back to article Make sure your Skype is up to date because FYI there's a nasty hole in it

Infosec researchers have discovered a nasty and exploitable security vulnerability in older versions of Skype on Windows. The stack buffer overflow flaw allows miscreants to inject malicious code into Windows boxes running older versions of Skype, bug hunters at Vulnerability Laboratory warn: The issue can be exploited …

  1. Humpty McNumpty

    Like we get a choice

    Every time Skype has an incoming update the old version suddenly becomes incredibly unstable, in fact on my system this is usually how I find out my version needs upgrading, before the program itself notifies me officially/just updates.

  2. Hans 1 Silver badge
    Windows

    Every time Skype has an incoming update the old version suddenly becomes incredibly unstable, in fact on my system this is usually how I find out my version needs upgrading, before the program itself notifies me officially/just updates.

    Sounds like an improvement, in my experience it would refuse my login details, after some troubleshooting (even resetting the password did not work) I tried the latest version at the time and all was back to normal again... have not used it in a while, though, MS have, once more, totally F'd up a piece of software that was working perfectly at the time of purchase.

    Never let Redmond anywhere near your business critical stuff ...

  3. ElReg!comments!Pierre Silver badge

    No notice for the Linux versions

    I (almost) can't gather why...

    Nadela did "open up" Microsoft to some extent, but he kinda veered it towards an Oracle-like mentality, it would seem. Gates must be spinning in his... bed. Yes, bed. Bed is what I meant. Yes.

  4. Anonymous Coward
    Anonymous Coward

    Skype Drive bys...

    about 2 -3 years ago we had the only (to date) ransomware attack successfully make it into our network. After digging in our IDS, we confirmed that the attack was delivered through Skype.

    Skype is banned from our network - period.

    1. Tomato Krill

      Re: Skype Drive bys...

      You keep that stable door nailed shut!

    2. RudderLessIT

      Re: Skype Drive bys...

      Isn't that quite literally shooting the messenger?

  5. Anonymous Coward
    Anonymous Coward

    Well, duh.

    Come on, be honest. Has any product ever actually improved when Microsoft got its hands on it? This lies totally in the line of expectations.

    Besides, the consumer version is monitored anyway so we've stopped using it - we don't see the same issues with the business version but our trust in Microsoft vanished quite a long time ago anyway.

    We'll be looking at WebRTC solutions, the hope is that we find a solution that permits independent audit, that we can run ourselves and that is platform independent so we can run it on iOS, MacOS, Linux and, if we have no way to avoid it, Windows (and no, we don't like Java for that). My preference is something that is as Open as possible, maybe XMPP/Jabber centric (no, not Cisco's attempt to appropriate the name for which they should get slapped).

    1. Drakkenson

      Re: Well, duh.

      I suggest qTox for multi-platform. I don't know if it satisfies your other requirements, but maybe you could take a look and let us know?

      1. Anonymous Coward
        Anonymous Coward

        Re: Well, duh.

        I suggest qTox for multi-platform. I don't know if it satisfies your other requirements, but maybe you could take a look and let us know?

        Had a quick look.

        For:

        - multi-platform, with (as far as I can see) code native to each platform

        - peer to peer model seeks to avoid centralised services (not yet worked out how that hops the typical NAT port problem

        - thought through in terms of what it seeks to protect

        Against:

        - contact discovery. Users are asked to copy a very long string to connect to others so not yet ready for your average end user. There is apparently a service that makes it easier, but there will always be a conflict between deniability and ease of interaction.

        - not a commercial entity. If something doesn't work or needs fixing, having a contractual relationship means you have a better argument in getting things fixed. For smaller environments it also offers a route to support - I know free projects can sometimes offer very good ad-hoc support but for use in a commercial setting that's not good enough. The flipside is that that obviously prevents any financial blackmail from subverting the platform

        - too new to have usable UIs (uTox as well as qTox for macos are barely functional, the iOS app is a little bit better).

        Overall, the impression I get is that it would be too immature to use for what we're doing. I must try to get hold of Moxie to see what we could do with Signal.

    2. Adam 52 Silver badge

      Re: Well, duh.

      "Has any product ever actually improved when Microsoft got its hands on it?"

      QDOS

      Sybase

      Panorama

      Forethought

      Visio

      Multimap

      Not much in the last decade I'll grant you.

  6. IglooDude
    Facepalm

    Is this for retail or business Skype, or did I lose track of business Skype becoming Lync, or was it the other way around?

    1. Anonymous Coward
      Anonymous Coward

      ::blah blah mode=on

      After using Skype on and off for many years, pretty much the moment MS got a hold of it, I completely lost interest, (based solely on their history (MS's)).

      So when I started a new contract and was told Skype was setup on my desktop and mobile device, I felt completely stupid for a few moments looking for the Skype link on my desktop. That is until I figured it wasn't really called Skype anymore (or was it?), but is now called Lync - Lync, something I also found hard to get my head around, as it kept nagging me in the back of head as meaning some other piece of software/hardware/something from the 80s, 90s(???)...

  7. John Crisp

    Acts of desperation

    "It's got a flaw. Hurry, hurry, you'll be safer if you upgrade to our newer, shinier, cloud enabled, data slurping, more expensive (for business) PoS. And hopefully we can lock you into all our other cloud crap too."

    Alternatively uninstall and try Rocket.Chat for some fun. Still very AlphaBeta, but works well for us. The data is (probably) all mine.

  8. Tom Melly

    What is it with Skype's interface? Why is it so hard to navigate? Just finding the messaging area is harder than managing IRQs most of the time.

  9. Michael Kean

    I've migrated away from Skype to Facebook Messenger, Google Duo and WhatsApp. Couldn't trust it to remain signed in on Android and missed too many calls. Finally removed it from StartUp today.

  10. This post has been deleted by a moderator

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Biting the hand that feeds IT © 1998–2019