Last month, security researcher and founder of the vulnerability lab Benjamin Kunz Mejri discovered a new Microsoft Skype vulnerability. The problem has a local and a remote attack vector that can be exploited. Surprisingly, the way the attack takes place is via the client infrastructure to an export function for an older version of Skype.

Skype has a new export function for the skype v7.x contents and messages. Users are able to export the old logs to generate a html file inside the browser with the exported content of the main.db file in combination with the journal file. The content is rendered and generated in the local installed standard browser without much usage of physical capacity.

Undocumented Telnetd & Code Execution

A few weeks ago, in the context of a security, we had carried out individual investigations following an anomaly in a private network. Web radio terminals device of the company Telestar Digital GmbH were identified, which have an undocumented telnetd server. Since this seemed strange to us, we took a closer look at the services and other functions and found something amazing.