Analysts: Skype Could Pose Security Problems

The growing popularity of Skype Technologies SA’s free Internettelephony software could soon pose the same kind of security challengesfor companies that other peer-to-peer (P2P) software technologies havecreated in recent years, according to security experts.

The warning comes after the disclosure this week of two critical flawsin Skype’s software, one of which could allow malicious hackers to takecomplete control of compromised systems.

One of the flaws is a buffer overflow error in Skype’s user client forWindows that could allow attackers to execute arbitrary code oncompromised systems, according to a statement from the company. Theother vulnerability is a heap overflow flaw in a networking routineaffecting Skype clients for all platforms. That flaw could crash theclient software.

Fixes for both problems have been released.

Skype, which was recently acquired by eBay Inc. for US$2.6 billion,offers downloadable software that allows PC users to make free Internettelephone calls to each other and low-cost calls to telephone users.

So far, Skype has garnered more than 61 million registered users,approximately 30 percent of whom use it for business purposes,according to the company. Almost all of that adoption has been inEurope and Asia, though analysts expect Skype to eventually gain wideaccepted in the U.S. as well.

According to Stamford, Conn.-based analyst firm Gartner Inc., eBay’spurchase of Skype could result in a product more suited for corporateuse.

In the meantime, business users should refrain from using “voiceservices based on proprietary protocols like Skype while on corporatenetworks because of network security issues,” Gartner said in a Sept.15 advisory.

There are several reasons for the concern, industry experts said.

“Skype is VoIP on steroids,” capable of punching holes through many ofthe network defenses that companies typically deploy, said Tom Newton,product manager at SmoothWall Ltd., a Leeds, England-based vendor offirewalls and other security products.

Like other P2P technologies Skype allows users to establish directconnections with each other. It’s also “port agile,” meaning that if afirewall port is blocked Skype will look around for other open portsthat it can use to establish a connection, Newton said. “If you putSkype behind a firewall or Network Address Translation layer, 99 timesout of 100 it will work” without any special configuration, he said.

As a result, Skype could provide a backdoor entry into otherwise securenetworks for Trojans, worms and viruses, Newton said. It could alsoprovide a channel for corporate data to be freely shared between userswithout any of the usual security considerations.

Also, like other P2P applications such as KaaZaa, the connectionsharing permitted by Skype makes the the host computer and the networkavailable to others as well, said Robin Bloor, an analyst at Hurwitz& Associates in Waltham. Mass.

As a result, “Skype can use a lot of network bandwidth, which mayinterfere with business applications and services,” said AndreaWuchner-Bruhl, head of global IT security at Novartis Pharma AG, inBasel, Switzerland.

The fact that Skype uses a proprietary protocol instead of a standardone such as the Session Initiation Protocol (SIP) also makes it an”unknown from the point of view of the vulnerabilities that might bethere,” said John Pescatore, a Gartner analyst.

“Every nonstandard application can add unnecessary risks to yourenvironment,” Wuchner-Bruhl said. “In the end no one really knows whatall is built into such an application.”

So far at least, there have been no major attacks directed againstSkype. But its growing popularity and installed base will inevitablymake it a hacker target, analysts said.

Companies will need to keep a close eye on both the sanctioned and theunsanctioned use of Skype on their networks, Pescatore said.

IT administrators may also need to impose measures such as denyinglocal administration rights on the desktop, content control andmanagement at the network gateways. They may also need to lay out clearpolicies and procedures for users, Wuchner-Bruhl said.

In the end, the use of Skype needs to be resolved in the same waycompanies have gone about addressing other P2P applications, includinginstant messaging, Bloor said. “But you are probably going to havesomething bad happen to someone first,” he said.

By Jaikumar Vijayan – Computerworld (US online)