Incident: Skype Password Reset Vulnerability Leads to Account Takeover

Published Date: 2012-11-14

Postmortem Analysis
Timeline 1. The software failure incident of Skype's password reset capability being disabled due to a security hole happened on November 14, 2012, as reported in [Article 15779].
System 1. Skype's password reset system [15779]
Responsible Organization 1. Hackers discovered a serious security hole in Skype's password reset system, leading to the software failure incident [Article 15779].
Impacted Organization 1. Skype users [15779]
Software Causes 1. The software cause of the failure incident was a serious security hole in Skype's password reset system that allowed anyone to take control of an account by knowing its email address [15779].
Non-software Causes 1. Lack of proper account verification processes: The hack was possible due to a flaw in Skype's password reset system that allowed individuals to reset passwords without access to the associated email account, indicating a lack of robust verification processes [Article 15779].
Impacts 1. The software failure incident allowed hackers to take control of Skype accounts by knowing the email address associated with the account, potentially compromising user data and privacy [15779]. 2. Users who received emails asking them to reset their Skype passwords were at risk of having their accounts taken over by hackers [15779]. 3. The incident led to Skype disabling its password reset capability as a precautionary measure to investigate the security vulnerability further, causing inconvenience to users [15779].
Preventions 1. Implementing a more secure password reset system that requires additional verification steps beyond just knowing the email address, such as multi-factor authentication or security questions [15779]. 2. Regularly conducting security audits and penetration testing to identify and address vulnerabilities before they can be exploited by hackers [15779]. 3. Educating users about best practices for online security, such as creating strong and unique passwords, avoiding suspicious emails, and being cautious with password reset requests [15779].
Fixes 1. Implementing a more secure password reset system that requires additional verification steps to prevent unauthorized access to accounts [15779].
References 1. Russian underground forums 2. Blog post 3. Skype statement 4. Microsoft

Software Taxonomy of Faults

Category Option Rationale
Recurring unknown (a) The software failure incident related to a security vulnerability in Skype's password reset system is specific to Skype, which is owned by Microsoft. There is no mention in the article of a similar incident happening again within the same organization or with its products and services. (b) The article does not provide information about a similar incident happening at other organizations or with their products and services.
Phase (Design/Operation) design, operation (a) The software failure incident in the article can be attributed to a design flaw in Skype's password reset system. The key flaw identified was a web page in the password reset system that allowed people to reset a password without having access to the email account itself. This design vulnerability enabled hackers to take control of existing accounts by exploiting the password reset mechanism [15779]. (b) The software failure incident can also be linked to operational factors, specifically the misuse of the system by hackers. The hackers discovered a serious security hole in Skype's password reset capability and exploited it to gain unauthorized access to user accounts. This misuse of the system led to the need for Skype to disable the password reset feature temporarily to investigate and address the security vulnerability [15779].
Boundary (Internal/External) within_system (a) The software failure incident in the article is within_system. The hack on Skype's password reset capability was due to a serious security hole within Skype's system that allowed anyone to take control of an account by exploiting a flaw in the password reset system. This flaw enabled hackers to reset passwords without having access to the email account itself, leading to potential account takeovers [15779].
Nature (Human/Non-human) non-human_actions (a) The software failure incident in this case occurred due to non-human actions. The incident was a result of a serious security hole in Skype's password reset system that allowed anyone to take control of an account by exploiting a flaw in the web page used for password resets. This flaw enabled individuals to reset passwords without needing access to the associated email account, leading to potential account takeovers [15779].
Dimension (Hardware/Software) software (a) The software failure incident in the article is not related to hardware issues. It is primarily a security vulnerability in Skype's password reset system that allowed hackers to take control of accounts without having access to the email account itself. This vulnerability was exploited by manipulating the web page in the password reset system and using the "disposable account" facility offered by Skype [15779]. (b) The software failure incident is directly related to a flaw in Skype's software, specifically in the password reset system. The key flaw allowed individuals to reset a password without needing access to the associated email account, thereby enabling unauthorized access to user accounts. This flaw was exploited by hackers, leading to the temporary disabling of the password reset capability by Skype to address the security vulnerability [15779].
Objective (Malicious/Non-malicious) malicious (a) The software failure incident reported in Article 15779 is malicious in nature. Hackers discovered a serious security hole in Skype's password reset capability that could allow anyone to take control of an account by knowing its email address. The hack was known among Russian underground forums and instructions on how to exploit the vulnerability were posted on a blog. This incident involved unauthorized access to user accounts with the potential to use any credit to make calls, indicating malicious intent [15779].
Intent (Poor/Accidental Decisions) poor_decisions (a) The software failure incident related to the Skype hack can be attributed to poor decisions made in the design and implementation of the password reset system. The key flaw in the system allowed individuals to reset a password without needing access to the associated email account, leading to a serious security vulnerability [15779]. This poor decision in the design of the system ultimately enabled hackers to exploit the loophole and potentially take control of user accounts.
Capability (Incompetence/Accidental) development_incompetence (a) The software failure incident in the article can be attributed to development incompetence. The incident involved a serious security hole in Skype's password reset system that allowed hackers to take control of accounts without needing access to the email account itself. This flaw was exploited by following simple instructions posted on a blog, utilizing the "disposable account" facility offered by Skype. The article mentions that Skype moved quickly to block the vulnerability and disabled the password reset capability as a precautionary step while investigating the issue further [15779]. (b) The incident does not seem to be related to accidental factors but rather to a deliberate exploitation of the security flaw in the password reset system.
Duration temporary (a) The software failure incident in the article is temporary. Skype disabled its password reset capability temporarily after discovering a serious security hole that could allow anyone to take control of an account. The article mentions that Skype moved quickly to block the security hole and temporarily disabled the password reset feature as a precautionary step while they investigated the issue further [Article 15779].
Behaviour crash (a) crash: The software failure incident in the article can be categorized as a crash. Skype disabled its password reset capability after discovering a serious security hole that could allow anyone to take control of an account without proper authentication. This led to the system losing its intended state of securely managing user accounts, prompting the need to disable the feature to prevent further unauthorized access [15779].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence property, theoretical_consequence (d) property: People's material goods, money, or data was impacted due to the software failure The software failure incident involving Skype's password reset capability being disabled due to a security hole could have led to potential property loss for users. Hackers could take control of accounts, potentially using any credit to make calls. Additionally, captured accounts may have had their primary emails changed by hackers who gained access, indicating a risk to personal data and account information [15779].
Domain information (a) The failed system in this incident was related to the information industry as it involved the software failure of Skype, a communication platform widely used for messaging and calls [15779].

Sources

Back to List