Last night I received an e-mail notification that my Skype password had been changed. The Skype client was NOT running and I hadn't used it for about 4 weeks.

I checked and it had actually been changed. Fortunately the pirate had not changed my e-mail address. I was able to change the password and keep control of my account. Thankfully my Skype account is not linked to any Paypal account and I never use it for anything important.

All my passwords have a reasonable level of complexity. Enough so that a dictionary attack is not plausible, unless it is possible to rapidly try millions of passwords without getting locked out. Please tell me this is not possible, as this would be a perfect example of lack of the most basic security.

Barring that, methinks there's something rotten in the Skype authentication server.

I'm a senior IT security consultant and I'm available if you need someone for a security audit. Actually, a certification by an IT security auditor, posted on the Skype web site, would go a long way into restoring my confidence in the software.

I had the same experience (pw changed while not on Skype), only I never received an e-mail at the original e-mail associated with my Skype account that my pw had been changed. I practice extremely "tight" net security (virus/bot/trojan scans daily of all my boxes and I never access Skype at a public location) and have never been compromised in my 15+ years of computing.

I, too, suspect that Skype might have been compromised and I urge everyone to unlink any Paypal account they may have associated with Skype and delete any saved credit card/bank account information. Skype "support" will take days, if not the weeks it took them in my case, to get back to you and they will not refund any unauthorized charges.

I also think that Skype should conduct a security audit and post the results so that its users can be confident that their personal information is still secure.

I just realized my initial post looks like I'm trying to sell my services .
I'm not. Actually I'm not available at all, it was a figure of speech, but I still would like this issue investigated by the Skype team as it seems serious.

This happened to me too. I tried contacting skype , they don't reply

20 days later still can't use skype, did you get yours fixed ?

The Register is reporting on this problem. the article

I think this also happened to me. I'd left the computer running this night to complete a large, slow download. This morning, I found Skype crashed, and an intriguing entry in my console.log :

2008-10-25 04:40:34.431 Skype[552] onMacAccountDidChange: password has changed
Oct 25 04:41:54 portia crashdump[12441]: Skype crashed
Oct 25 04:41:57 portia crashdump[12441]: crash report written to: /Users/ME/Library/Logs/CrashReporter/Skype.crash.log

Indeed, I couldn't log in anymore. Worse, I didn't receive any of the 3 emails with a password reset token (I may have changed my email address at some point — apparently it's too much to presume that Skype would forget about the earlier one(s) ...).

I've been appearing online for a while as seen from someone else's account, and then at some point *my* status turned into the "you're not allowed to see me" question mark on a grey shield.

I was suspecting a technical glitch at Skype's at first, but from what I just read, I'm probably a victim of the same hacker(s). So they earned 10€ and some cents in SkypeOut credit, my contact list (all 12 of them) and my billing address. Too bad for them I've always refused to store payment info.

Too bad for me that a number of those 12 contacts have me "locked" on Skype, because what I read was enough to make me decide to look for alternative gizmos

In the meantime and until further notice: rjvbertin is no longer me, but some creepy person, probably unwashed, with a big crooky nose (wart and all) and bad breath

There are some proceedures to help reclaim your Skype name if needed. If you have made a purchase with Skype, this can make things much easier.

If you need these proceedures. Please post here.

Yes please, I'd be very helpful to post these procedures, and probably not just for me only.
I've seen references to possibilities to recuperate control and/or funds, but no clear description as to how to proceed. Which corresponds all to clearly to the incredible time it took for certain others to regain control of their account and/or the funds they lost.

I have sent you these procedures via PM ("Private Message")

Hello,
Same thing happened to me as well a couple of weeks back.
Password was changed - auto-recharge was enabled and some credit is lost.
Only later the account email was changed - it all happened within a couple of hours. Now my account is used by someone from Algeria....


Have tried to contact Skype support - but never recieved a reply.

Please provide the procedures to reclaim my old skype account

Thanks !!

This post has been edited by shirgold: Wed Oct 29 2008, 13:20

Skype REALLY ought to be stepping forward with all the information necessary to 1) know that logging-in failure might mean account hijack and 2) know how to signal such an event and limit damages.

I received the procedures via PM, followed them up as soon as I could (last Monday afternoon, GMT+1) and haven't had as much as an auto-ack that my email had been received. Despite the statement that "Skype takes this very seriously".

Hence, here's what you have to do, according to the instructions I've received (note that it is not specified whether the address is CSL2, csl2 or any other upper/lowercase combination - CSL2 at skype.net hasn't bounced for me).

Stolen Account Procedures, Sun Oct 26 2008, 13:52
Please reply to the questions below and send the information to CSL2 at SKYPE.NET where it will arrive with the correct person at the Skype Fraud desk.

