A major bug is forcing Microsoft to rebuild Skype for Windows

Skype has fallen foul of a security flaw that can allow attackers to gain system-level privileges to vulnerable computers, Microsoft has confirmed. However, the company won’t immediately fix the issue because doing so would require a complete code overhaul. The bug was discovered by security researcher Stefan Kanthak, who says the Skype update can be nefariously tweaked to trick an application into drawing incorrect code instead of the right library. This would let a hacker download malicious code and put it into a user-accessible temporary folder, renaming it to an existing DLL that could be modified by anyone without system privileges. According to Kanthak, once system access is granted, an attacker “can do anything”. However, the hacker would require physical access to the computer to do this.

Kanthak told Microsoft about the vulnerability — which could let hackers steal files, delete data or run ransomware — back in September, and the company acknowledged a fix would require “a large code revision”. Speaking to ZDNet, Kanthak said that even though Microsoft was able to reproduce the issue, a fix will only arrive “in a newer version of the product rather than a security update”, the implication being that patching the issue would require too much work. Microsoft said it’s put “all resources” into building a new client, but has not revealed when that’s likely to land. We’ve reached out to Microsoft for comment.

Via: ZDNet

Source: Engadget - Read the full article here

Author: Daily Tech Whip

This article is part of our 'News Tiles' service. The site is currently in Beta. When it is fully operational you will be able to search through and arrange the 'Tiles' to display a keyword, product or technology over your chosen time period. For example you would be able to display all of the leading tech articles on the new Kindle Fire, in one spot in real time. You will also have access to our own original reporting and analysis as well as a polished place to post your own thoughts & reviews here, amongst the Daily Tech Whip Community. Please let us know if you have any feedback via the contact form or via Twitter. Don't forget to come back next week and see our full site and claim your name and your own free tech blog.

Share This Post On