Skype can't fix a nasty security bug without a massive code rewrite

[CMYKninja]

Skype can't fix a nasty security bug without a massive code rewrite

The bug grants a low-level user access to every corner of the operating system.

By Zack Whittaker for Zero Day | February 12, 2018 -- 21:28 GMT (13:28 PST) | Topic: Security

 

source: http://www.zdnet.com/article/skype-cannot-fix-security-bug-without-a-massive-code-rewrite/

 

Quote

A security flaw in Skype's updater process can allow an attacker to gain system-level privileges to a vulnerable computer.

The bug, if exploited, can escalate a local unprivileged user to the full "system" level rights -- granting them access to every corner of the operating system.

But Microsoft, which owns the voice- and video-calling service, said it won't immediately fix the flaw, because the bug would require too much work.

...

Once installed, Skype uses its own built-in updater to keep the software up to date. When that updater runs, it uses another executable file to run the update, which is vulnerable to the hijacking.

 

I feel that there are so many ways into systems now, that you have to assume that you are on an insecure system, unless you know it's secure.
For personal it's one thing, but as someone who has sensitive embargoed designs comes across his desk, I get a little worried about the business disruptions, and industrial espionage opportunities.

Even more alarming is this it's too hard to fix, and we're all doomed to getting hacked anyway mentality this seems to be evlolving...

Even Linus says he uses Skype... 

 

[ItsMitch]

Why are people still using Skype? It's fucking ancient 

[NTDaws]

Who uses Skype again? I last used that in 2012 lmao. Discord has way better voice and video quality. And the way in general they have it setup is great.

[Murasaki]

No problem it wont affect anyone.

[WiViW]

What's even more supprising is that windows 10 likes to push it's products to the machines. Bit worrying if I open Skype for that risk.

[AnonymousGuy]

7 minutes ago, Being Delirious said:

Who uses Skype again? I last used that in 2012 lmao. Discord has way better voice and video quality. And the way in general they have it setup is great.

I still use Skype because I'm not going to bother switching to whatever chat client is the flavor of the month.  If it's not on iMessage, WhatsApp, or Skype then I don't need it.

[Bananasplit_00]

so is this just for the normal craptastic skype or also for skype for buisness?

[AnonymousGuy]

Just now, Bananasplit_00 said:

so is this just for the normal craptastic skype or also for skype for buisness?

Skype for Business doesn't get general updates, they're pushing from IT.

[NTDaws]

Just now, Bananasplit_00 said:

so is this just for the normal craptastic skype or also for skype for buisness?

probably just skype more then likely. Skype for business was mainly used for Office 365 if you had a domain. 

[JuztBe]

Then rewrite whole thing. It's piece of crap as its stand currently. And God forbids the tragedy which is W10 store version.

[IronSoldier]

I use Skype and much prefer it to discord ect. 

[CMYKninja]

20 minutes ago, SC2Mitch said:

Why are people still using Skype? It's fucking ancient 

LMG does didn't they say it in the last WAN Show? 
But let's be honest, small not tech savvy companies are the most at risk because they don't probably can't afford IT teams that control the masses with draconian IT policies...

[CMYKninja]

3 minutes ago, JuztBe said:

Then rewrite whole thing. It's piece of crap as its stand currently. And God forbids the tragedy which is W10 store version.

I agree! if Microsoft is honestly committed to good code and more importantly a culture of quality / security, that's exactly what should be done if need be. They tell the world we're going to spend the $$ to do what's right, that's the value proposition...

[samcool55]

Honestly this might be a good time to bring something like MSN back, i still miss it and there has never been a worthy alternative. There have been decent alternatives don't get me wrong but none of them imo have managed to reach the same level.

[maartendc]

33 minutes ago, Being Delirious said:

Who uses Skype again? I last used that in 2012 lmao. Discord has way better voice and video quality. And the way in general they have it setup is great.

I use it to Skype to my parents overseas weekly.

 

Just because we are used to using it, and I would have to explain to them how to install and use something else otherwise. Also, Skype has a neat feature where you can call landlines and cellphones internationally for pretty cheap. It just all works pretty well, and switching is harder than just keep using Skype, because it is what everyone has.