1. Approximate date of a last purchase made with your SkypeOut account (can be looked up from the credit card statement or from the confirmation email sent to you after the purchase).
2. The order number
3. Payment method or Credit Card type used to make a purchase
4. Email that was entered during registration (if any)

Additionally, in case you have purchased with a credit card, then please provide:

5. The first 4 and last 4 numbers of the credit card used
6. Name on the credit card

Or in case you used PayPal or Moneybookers, then we need this additional information:

5. Your registered PayPal/Moneybookers email address
6. PayPal/Moneybookers Transaction ID
7. Your Skype user Name

That way we can complete our verification and change your registered email address
Skype takes this very seriously.
Thank you,

Hello,
Same thing happened to me as well a couple of weeks back.
Password was changed - auto-recharge was enabled and some credit is lost.
Only later the account email was changed - it all happened within a couple of hours. Now my account is used by someone from Algeria....


Have tried to contact Skype support - but never recieved a reply.

Please provide the procedures to reclaim my old skype account

Thanks !!

I have sent you a PM ("Private Message") with the procedures to follow.

Skype REALLY ought to be stepping forward with all the information necessary to 1) know that logging-in failure might mean account hijack and 2) know how to signal such an event and limit damages.

I received the procedures via PM, followed them up as soon as I could (last Monday afternoon, GMT+1) and haven't had as much as an auto-ack that my email had been received. Despite the statement that "Skype takes this very seriously".

Hence, here's what you have to do, according to the instructions I've received (note that it is not specified whether the address is CSL2, csl2 or any other upper/lowercase combination - CSL2 at skype.net hasn't bounced for me).

Please PM me your Skype name and the date you sent this email.

Hello,

The same thing happend to me 3 days ago. My account has been hijacked. I was away from my computer for an hour and skype and when I came back I had a pop up message saying that my password had been changed and that I should log back in. At that point I could not log back in.

I have tried contacting customer support without a reply. My skype account was set on auto-recharge and as a result lots of transactions have gone through my paypal account already in the space of three days, and more probalby going through. I 've contacted paypal and they are looking into ways to stop the payment goign through.

Can someone please help me shut down my skype account or regain access to my account. (The latter being preferable). Who do I email to get a quick reply as it's costing money the longer skype take to answer back.

If a skype moderator is reading this (the log-ing I used to post into this forum is a new one, as I couldn't use my skype logon anymore.

Many thanks,

Juan

Juan, I think your best option to stop losing money on this is either revoke the mandate you gave to Skype (that's a feature PayPal OUGHT to provide, I hope they do!!!). Or remove the payment methods from your PayPal account for the time being. I know that's a hassle, but it may be worth it as I fear no one is going to feel any particular hurry to help you regain control of your account or get your money back.

Instructions on how to proceed have been posted above (see the post I made last Wednesday at 13:55).

Hello,

The same thing happend to me 3 days ago. My account has been hijacked. I was away from my computer for an hour and skype and when I came back I had a pop up message saying that my password had been changed and that I should log back in. At that point I could not log back in.

I have tried contacting customer support without a reply. My skype account was set on auto-recharge and as a result lots of transactions have gone through my paypal account already in the space of three days, and more probalby going through. I 've contacted paypal and they are looking into ways to stop the payment goign through.

Can someone please help me shut down my skype account or regain access to my account. (The latter being preferable). Who do I email to get a quick reply as it's costing money the longer skype take to answer back.

If a skype moderator is reading this (the log-ing I used to post into this forum is a new one, as I couldn't use my skype logon anymore.

Many thanks,

Juan

I have sent you a PM ("Private Message") with the procedures to follow.

My account got hacked also and a payment was made via paypal.

luckily i was checking my email and saw the payment advice from paypal.

my password and email were changed and I had to create a new account to access here.

I submitted a report already to skype. I hope to get a reply and resolution soon.

I have sent you a PM ("Private Message") with additional instructions.

If this happens & you have used paypal in the past the hijackers can set up auto payment from paypal very easily. Changing your paypal password does not stop the payment, you need to go to your paypal account & cancel the agreement with skype. It's not easy to find on the paypal site, it's under:

My Account

Profile

Pay List (in the middle under Financial Info)

You should see Skype in there as a merchant, you can cancel it from there (or it's reasonably obvious from there...). Submit all your paypal transactions as fraudulent & you might get your money back.

Also cancel your credit card if Skype have that on file. It'll take days for Skype to stop taking the payments & the hijackers managed to spend £50 a day on mine...

Same thing has happened to me 2 days ago - still no response from support.

Any help would be appreciated.