Close
  • Latest News
  • Big Data and Analytics
  • Cloud
  • Networking
  • Cybersecurity
  • Applications
  • IT Management
  • Storage
  • Sponsored
  • Mobile
  • Small Business
  • Development
  • Database
  • Servers
  • Android
  • Apple
  • Innovation
  • Blogs
  • PC Hardware
  • Reviews
  • Search Engines
  • Virtualization
Read Down
Sign in
Close
Welcome!Log into your account
Forgot your password?
Read Down
Password recovery
Recover your password
Close
Search
Menu
Search
  • Latest News
  • Big Data and Analytics
  • Cloud
  • Networking
  • Cybersecurity
  • Applications
  • IT Management
  • Storage
  • Sponsored
  • Mobile
  • Small Business
  • Development
  • Database
  • Servers
  • Android
  • Apple
  • Innovation
  • Blogs
  • PC Hardware
  • Reviews
  • Search Engines
  • Virtualization
More
    Home Applications
    • Applications
    • Cybersecurity

    Skype-MySpace Combo to Make Convenient, All-in-One Malware Target

    By
    Lisa Vaas
    -
    October 18, 2007
    Share
    Facebook
    Twitter
    Linkedin

      MySpace and Skype are partnering, potentially creating “an IT departments worst security nightmare: a massive, productivity-draining time-waster that opens up firewall ports, also presenting an unidentifiable, secure, secret stream of network traffic on a corporate network,” an Akonix rep wrote in a letter. They make security products for corporate instant messaging, so you can see where the writer is coming from.

      The letter made me laugh—all it lacks are emergency klaxons and chattering skulls—but in fact, the rep wasnt spinning pure hyperbole. Stitching together Skype—the VOIP (voice over IP)/IM service that, according to McAfees count, has been targeted by about a dozen malware programs—with MySpace, which pushes out malware, spyware, music files that arent real music files but actually distribute password-stealing Trojans, and so on, … wow. Could you make it any more convenient for malware writers? I mean, its kind of tough for them now, having to actually write separate attacks for both MySpace and Skype.

      Why, yes, you could make it more convenient. How about this: You could allow MySpace IM users to link their profiles to their new freebie Skype accounts. Oh, wait, thats really happening. But then you could film clips of people using the two together and upload them to YouTube, and then you could sell the clips on eBay and people could pay for them with PayPal or, hey, even Wells Fargo—thats safe, right? And then you could afford to help out those deserving people in Nigeria who are trying to get money out of the country, or maybe you could buy some hot stocks if you get a great tip e-mailed from somebody youve never heard of.

      Seriously, though. Skype and MySpace? Whats particularly ironic about this terrible match is that the announcement came on Oct. 17, the same day that yet another Skype-targeted piece of malware came to light. This one is a password-stealing Trojan posing as a security plug-in for the popular VOIP and IM service. It displays a fake log-in screen thats almost identical to the real thing.

      By McAfees reckoning, that brings the count to about 12 for Skype-targeted nastyware. What happens when you put that track record together with MySpace, which can also be a bit of a cesspool when it comes to serving up malware? There was that MySpace worm in June, for example, that was turning MySpace.com users sites into bots to serve phishing scams and viruses, using “fast flux” to hide its phishing and malware delivery sites behind ever-shifting networks of proxy servers that are next to impossible to track down.

      Mmmm, MySpace. Worms. Skype. Password-stealing Trojans.

      Heres what Dave Marcus at McAfees Avert Labs had to say about this unholy alliance: “One thing that always piques our curiosity is when you have two areas with established malware patterns to them and you merge them … Combine them together and you get … wonderful convergence. Well see what happens with that. Malware writers like convergence. They like to focus on one thing and not three.”

      Ultimately, Marcus told me in a recent conversation, convergence makes malware authors job easier. Thats why they generally write malware for just one or two Windows builds: The world converges on Windows, making it easy for malware authors to concentrate on just writing for Windows.

      Don Montgomery, vice president of marketing for Akonix, called Skype/MySpace “a great deal for consumers and a nightmare for corporations.”

      “Youve got two consumer behemoths doing great things for people at home or younger folks or people who want to be able to talk anywhere in the world for free or little cost. And thats great for the consumer but maybe not for a business,” he said.

      Skype, for its part, has been a bane to many IT departments because of its encryption and architecture, which sets up encrypted connections inside users PCs, cutting a hole through firewalls and blocking IT from seeing inside its traffic. Skype can use one port to set up a connection and another port to complete the stream of traffic. It is possible to block it, though—Ive heard from network administrators whove had no problem blocking the Skype protocol. It can be done through the firewall or through protocol recognition.

      In fact, larger companies often block Skype. Theres just no valid value proposition to the service for them. If employees need encrypted communications, the organization will provide it for them. As far as encrypting traffic so your own IT department cant see it—bad idea. “Thats core to IT security: the ability to view into the stream,” Montgomery said.

