(It does now.)Īfter Microsoft acquired Skype, they added support for ‘linking’ a Microsoft account to your Skype account. The sign up flow never used to prompt for an email address or phone number. Long time users of Skype will have set up their Skype account under a username. (Skype accounts aren’t always linked to email addresses, making the password recovery process notoriously difficult.) Issue Leaving them open leaves you at high risk of being the source of embarrassing spam messages to your contacts, and potentially being locked out of your Skype account for good. These vulnerabilities are simple to close. I expect many people to be in similar position, based on Microsoft + Skype’s approach to account migrations over the years. The links had been tagged with my owner username, likely to give them info on whose accounts to target next.Īfter a little bit of digging, I found vulnerabilities in my own Skype account setup. The spam messages were simple links via Baidu or LinkedIn open redirect endpoints. I received several spam messages from contacts of mine, all of whom were knowledgeable about IT security, and avid users of password managers and two factor authentication.
There has been quite a peak of spam on Skype this week, involving compromised credentials. Sign in with your Skype account (old Skype username, not email or phone number)įor the most complete fix, and a little background, read on.If you don’t have time to read the full post below, these are the minimum steps you should follow to secure your Skype account:
0 kommentar(er)
