Last week my Skype account was hacked during my weekend holidays in Budapest. I don't know how this has happened - I only know that I was logged into Skype from iPhone, and I used a lot of free public WiFi, which are abundant in Budapest. The last day of my journey I tried to call out from Skype, and the call was finished too quickly, which should not have happened, since I remembered there was a ~30 bucks deposit on my account. I checked my account, and I've found a lot of calls to Belarus, which I didn't make of course:
There were more (tens) of entries like this.
The next thing I did was logging out from Skype iPhone app, and changing my password. Then I contacted Skype support, and I've got a Web chat with support engineer. I must say, their support reacted immediately to my request, which looked really professional from their side. I chatted about half an hour from my mobile phone's browser, but finally I've got a refund for all the calls I never did.
The incident is over now (actually, it was over the hour after I realized that my account was hijacked), but it raises the question: "How is that possible that my account was hacked? Is there some insecure part in Skype connection from the iPhone app, like sending credentials over non encrypted channel?". Unfortunately, I've got no answer from the support engineer, except for some funny comments/advises (Postfactum, I've read Skype security evaluation, but I haven't find anything that explains this incident either). Below are selected parts from the chat transcript:
Donald M: Michael, we understand that you would like to have your Skype account secured while using the application.
Donald M: We’d be more than happy to assist you and provide you the best practice to keep you secured.
Donald M: To help you stay secure, we would like to share with you some useful tips and information about online security:
You: Ok, what can I do to keep the account secure?
Donald M: Please visit this link: http://www.skype.com/en/
I've read everything on that page, but I didn't find anything useful except for choosing strong enough password (which was strong enough).
Donald M: We strongly advise that every customer installs sufficient security software, such as an antivirus and a firewall on all their devices that use Skype and to keep them enabled and up to date.
You: Antivirus on iPhone?
Donald M: Skype does its best to keep your communication and personal information secure.
Donald M: Yes!
Donald M: However, please be aware that Skype users should also take precautions against security threats by not sharing their private data and should install adequate security software on all their devices that use Skype.
You: There's no antivirus software on for iPhone mobile phone
Previously, I explained to the support engineer that I use Skype solely from my mobile phone.
Donald M: Yes and be careful when using or accessing Wifi connection.
This last sentence simply killed me. What can I do when using public WiFi? Maybe wrap my iPhone into a condom?
There were more (tens) of entries like this.
The next thing I did was logging out from Skype iPhone app, and changing my password. Then I contacted Skype support, and I've got a Web chat with support engineer. I must say, their support reacted immediately to my request, which looked really professional from their side. I chatted about half an hour from my mobile phone's browser, but finally I've got a refund for all the calls I never did.
The incident is over now (actually, it was over the hour after I realized that my account was hijacked), but it raises the question: "How is that possible that my account was hacked? Is there some insecure part in Skype connection from the iPhone app, like sending credentials over non encrypted channel?". Unfortunately, I've got no answer from the support engineer, except for some funny comments/advises (Postfactum, I've read Skype security evaluation, but I haven't find anything that explains this incident either). Below are selected parts from the chat transcript:
Donald M: Michael, we understand that you would like to have your Skype account secured while using the application.
Donald M: We’d be more than happy to assist you and provide you the best practice to keep you secured.
Donald M: To help you stay secure, we would like to share with you some useful tips and information about online security:
You: Ok, what can I do to keep the account secure?
Donald M: Please visit this link: http://www.skype.com/en/
I've read everything on that page, but I didn't find anything useful except for choosing strong enough password (which was strong enough).
Donald M: We strongly advise that every customer installs sufficient security software, such as an antivirus and a firewall on all their devices that use Skype and to keep them enabled and up to date.
You: Antivirus on iPhone?
Donald M: Skype does its best to keep your communication and personal information secure.
Donald M: Yes!
Donald M: However, please be aware that Skype users should also take precautions against security threats by not sharing their private data and should install adequate security software on all their devices that use Skype.
You: There's no antivirus software on for iPhone mobile phone
Previously, I explained to the support engineer that I use Skype solely from my mobile phone.
Donald M: Yes and be careful when using or accessing Wifi connection.
This last sentence simply killed me. What can I do when using public WiFi? Maybe wrap my iPhone into a condom?
6 comments:
> This last sentence simply killed me. What can I do when using public WiFi? Maybe wrap my iPhone into a condom?
Use VPN to a trusted host.
these numbers are located in Vitebsk. You may contact the Belarusian police
Why you dont you use vpn while connected to public wifi. For example https://hide.me has a free plan
well, the issus is that the voice quality usually goes down via VPN ;)
Interesting, on the day you wrote this article, the exact same thing happened to me, except I haven't been using my personal account for a while and therefore my password couldn't have been spied on. Also the calls all went to the UK. After all this, I even suspect, they have another problem than unencrypted WiFis!
No, I didn't :)
Post a Comment