 

I do wish Skype video/call quality was better. Seems like there have been no real improvements to the whole experience since 2012 or so.

 

Discord might have better quality, but I hate the Discord interface, it is needlessly confusing how to set up.

 

On topic: This "Too much work to fix" is unacceptable! If it is broken, they have to fix it, especially serious security holes.

[Guest]

31 minutes ago, WiViW said:

What's even more supprising is that windows 10 likes to push it's products to the machines. Bit worrying if I open Skype for that risk.

To be fair, they are pushing the UWP version to windows 10 users and not the desktop version.

[BlueChinchillaEatingDorito]

Another reason to just bring back Live Messenger. 

[GoodBytes]

Ok, let me explain better than the crappy news article.

1. It affects Skype DESKTOP app (so Windows 7, 8 users). UWP (Win10 built-in Skype app), Android, and iOS are not affected
2. The system needs to be infected by a malware to inject code in the DLL files of Skype to make it download the wrong file off the web
3. the way it affects you (if you are infected) is that it relies on you giving Skype updater admin privileges to allow the update setup to run, which instead of being a Skype update it is some other .exe it was fooled in getting due to the hack.
4. Technically, this hack actually can affects nearly ALL auto updater systems of programs. You can do it with Firefox, Chrome, Java, Flash, and just about anything else. Technically, you can even infect Steam by rerouting traffic from Steam server for games update to another one, and the moment you run the game, it runs the malware/ransomware.
5. "Massive code rewrite" is laugthable statement. All that needs to be recoded or patched is the automated updated system to scan for injected code in itself, and find ways that to make sure the data downloaded wasn't from rerouted and is indeed correct (many challenges to solve).

The attack is unlikely to happen, as it would require mass servers and internet bandwidth for the attacker to have in place to support the hundred of thousands if not millions who will be infected, as they'll all have Skype connect to its server that he setup to get the infection possibly at the same time as well. MS has the mass numbers of servers and infrastructure including being a kind of Tier 1 ISP by having direct lines connect to other Tier 1 and Tier 2 actual providers (much like Google, and even Facebook but to a lesser extent). That hacker has no chance to do a real impact... Also, if the malware maker make a solution that it managed to infect people, why not just have it do what it wants to do.. why go through the complication of making Skype download something else, to run as admin, and infect again the system. Just make a ransomware... much easier, if you ask me.. not even need to go past UAC prompt, and that is why they are popular these days.

 

It is clearly a much lower priority issue in Microsoft eyes, as their focus is on Windows 10, Android and iOS, and not the legacy desktop app, and that the risk of infection is clearly viewed to be nothing critical.

 

And this things sounds like an over-hype for attention by the discoverer... I mean with statement like:

Quote

"System is 'administrator' on steroids,"

Sooooo a normal Administrator... true administrator is the highest level you can be on a Windows system. That is like saying "the malware will be a root on steroid!!!"  on a Linux based system. It's root, there is no higher!. You have full access to all!

 

So what is "on steroids"... clearly playing with the lack of technical knowledge of the journalists (basically click-baiting them, making you click-bait.. cleaver, I must say!) to get his name out-there, I guess. Probably him or his company seeks a job?

[Cheezdoodlez]

Who uses Skype these days? Well. Tech companies and reviewers do. I've had contact with reps from various hardware tech companies and resellers over the years. Afaik LMG also uses Skype for stuff. Linus has complained about the separation issues with Skype and Skype for business on wan show atleast two times.

 

But is it a platform for personal use anymore? Not so much. 

[GoodBytes]

14 minutes ago, Cheezdoodlez said:

Who uses Skype these days? Well. Tech companies and reviewers do. I've had contact with reps from various hardware tech companies and resellers over the years. Afaik LMG also uses Skype for stuff. Linus has complained about the separation issues with Skype and Skype for business on wan show atleast two times.

 

But is it a platform for personal use anymore? Not so much. 

Skype is still widely used. It is currently still the best platform for audio and video chat between countries, for most countries, where you have great audio and video quality if both sides have good/decent internet connection and of course webcam/mic.

