Tweet
User details such as your name, birthday and address can be accessed in a security loophole on Skype for Android. Photo courtesy of SkypeA recently discovered security flaw in Skype for Android mobile devices could give prying eyes carte blanche to your data.
Using a custom-made app to test Skype Video for security issues, mobile blog Android Police discovered easy access to many sensitive user details in the current version of Skype for Android mobile phone users.
After downloading and analyzing a leaked version of Skype Video which appeared earlier in the week, the Android Police blogger discovered how poorly the leaked app stored user data. He was able to access the data using a custom app to exploit the leaked version’s poorly-guarded data. After testing this on the currently released version of Skype video for Android — which has been in wide release since October of 2010 — he found it contains the same security issues.
In the Skype data directory, the file main.db hold sensitive information such as your full name, date of birth, billing address, email addresses, home and cell phone numbers. Information on all of the people in your address book is accessible through the contacts database, and all stored chat logs are also accessible through the chat database.
The custom app, which the Android Police named “Skypwned,” doesn’t require root access to the phone in order to exploit Skype’s security loophole. “This means that a rogue developer could modify an existing application with code from our Proof of Concept (without much difficulty), distribute that application on the Market, and just watch as all that private user information pours in,” Android Police wrote.
The loophole doesn’t appear to be showing in the Skype Mobile for Verizon version of the app, according to Android Police.
Skype provided Wired.com with a written statement when asked for comment:
It has been brought to our attention that, were you to install a malicious third-party application onto your Android device, then it could access the locally stored Skype for Android files.
These files include cached profile information and instant messages. We take your privacy very seriously and are working quickly to protect you from this vulnerability, including securing the file permissions on the Skype for Android application.
To protect your personal information, we advise users to take care in selecting which applications to download and install onto their device.
This isn’t Skype’s first time to take heat on security issues. In March, advocacy group Privacy International called upon Skype to tighten up some of its security measures in a vehemently-worded blog post. The blog post cited the ease of a Skype user’s ability to imitate other users, as well as a lack of HTTPS-level of protection for its downloads. These files include cached profile information and instant messages. We take your privacy very seriously and are working quickly to protect you from this vulnerability, including securing the file permissions on the Skype for Android application.
To protect your personal information, we advise users to take care in selecting which applications to download and install onto their device.
The blogger who detected the security issue suggests three ways for Skype to fix it: the use of proper file permissions, the institution of some sort of encryption scheme, and a thorough security review of the company’s apps before their release.
See Also:
- Skype Creates Exchange Platform For Teachers
- Skype IPO 'Delayed': Wall Street Journal
- Skype Comes to Android: Free Voice, Text Over 3G (But Not In US)
- Skype Comes to Android — Really, This Time. But You Will Pay
- Verizon + Skype Not Mobile VoIP Nirvana, But Closer
- Android: No VOIP for You — and Other Oddities With the Google
Powered By WizardRSS.com | Full Text Feed | Amazon Affiliate
