Skype/Facebook integration spawns hijack risk
Don't talk to strangers...
A bug involving the method Skype uses to integrate with Facebook creates a possible account-hijack risk, security watchers warn.
The latest update to Skype – version 5.5 – released last week, contains closer integration with the social network, allowing surfers to track Facebook status updates and post wall messages from the Skype client.
The same trick would work if a potential victim is tricked into visiting a maliciously constructed fan site on the social network, heise Security reports, adding that the bug also affects earlier versions of Skype's software, dating back to version 5.3, when less-sophisticated Facebook integration was first introduced.
In a statement, Skype said the Facebook integration flaw is another aspect to the earlier cross-site scripting flaw it fixed with a server-side update last week. A Skype spokesman said: "The newly reported Cross Site Scripting (XSS) vulnerability that allows your Facebook stream to pop up messages or redirect you to other websites is actually an issue that was fixed recently by an update deployed to users. All affected users should already be protected. Skype users do not need to install any updates for this fix to take effect."
The latest bug follows less than a fortnight after the discovery of a broadly similar cross-site scripting bug – which the Microsoft-owned VoIP outfit fixed with a server-side update last week. ®