      Skypes recent outage showed that business-class users get no extra safeguards. Click here to read more.

      As for free phone calls, they just arent worth the risk. Except, perhaps, if youre a small or midsize business trying to save money on your phone bill. Skype gives smaller businesses the ability to cut the cost of telephony and to break free of phone companies, and you get a pretty decent-quality service, to boot, Montgomery noted.

      “Smaller business embraces it as a cost saver and makes a decision, I believe, that cost savings outweigh security risks and the inability to see whats going through those secure channels,” he said.

      Maybe its time for small businesses to rethink that value proposition. Put Skype and MySpace together and you get multiple areas of risk: 1) security, with MySpace added to the mix and the real risk of malware coming from that source; 2) waste of productivity; 3) regulatory compliance with rules that govern who can talk to whom and what information can be passed when; and 4) added liability for whatever users put up on their MySpace profiles.

      As Dave Marcus put it, this isnt doomsday. But its something that organizations should be educating their user base about. And bear in mind, both Skype and MySpace have huge user bases, so the chances of not having users in your organization is pretty small.

      Another factor is that IM is an up-and-coming vector for malware. McAfee has seen more IM malware in the past year than in the past 10 years combined. Its becoming one of the most popular ways to distribute spam links.

      Make sure your users are aware.

      eWEEK Senior Security Editor Lisa Vaas has written about technology since 1997. She can be reached at [email protected]

      Check out eWEEK.coms Security Center for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at eWEEKs Security Watch blog.

      Lisa Vaas
      Lisa Vaas is News Editor/Operations for eWEEK.com and also serves as editor of the Database topic center. Since 1995, she has also been a Webcast news show anchorperson and a reporter covering the IT industry. She has focused on customer relationship management technology, IT salaries and careers, effects of the H1-B visa on the technology workforce, wireless technology, security, and, most recently, databases and the technologies that touch upon them. Her articles have appeared in eWEEK's print edition, on eWEEK.com, and in the startup IT magazine PC Connection. Prior to becoming a journalist, Vaas experienced an array of eye-opening careers, including driving a cab in Boston, photographing cranky babies in shopping malls, selling cameras, typography and computer training. She stopped a hair short of finishing an M.A. in English at the University of Massachusetts in Boston. She earned a B.S. in Communications from Emerson College. She runs two open-mic reading series in Boston and currently keeps bees in her home in Mashpee, Mass.

      MOST POPULAR ARTICLES

      Android

      Samsung Galaxy XCover Pro: Durability for Tough...

      Chris Preimesberger - December 5, 2020 0
      Have you ever dropped your phone, winced and felt the pain as it hit the sidewalk? Either the screen splintered like a windshield being...
      Read more
      Cloud

      Why Data Security Will Face Even Harsher...

      Chris Preimesberger - December 1, 2020 0
      Who would know more about details of the hacking process than an actual former career hacker? And who wants to understand all they can...
      Read more
      Cybersecurity

      How Veritas Is Shining a Light Into...

      eWEEK EDITORS - September 25, 2020 0
      Protecting data has always been one of the most important tasks in all of IT, yet as more companies become data companies at the...
      Read more
      Big Data and Analytics

      How NVIDIA A100 Station Brings Data Center...

      Zeus Kerravala - November 18, 2020 0
      There’s little debate that graphics processor unit manufacturer NVIDIA is the de facto standard when it comes to providing silicon to power machine learning...
      Read more
      Apple

      Why iPhone 12 Pro Makes Sense for...

      Wayne Rash - November 26, 2020 0
      If you’ve been watching the Apple commercials for the past three weeks, you already know what the company thinks will happen if you buy...
      Read more

      eWeek has the latest technology news and analysis, buying guides, and product reviews for IT professionals and technology buyers. The site’s focus is on innovative solutions and covering in-depth technical content. eWeek stays on the cutting edge of technology news and IT trends through interviews and expert analysis. Gain insight from top innovators and thought leaders in the fields of IT, business, enterprise software, startups, and more.

      Facebook
      Linkedin
      RSS
      Twitter
      Youtube

      Advertisers

      Advertise with TechnologyAdvice on eWeek and our other IT-focused platforms.

      Advertise with Us

      Menu

      • About eWeek
      • Subscribe to our Newsletter
      • Latest News

      Our Brands

      • Privacy Policy
      • Terms
      • About
      • Contact
      • Advertise
      • Sitemap
      • California – Do Not Sell My Information

      Property of TechnologyAdvice.
      © 2021 TechnologyAdvice. All Rights Reserved

      Advertiser Disclosure: Some of the products that appear on this site are from companies from which TechnologyAdvice receives compensation. This compensation may impact how and where products appear on this site including, for example, the order in which they appear. TechnologyAdvice does not include all companies or all types of products available in the marketplace.

      ×