Slashdot Mirror
Skype Can't Fix a Nasty Security Bug Without a Massive Code Rewrite (zdnet.com)
ZDNet reports of a security flaw in Skype's updater process that "can allow an attacker to gain system-level privileges to a vulnerable computer." If the bug is exploited, it "can escalate a local unprivileged user to the full 'system' level rights -- granting them access to every corner of the operating system." What's worse is that Microsoft, which owns Skype, won't fix the flaw because it would require the updater to go through "a large code revision." Instead, Microsoft is putting all its resources on building an altogether new client. From the report: Security researcher Stefan Kanthak found that the Skype update installer could be exploited with a DLL hijacking technique, which allows an attacker to trick an application into drawing malicious code instead of the correct library. An attacker can download a malicious DLL into a user-accessible temporary folder and rename it to an existing DLL that can be modified by an unprivileged user, like UXTheme.dll. The bug works because the malicious DLL is found first when the app searches for the DLL it needs. Once installed, Skype uses its own built-in updater to keep the software up to date. When that updater runs, it uses another executable file to run the update, which is vulnerable to the hijacking. The attack reads on the clunky side, but Kanthak told ZDNet in an email that the attack could be easily weaponized. He explained, providing two command line examples, how a script or malware could remotely transfer a malicious DLL into that temporary folder.
The article indicates that the Updater is the problem, not Skype. The Updater runs in a privileged environment, and is susceptible to loading non-system DLLs. The article says the same can happen on Macs and on Linux except that neither platform uses DLLs nor allows sourcing libraries from local (no-system) directories.
E
Of course Linux is completely immune to such attacks because LD_PRELOAD is open source.
Phew. https://www.cs.rutgers.edu/~pxk/419/notes/content/04-injection-slides-6.pdf
it's a IM client with audio/video capabilities, wth
Looking for people to chat about multicopters, coding, music. skype: gtsiros
That way you can be kinda sorta sure the entire thing came from Microsoft, maybe...
“He’s not deformed, he’s just drunk!”
If you can't fix the issue then let us have the option to remove the POS. Ever since they jammed the crappy product down my throat wished I could remove it, now would be a good time.
errr....umm...*whooosh* *whoosh* Is this thing on ?
Trump himself said he did it. He said "no collusion", which in Trump-speak means "I colluded".
We are slowly realises that whatever Trump says, he means the opposite. "Largest ever inauguration crowd" means it wasn't. "Building a wall" means he won't.
The Trump fans took Trump seriously, but not literally. The general pubic took Trump retardedly, but not unretardedly.
Skype turned into a huge turd when Microsoft touched it.
It took 6 attempts to get a call through without having either side sound like either donald duck, or mickey mouse. Then of course, you need to make sure your 100/100 internet connection is fast enough, or you get the dreaded "poor quality connection"...
I fixed skype by uninstalling it and using google hangouts.
You seem to misunderstand. The entire thing from Microsoft is the part with the flaw. The way this works is something else would get you infected with malware, which would then leverage Skype's update process to gain administrative access to your system silently.
Could they just static link the libraries to avoid the use of DLLs until the replacement is ready?
Just look at the stats. Failing Linux has had hundreds of CVE's in just the last year with a lot more and worse severities than all the current versions of amazing Windows *combined*. If you want to trust your computer to be secure, you are better off with Windows than littul linux. It's a simple fact, easily proven, but completely politically incorrect to say here which is everyone knows it is true.
20.......16, doh.
We don't have any evidence of it, but the media wouldn't be talking about it so much and for so long if it wasn't true.
This exact same "attack" has been the root cause of dozens of Windows vulnerabilities reported on Slashdot over the past decade.
EVERYONE should already know about this flaw, so Microsoft has no right to act like it didn't know about the flaw when they purchased Skype.
If any program allows downloads to its %PATH%, then it's 100% vulnerable to this exploit.
p.s. This is also the reason you should never launch an installer from the download directory for your web browser. (Yes, that was also a story on /., but I'm too lazy to look it up.)
app store censorship needs to go.
The old standalone client was bad. Rather than fixing it, they tried to push everyone into WebRTC.
