Skype Security Problems Multiply
Aviv Raff showed me proof-of-concept code that fired a code execution exploit whenever I visited a booby-trapped Web page. The exploit worked even if Skype was not running--visiting the Web page automatically opened Skype, attempted to load a video, and then launched the executable code. After Raff's second discovery--which is a combination of a cross-site scripting bug in Metacafe and a cross-zone scripting vulnerability in Skype--the eBay-owned company completely removed the Add a Video feature until a patch is ready. |
The Skype security problem I wrote about 
Comments (3)
This additional warning is appreciated. However to clarify this situation you may want to state specifically when the vulnerabilty is active. Is it (1) with Skype showing in the taskbar "Offline" and in other taskbar modes, or (2) is there's some unusual feature in Skype that allows it to be started and "run" remotely even after someone "Quits" Skype and it's not showing in the taskbar. Thanks!
Posted by jonmca | January 28, 2008 2:05 PM
That's one ef the many troubles with using a closed, proprietary system like Skype: you are forced to put up with the software they provide, you can't switch to anything else.
Whereas if you were using open, standards-based VOIP, if one client had a security hole in it that the vendor was being tardy about fixing, you could switch to another client.
Posted by Lawrence D'Oliveiro | January 29, 2008 4:32 AM
One such free and open source/open standards based service is "Wengophone"
http://wengo.org
Not only is it "open" but the computer to telephone rates are cheaper than Skype.
Posted by canuckistani | January 31, 2008 2:00 AM