📎 AI Summary:
The thread discusses a security vulnerability in Skype involving a cross-site scripting flaw that could allow attackers to hijack sessions or change user passwords through malicious code inserted into the mobile phone input field. The flaw was reported by a security consultant to Skype, who had not received a response at the time. The overall tone is informative, highlighting a significant security concern for Skype users, especially those on mobile.
JMH

JMH

Senior Member
Member details
Joined
Sep 21, 2010
Messages
361
Thread Author #1
A security consultant has notified Skype of a cross-site scripting flaw that could be used to change the password on someone's account, according to details posted online.
Click to expand...

The consultant, Levent Kayan, based in Berlin, Link Removed - Invalid URL on Wednesday and notified Skype a day later. He said on Friday he hasn't heard a response yet.
The problem lies in a field where a person can input their mobile phone number. Kayan wrote that a malicious user can insert JavaScript into the mobile phone field of their profile.
When one of their contacts comes online, the malicious user's profile will be updated, and the JavaScript will be executed when the other contact logs in. Kayan wrote that the other person's session could be hijacked, and it may be possible to gain control of that person's computer. An attacker could also change the password on someone's account.
Click to expand...
Link Removed
 

You must log in or register to reply here.