Skype bug may expose users to malicious code
Skype: Does not. Researcher: Does so
Updated The latest version of Skype for Windows contains a security vulnerability that allows attackers to inject potentially dangerous code into a user's phone session, a German security researcher has reported.
The XSS, or cross-site scripting, vulnerability in Skype 188.8.131.52 is the result of the voice-over-IP client failing to inspect user-supplied phone numbers for malicious code, researcher Levent Kayan said. As a result, attackers might be able to exploit the bug to inject commands or scripts that hijack the machine running the program.
A screen shot from Kayan's website showing the injection bug in action
A Skype spokeswoman disputed Kayan's account.
"We have had this reported to us by various media outlets and have confirmed that the person is mistaken, this is not a web window and while it does cause a phone number to be underlined, does nothing other than this," spokeswoman Brianna Reynaud wrote in an email.
In an email to The Register, Kayan stood his ground, insisting that at a minimum, the flaw allows an attacker to create a hyperlink on a victim's client that leads to a site of the attacker's choosing.
"According to Skype's spokeswoman, I wanted to tell you, that this is not really true what she said, because the entries in (home, office and mobile phone and even in "city") are embedded via HTML," he wrote.
Such vulnerabilities open the possibility of creating self-replicating attacks if they can be used to target users contained in each victim's contact list. As each new user is exploited, the worm spreads virally by attacking a whole new set of people. A vulnerability reported in May for Mac versions of Skype was described as wormable, though there are no reports it was ever exploited in the wild. It's unclear if the current vulnerability might also allow for self-replicating attacks.
Microsoft is in the process of acquiring the popular internet-based phone service. ®
This article was updated to add comment from Skype spokeswoman and a response from Kayan.
To get it to work, you need to edit your profile phone numbers and then view the profile from *another* account (Right click on contact -> 'View Profile').
...I did figure that much, but I still don't see how it would be possible if the site/client had disallowed/altered the data.
Might try again at lunch.
shoulda listened to me folks
For years I have been warning the government and public to leave phones well alone. But no, successive companies and governments had to mess with them, making them smaller "compact", cordless ("mobile") and hardware free ("software" based phones such as Skype).
Well you reap what you sow.