 

All other platform are designed for small short audio/video messages being transferred, or is more focused on pictures sharing or text sharing over audio/video.

 

Skype of Business is a completely different platform. It is Lync renamed to "Skype". The only similarity that Skype for Business has with Skype, is the name. In any case, Skype for Business is being axed by MS, and switch over to Microsoft Teams which is far more useful for businesses these days, far better, more powerful. It is a totally a different chatting software. It is like Slack, if you know it, with a focus on medium and large business and enterprises, while Slack is more focused on smaller companies. The pricing model of both reflect that as well. MS has the knowledge and expertise to make a good solution for the target audience (medium-large companies and enterprises).

[vanished]

22 minutes ago, Cheezdoodlez said:

[...]Afaik LMG also uses Skype for stuff. [...]

1 hour ago, CMYKninja said:

LMG does didn't they say it in the last WAN Show?

 

Yeah they use it but Linus has been quite clear about how he uses it only because others do, and he'd much rather use something else.  I think it's still around for the same reasons as VGA, Windows XP, and other things like that.  People are used to it, it's everywhere, etc.

 

I mean they even did a comparison of some chat programs and concluded (to paraphrase) that Skype should not be used for any reason

It's basically the Internet Explorer of chat programs

[Guest]

2 hours ago, SC2Mitch said:

Why are people still using Skype? It's fucking ancient 

Add me on MSN Messenger

[ItsMitch]

Just now, RorzNZ said:

Add me on MSN Messenger

Add me on Bebo

[Cheezdoodlez]

15 minutes ago, Ryan_Vickers said:

 

Yeah they use it but Linus has been quite clear about how he uses it only because others do, and he'd much rather use something else.  I think it's still around for the same reasons as VGA, Windows XP, and other things like that.  People are used to it, it's everywhere, etc.

 

I mean they even did a comparison of some chat programs and concluded (to paraphrase) that Skype should not be used for any reason

It's basically the Internet Explorer of chat programs

Yeah. Pretty much. I personally don't think the "people are used to it" aspect is the reason for most to stick to it. But the "everyone uses it" is the probably the only reason Skype still is relevant. It's too convenient and too easy to connect with people so everyone still uses it. Atleast when communicating outside their own company.  It's pretty easy to compare it Facebook, you can survive without it but it's ALOT less convenient. 

 

But everyone thinks it's a steaming pile of shit. Especially since the redesign I and alot of people around me have experienced major stability and reliability issues. 

20 minutes ago, GoodBytes said:

Skype is still widely used. It is currently still the best platform for audio and video chat between countries, for most countries, where you have great audio and video quality if both sides have good/decent internet connection and of course webcam/mic.

 

All other platform are designed for small short audio/video messages being transferred, or is more focused on pictures sharing or text sharing over audio/video.

 

Skype of Business is a completely different platform. It is Lync renamed to "Skype". The only similarity that Skype for Business has with Skype, is the name. In any case, Skype for Business is being axed by MS, and switch over to Microsoft Teams which is far more useful for businesses these days, far better, more powerful. It is a totally a different chatting software. It is like Slack, if you know it, with a focus on medium and large business and enterprises, while Slack is more focused on smaller companies. The pricing model of both reflect that as well. MS has the knowledge and expertise to make a good solution for the target audience (medium-large companies and enterprises).

Yeah I'm fully aware on this and agree. Skype for Business should've had another name to avoid the confusion or some cross-platform integration, not that it matters now when it's beeing axed. Not that I'm that to keen on another Slack-like experience. All though I suspect MS Teams will be a far better platform then Slack. A company I used to work for had Slack has their communications platform and I found it to be very lacking. 

[Ryujin2003]

2 hours ago, CMYKninja said:

For personal it's one thing, but as someone who has sensitive embargoed designs comes across his desk, I get a little worried about the business disruptions, and industrial espionage opportunities.

Skype is ending it's Enterprise version anyways, and I feel like the rest of Skype is going to be released by their Skype business replacement. So not fixing it is probably worth it if it's already reached end of life... But I don't use Skype, so not that big a deal for me. And the company I work for is transitioning to something else. Maybe team speak or something? Not too sure yet.