years ago

A commenter after that, posting "1 hour ago" like you at the moment, says the information was on Skype alternatives.

I can just imagine the Skype forums having that as a high visibility pinned topic ^_^.

Guillaumeish• 13 years ago

No need to verify, it works. Trust me, trust this stranger from the Internet.

ams6110• 13 years ago

TL;DR: Social engineering attacks work. I was able to reset my Ameritrade account password by giving the support person the name of one of the stocks in my portfolio (along with some other basic identifying info).

stygiansonic• 13 years ago

TD Waterhouse works the same way. I was actually surprised at how little information was asked of me when I phoned in.

tokenadult• 13 years ago

Did you phone in on a landline from a place reasonably connected to your previously reported identity, such as your home?

darkarmani• 13 years ago

> TL;DR: Social engineering attacks work.

They work against the service company you mean. This is not a normal vector. The company is supposed to be smart enough to not divulge their customer's accounts through social engineering.

lucb1e• 13 years ago

> supposed to be smart enough

You should ask Kevin Mitnick about that :)

aashaykumar92• 13 years ago

If this is true, I'm glad it reached the front page of HN. Given all the popular services out there which we use with just enough trust to put our privacy in jeopardy, I'm glad a hole is being exposed in such a big service. Hopefully Skype changes their verification practices.

bskap• 13 years ago

Skype is switching to use Microsoft Accounts, which have security questions and 2-factor auth. This vulnerability is only for people who haven't switched yet.

meritt• 13 years ago

Haven't switched? You say that like Skype is actually forcing or even suggesting users switch. I just logged into my account. Aside from a 'Microsoft Accounts' button on the login screen, there isn't a single thing about MS Accounts let alone "you need to change your account!"

So, I'm going to wager this vulnerability affects about 99.99% of the users.

futhey• 13 years ago

How many years has microsoft owned skype now?

venomsnake2• 13 years ago

A lot of people don't want MS accounts. And for good reasons.

Morphling• 13 years ago

I'm really curious in what legit situation this kind of "account recovery" would be needed.

Like you forgot your email address and/or password so you can't recover you skype account via that way?

plorkyeran• 13 years ago

There's plenty of ways people can lose access to the attached email address: signed up with a work email, then left the company; signed up with an ISP email, then switched ISPs; email provider went out of business; Google banned your account. It's useful to have a fallback for those cases.

adir1• 13 years ago

With little amount of information Skype requires when signing up, I think fallback option is just not feasible. If you left the company or email provider out of business - and you forgot to switch your email AND THEN you forgot your password??! Just sign up for new Skype account...

david_shaw2• 13 years ago

It's interesting to see a social engineering proof of concept released in this way.

When my company conducts social engineering assessments, whether physical or remote, it always surprises the client to see how high their rates of failure are. We rarely hit below 40% of users willing to change their passwords for us on the phone, and usually more than half of the employees we email an arbitrary URL will enter their password on a cloned webmail portal.

Most security advisories we see are for software vulnerabilities, but it's interesting that "Ximer," the user who posted the linked forum advisory, seemed to map out exactly the information needed to conduct this attack.

Hopefully Skype takes swift action to require more identity verification so this attack doesn't become pervasive... but at the same time, it should be no surprise that "social engineering works."

praptak2• 13 years ago

> it should be no surprise that "social engineering works."

Is it really social engineering if the employees followed the Microsoft policy, however crappy it might be? I always thought social engineering is making someone break the policy by psychological tricks.

david_shaw2• 13 years ago

> Is it really social engineering if the employees followed the Microsoft policy

I'd say that the attack vector is still social engineering; the difference here is that the result is not based in policy failure.

Normally we recommend that clients require their employees to attend security awareness training, in order for them to understand social engineering risks and remind them to follow the correct policies that are put in place.

In this instance, however, there is no policy being broken. My summation of the issue would be that it is a policy failure being exploited by a social engineering attack vector.

smsm427• 13 years ago

If it's exploiting human factor vulnerability as opposed to software/hardware vulnerability, it is social engineering. It's like saying "this is not a vulnerability because our software does not have a buffer overflow - it just allows anybody who enters admin/admin as login/password to have full access". It's only worse if policies are so broken that you don't even have to violate them to get unauthorized access.

youngtaff• 13 years ago

Someone hacked my Skype account back last summer and took at a subscription to Guatemala.

Skype picked it up and locked me out of my account but after that were quite frankly F All use: wouldn't refund the money, wouldn't give me any details as to where my account had been accessed from (citing privacy concerns!!!)

