A programming error in eBay's Skype communications software could give cybercriminals a new way to sneak their malicious software onto a victim's PC. The flaw, which was reported Thursday by security researcher Aviv Raff, has to do with the way that Skype makes use of a Windows Internet Explorer component to render HTML. Because Skype does not apply strict security controls to the software, an attacker could run scripting code on the victim's system in a dangerous fashion and ultimately install malicious software.
The problem is that Skype runs the IE component with the less locked-down "Local Zone" security setting. Because of this attackers are able to do "all sorts of things... [such as] reading/writing files from the local disc and launching executables," wrote security researcher Petko Petkov, in a Thursday blog post about the issue. For an attack to work, the bad guys would first need to find a trustworthy Web site that contained a common programming flaw called a cross-zone scripting error. This bug would give them a way to trick Skype into running their malicious script as if it came from a trusted Web site.
View: 
3 Comments - Add comment