Skype bug gives attackers root access to Mac OS X

http://www.theregister.co.uk/2011/05/06/skype_for_mac_critical_vulnerability/

by jlangenauer • 15 years ago

123 65 15 years ago

theregister.co.uk

bigmac• 15 years ago

“About a month ago I was chatting on skype to a colleague about a payload for one of our clients,” he wrote. “Completely by accident, my payload executed in my colleagues skype client.

That means this thing is either BS or it is an egregious bug by the Skype team. Remote code execution doesn't happen by chance.

lawnchair_larry2• 15 years ago

Not if skype renders javascript somehow. Amazon had a similar vulnerability in the "preview this book" feature a few months ago. If you used it to preview certain books that had example XSS payloads, you would get owned.

nbpoole5• 15 years ago

What does XSS have to do with remote code execution? I mean, it's possible for a Javascript parser to have vulnerabilities that can lead to arbitrary code execution, but the Amazon example seems in no way relevant here.

funkshanker• 15 years ago

After seeing the abortion which is the latest interface redesign, I chalk it up to either incompetence or sadism.

nbpoole5• 15 years ago

It doesn't happen by chance (usually), but it's not an infrequent occurrence either.

Take an example from earlier today: there's a vulnerability in Exim that can allow arbitrary remote code execution (http://www.vupen.com/english/advisories/2011/1185). For anyone who doesn't know what Exim is, I refer you to Wikipedia (http://en.wikipedia.org/w/index.php?title=Exim&oldid=421...):

"Exim is a mail transfer agent (MTA) used on Unix-like operating systems. Exim is free software distributed under the terms of the GNU General Public License, and it aims to be a general and flexible mailer with extensive facilities for checking incoming e-mail.

...

A large number of Exim installations exist, especially within Internet service providers[1] and universities in the UK. Exim is also widely used with the GNU Mailman mailing list manager, and cPanel."

zitterbewegung• 15 years ago

Wasn't there that bug in android where if you would type in anything it would execute it as a shell command as root?

nuclear_eclipse• 15 years ago

The original builds of Android for the G1 had a root terminal running in the background that used keyboard input even though it was invisible and not focused. This allowed you, eg, run telnetd and then connect from your PC to run commands as root, which included the ability to re-flash the bootloader and jailbreak the OS.

51Cards• 15 years ago

This is how you do a security alert. Notify the manufacturer of the software, notify the press so it is made public and thus people will install updates, and keep the details secret until it's fixed. Kudos to the discoverer.

r00fus• 15 years ago

You know, it's a bit of FUD since I have no workaround/prevention angle.

Great. I run skype on one of my machines (OSX) and it's now vulnerable...

cheald• 15 years ago

Our solution is "Use Google Talk until it's resolved".

nbpoole5• 15 years ago

Unfortunately, it's not so simple. Alerting the public before a fix is out is a double-edged sword: it also means malicious attackers have a chance to replicate the finding and abuse it.

lancewiggs• 15 years ago

Then perhaps the flow should be amended: Alert the public after the fix, or after a week, whichever is the earlier.

nolanw• 15 years ago

Any word on whether this affects version 2 of Skype for Mac OS X (the old one), the current Skype 5.1, or both? Neither the article nor the linked blog post would say.

If the former, I don't imagine they'll update it, and this might finally force me to grab 5.1.

morganpyne2• 15 years ago

I'm been studiously avoiding the update since inadvertently installing it a while ago and backtracking furiously shortly afterwards. I hope we get some details on the versions affected and if the problem is present in v2 that we also get a patch for that. If Skype uses this as an excuse to force the v5 upgrade they will have a lot of very unhappy people on their hands.

janulrich• 15 years ago

I wonder which versions of Skype are affected? This might cause those trying to hang on to the previous version with multiple windows to have to update.

cheez• 15 years ago

So I have to upgrade to the shitty skype now? I've been actively avoiding v5...

lloeki3• 15 years ago

From what I've read v5 is affected but not the older, good one. Needs confirmation though.

cobbal• 15 years ago

The headline says root access, but I didn't see any references to it in the article or its link. Does anyone know if it really is root access?

tshtf• 15 years ago

On my Mac Skype runs under the uid of my normal account, so I'm not sure how this could be used to get root access unless there's a separate privilege escalation exploit involved.

machrider• 15 years ago

Frankly, getting a shell as my regular user on my machine can be just about as devastating as getting root. Everything that's important to me is owned by my user.

technomancy• 15 years ago

If it doesn't have root access you can run it in a dummy user account until it's patched.

Doesn't stop your machine from becoming a vector to attack other users on your contact list though.

mustpax• 15 years ago

Does any part of Skype run as root? It really shouldn't but I wouldn't put it past that piece of turd.

bradleyland4• 15 years ago

If it executed as root, you'd receive the password prompt every time you launched.

bradleyland4• 15 years ago

The actual release from Pure Hacking is here:

http://www.purehacking.com/blogs/gordon-maddern/skype-0day-v...

No mention of root; only remote shell. I have a feeling this is just bad reporting on the part of The Register.

