Skype warned in August of email flaws - The Guardian

Skype was warned in August by a Russian programmer about a vulnerability closely linked to the one the company admits has been exploited to hijack peoples' accounts using just their email address.

Dmitry Chestnykh, the founder of the software company Coding Robots, has shown the Guardian a dated transcript of a conversation he had on 7 August with Skype support in which he pointed out that anyone could create a new Skype account using a email address – even if they didn't control it. He has also published the transcript, without the date, on Hacker News.

Chestnykh says he subsequently sent an email to Skype's security but received no response. He became suspicious when he received an email confirming the setup of a new Skype account at his email – showing that Skype did not use a verification system before allowing the creation of new accounts.

To prove the weakness he reported still exists, he set up an account using the email of Steve Ballmer, Microsoft's chief executive, on Wednesday. "Ballmer@microsoft.com now has a new Skype account. Congrats!" he tweeted.

The flaw is similar to the one which Skype closed off on Wednesday, in which hackers could take control of an account if they knew the email address used by the person who controlled it. The hack was carried out via a web form that was provided for the reset; the owner's email account was not compromised.

Skype said on Wednesday afternoon that it had closed off the flaw and that the problem had affected a "small" number of users who it thinks may have been hacked in this way – but declined to elaborate on how the "small" figure compared to its registered user base of over 600 million or the 45 million who are online at any time.

"Early this morning we were notified of user concerns surrounding the security of the password reset feature on our website," the company said in a statement. "This issue affected some users where multiple Skype accounts were registered to the same email address. We suspended the password reset feature temporarily this morning as a precaution and have made updates to the password reset process today so that it is now working properly.

"We are reaching out to a small number of users who may have been impacted to assist as necessary. Skype is committed to providing a safe and secure communications experience to our users and we apologise for the inconvenience."

Chestnykh said that though the flaw he reported differs from the one that hackers exploited – because theirs used existing accounts tied to email addresses, and his used new accounts on untaken addresses – if Skype had fixed the flaw he had discovered, it would probably have found the one he did.

He told the Guardian: "What I reported in August and today's vulnerability, which has been discovered by different people (I don't know them), are different issues. What I claim is that if they fixed the issue I reported, there possibly wouldn't be a way to exploit today's vulnerability. Maybe I wasn't the first person to report the issue, too."

Skype did not respond to a request for comment by the time this story was published.