The UI of Skype even on Mac is now awful. Microsoft took a piece of crap and piled on a layer of fresher crap.
The time has come for Skype to get tossed in the trash.
Comment removed based on user account deletion
Last time I checked a complete rewrite is not necessary at all. Sometimes a one liner, e.g. SetDllDirectory(""), is more than enough.
What's worse is that Microsoft, which owns Skype, won't fix the flaw because it would require the updater to go through "a large code revision." Instead, Microsoft is putting all its resources on building an altogether new client.
Man I gotta hand it to whomever at Microsoft actually convinced their boss to go this route. There was a MSN messenger once, you know, Microsoft's IM client, they dumped it and bought Skype. Now they're dumping Skype for inhouse MSN messenger 2.0? Hahahahaha nice job.
Adobe, Java, Skype runs 24/7 update processes that I keep just killing and they keep coming back. I do all my normal work on a normal user account, which means these programs fail trying to auto install updates because on my Windows 7 Pro box they do not have permissions.
;) Not
;)
These programs are a plague that expects their users to run their computers (as admin) on a day to day basis. They encourage poor security habits.
When I get irked about the constant pop ups and threats I will log out of my user account and in to my admin account and install the most needed ones.
And no I do not need resident programs running 24 7 to monitor my ink cartridge status and offer easy on line ordering.
Oh another category, all the worthless loaded process trying to add to your customer experience (Yea I am taking about you NVidia and others).
Note from me, just install the needed drivers and applications, and have an unchecked box saying yes I want to install all your worthless add on crap
Just my 2 cents
...they can damned well reinstate the API used by the Netgear Skype DECT phone I paid a shitload for. The one that says "Skype certified" on it. >:(
Discord
What Else ? Whatsapp, Line, WeChat, Zoom, Hermit, other?
What Else ? Whatsapp, Line, WeChat, Zoom, Hangouts, Hermit, other?
Modern Skype is mostly Web Skype.
Modern "Skype for Linux" version 8.x is just Web Skype, packaged together with Chromium, thanks to Electron framework.
(Unlike older versions 4.y which were a Qt port of an older Windows native application).
The most recent version has moved away from binary plugins for the Audio/Video and/or from Microsoft's own NIH syndrom.
And transitioned to WebRTC + HTML5 Video.
But you don't even actually need to install this piece of crap.
- You can browse to http://webskype.com/ with Chromium and mostly get the same result. (But without installed binary plugin, only relying on Chromium's WebRTC)
- You can also browse it with Firefox (last time I checked, Audio/Video wasn't supported, saddly)
- You can even install the SkypeWeb Purple plugin and use it from within Pidgin/Adium
You can basically use Skype without executing a single binary opcode written by Microsoft
(well directly, anway. Depending on your Javascript enginge, it's going to JIT the Javascript on Skype's website if you use Chromium/Firefox. Pidgin isn't affected).
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
Skype was unique when it was new. A simple to use, easy tool for voice and text chat. And one that can even do phone calls if you so please. People jumped onto it because, well, it was the only one.
Fast forward to today when this monopoly situation ain't so true anymore. Considering how Skype refuses to play nice with any of the other kids in the communication and messenger pool, insisting on being a special little snowflake that nobody may touch with their grubby paws, Skype is pretty much the tool you use when you need to get in touch with those that don't move away from Skype because, well, they don't like to change and they don't want to use a new tool.
If they now have to, they, too will move away from the one-trick pony with some prodding from their friends now that they have to install something new anyway, so why not something that more people use?
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
How do you know we don't have any evidence of it. Do you have access to Mueller's files? We certainly have already seen numerous guilty pleas from members of his "inner circle" followed by orwellian "that man was never part of my inner circle" newspeek from the tiny fingered Don.
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
Hosts fix -everything- though!
Comment removed based on user account deletion
Should be noted that the bug requires that the attacker can write a DLL to your file system. So the user already needs to be downloading random DLLs, be a multi-user system or some other software needs to be exploited to write a DLL.
For a typical home PC this bug doesn't seem like a particularly problematic issue.
My hatred of Skype is second only to that of One Drive. Though I've somehow maintained a $10 account balance on Skype by logging in once every couple of years.