Having said that, I wouldn't give a random person off the street access to my local user account, even if they can't execute as root. Plenty of attackers would be content to rsync all your files to their server for further examination/exploitation.

benwerd• 15 years ago

Not that I'm a conspiracy theorist, but is it a coincidence that Skype's been in acquisition talks lately?

Also, can someone please create a viable Skype alternative that actually works?

joeguilmette3• 15 years ago

Gmail in the browser is, in my experience, better than Skype. The voice and video chat worked flawlessly from San Francisco to the Philippines where under the exact same circumstances Skype stuttered and failed for video conferencing.

Also - Gmail in the browser is integrated with Google Voice and Google Chat, so you don't have to suffer through Skype's client just to chat. And in fact you can continue chatting over your phone through SMS (for free) because Google Voice is awesome.

moe2• 15 years ago

Hunting down browser tabs or detached browser windows is not my idea of a good chat user interface.

RandallBrown• 15 years ago

I wonder if you need to accept the attachment or if just sending it is good enough.

If you have to accept it, then who cares, don't accept attachments from strangers.

code_duck6• 15 years ago

There's no indication that a file transfer is involved, only 'an instant message'.

You can set your Skype to disallow messages from accounts not in your contact list. I've had trouble with this not working in some way on Skype for Linux, though.

pudquick• 15 years ago

Given that there is a known issue with the current version of Skype (5.x) for Mac where if you have your language set to something odd, it'll render the Skype chat windows in raw HTML tags ... I'm thinking the exploit is unescaped HTML/Javascript, combined with the ability to launch local code.

If you read the original post from the hack team in question, they stated the ability to at least get a local shell running as a result, so either there's something resulting in launching local file content (like an interpreter, then passing commands to it) or something able to crash Skype in an interesting and controllable way.

Given that the original authors also stated that when he tested this on his GF, she was unable to use Skype for awhile - I have a feeling it's chat related, was stored in the client chat logs, and was re-launching / re-executing whenever Skype was being opened.

jarin• 15 years ago

I hope while they're fixing this they can fix the terrible, terrible, UI bug introduced in Skype 5 for Mac.

sdbryan• 15 years ago

Why is this tabloid journalism featured in HN? Nowhere in the article is there any indication how root access could be obtained. There should be at least some description how privilege escalation could occur. I don't want arbitrary code executing but that is a long way from root access. Even for shell access the attacker needs the user's name and password. Does the target just offer them?

nbpoole5• 15 years ago

You don't need a username and password for shell access if the application has a vulnerability that allows for arbitrary code execution. Your code just executes as the same user as the application. To elevate your privileges, you would need to use a separate vulnerability once you have shell access.

thought_alarm• 15 years ago

No mention or actual "root" access, just "shell" access under the user's account. While that's still bad, obviously, on its own it's certainly not "wormable", as the article suggests.

More hysterical reporting from The Register.

morganpyne2• 15 years ago

I agree it's hugely light on technical details. But, if the exploit gains shell access to you own account, and the exploit can occur via simple message sending in Skype, and it is possible to script Skype from the command line (Applescript perhaps?) then I can't see why an appropriately crafted exploit couldn't message all your skype contacts once you get infected. This would spread rather fast :-)

code_duck6• 15 years ago

I don't agree that gaining control of the user account is that much smaller of a concern then root access. You can do a lot on a Mac with just the user account. And then, local exploits providing privilege escalation are relatively common.

cosmicray• 15 years ago

How many Mac owners do you think run their admin account as the personal account. I bet more than a few don't bother with the distinction between user and admin.

bradleyland4• 15 years ago

I contacted the author asking him to verify the claim of "root" access, since it makes a difference to those of who know what that is. He replied with an apology and updated the headline.

udp• 15 years ago

Maybe someone should change the title here here, too, then.

ffffruit• 15 years ago

This is a conspiracy from Skype to make us upgrade to the latest version of the Mac client.

dotBen2• 15 years ago

It may be that the exploit isn't previous version.

The current version appears to have been built by the most moronic team of developers ever who knows what crap made its way into the new client.

bodhi• 15 years ago

In case you weren't joking, it seems the bug only affected the new version:

> reported what they believed to be a zero-day vulnerability in Skype for Mac 5.x

Of course, that doesn't rule out other security holes in 2.8.x.

bradleyland4• 15 years ago

Looks like it has been addressed:

http://blogs.skype.com/security/2011/05/security_vulnerabili...

I submitted here as well:

http://news.ycombinator.com/item?id=2522808

mikeryan• 15 years ago

I just ran "Check For Updates" and it told me I was up to date and I'm on 5.1.0.914.

So something is not working there.

dotBen2• 15 years ago

I get same.

Sometimes companies release minor updates that are reflected for fresh downloads but don't have the auto-update mechanisms in existing clients to download the update --- usually to save on bandwidth costs.

However, for a security patch that seems 'unfortunate'.

moeffju• 15 years ago

My guess is that this is related to the Webkit component Skype 5 on Mac is using for the IM window. So Skype 2/Mac should be safe, as are all other OSes.

Also, it's obviously not "root" unless there's a separate privilege escalation bug in OS X.

loganlinn• 15 years ago

I've been looking for a good reason to convince my team to switch from Skype...

Skype bug gives attackers root access to Mac OS X

Related Stories