Furthermore they even left the fraudulent subscription in place until I cancelled it.

Don't leave money in a Skype account or hook it up to a credit card

oakaz• 13 years ago

Similar story: Last summer I realized that one guy from India was using my Skype account with me at the same time. He was making a lot of phone calls to his girlfriend, and Skype was charging my bank account all the time. I noticed once he forgot removing the history before he logs out.

flog• 13 years ago

Ditto: Logged in to find a bunch of calls to Pakistan

thebadplus• 13 years ago

I think there's a conflict of interest. If you're telling the truth, and they lock you out of your account, then they lose a customer. If an attacker is trying to steal your identity, you suffer much more than Skype.

Thanks for bringing this to my attention.

dewiz• 13 years ago

I can't see any conflict of interests. Skype would lose x>1 customers mistakenly locking out one users who blogs about it. When in doubt you can tell the user the identity verification test didn't go well and ask for extra information about the account, for example checking the IPs.

uvdiv• 13 years ago

Are there Skype alternatives which aren't so thoroughly dependent on a third party?

jacquesm• 13 years ago

SpeakFreely. It's old but it just works.

Sprint• 13 years ago

https://jitsi.org let's you do voice and video chat on top of XMPP. It's free software and runs on Win/Linux/Mac

kevinpet• 13 years ago

"because Skype support didn't verify if the person owned the account or not, just wanted those 3 points mentioned above"

So, what? Is the author expecting Skype to just have some "does this person own the account" crystal ball? What do they want? If it's security questions, I don't consider those much of a solution because the questions tend to be very poor on the ratio of "things I can remember specifically" to "things people can't look up about me".

praptak2• 13 years ago

There is a huge difference between:

* poor security question, which is up to the user to choose

* poor account recovery policy which is Microsoft choice, is the same for all users and which the user cannot do anything about

Dylan16807• 13 years ago

One thing they could do is check if you're still logged in when you call up claiming to need account recovery.

rlt• 13 years ago

Am I reading this wrong, or does this guy run a DDoS service?

"Security Researcher, Hacker, Software Developer, http://www.hfempire.net - Cheap DDoS Tool, up to 35+ GBPS Attacks, Bypass DDoS Protection!"

https://twitter.com/TibitXimer

D9u• 13 years ago

Your assessment appears to be valid.

http://www.hfempire.net/register

    *Boot Time:*
    *Concurrent Attacks:*
    *Subscription:*
    *Referrer:*
    *Discount Code:*
    *Total Price:   $10.99 USD*

A case of poetic justice if I've ever seen one.

smsm427• 13 years ago

I love it how every computer criminal now calls himself "security researcher". Muggers should start calling themselves "personal security researchers" and burglars should be "house security researchers".

tptacek2• 13 years ago

Careful. This sentiment has also been used in the other direction, to suggest that people who inspect software for vulnerabilities, including software they've downloaded and run or purchased on hardware, are themselves epsilon from criminals.

mathgorges• 13 years ago

He does, and his service does as it claims.

I manage a school network and despite our ISP provided "DDOS Protected" IPs a single student with a spare $12 was able to keep us down for a week using that service.

Screw that guy.

GhotiFish3• 13 years ago

on the one hand. Ouch.

but on the other, I have to salute that clever little anarchist bastard you have over there.

patcon• 13 years ago

Yeah. What an asshole. Almost makes me want to hijack his Skype account.

venomsnake2• 13 years ago

Make him sysadmin. That was the only way me and my classmates were reigned in while in high school.

yoster• 13 years ago

Good thing I don't use Skype.

unreal37• 13 years ago

Not sure I trust this. A thread on a forum, where the first 20 posts are just two (sockpuppet?) users talking to each other in full support of each other.

And then he keeps saying "scammers have stolen hundreds of dollars from friends of mine through Skype." And "I've lost the trust of my customers". And the guy runs a DDOS service as his business.

If you hire someone to do DDOS for you, do you trust him?

oddshocks• 13 years ago

Across the globe, thousands of free software advocates are completely unaffected.

Qantourisc• 13 years ago

Hell ! Even a bloody e-mail-reset-password is more safe then THIS! Good think I didn't decide to switch from MSN to Skype yet (and drop both) ... but now I decided.

littletables• 13 years ago

I wrote this article (same title as HN post above) 27 Apr 2013 02:40 PDT.

Here it is in its entirety with updates as of ten minutes ago: http://www.zdnet.com/alert-skype-account-hijack-technique-ma...

Skype account hijack technique may affect all users

Related Stories