Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

From the following article skype & from archlinux skype wiki some major skype insecurity in linux are:

  • The skype binary is disguised against decompiling, so nobody is (still) able to reproduce what it really does.
  • It produces encrypted traffic even when you are not actively using Skype.

I have founded some solutions, including making a skype group, skype user and running form terminal with command line:

    xhost +local: && sudo -u skype /usr/bin/skype'

Some questions, is there any insecurity if I install skype from my main user account? Or does it has to be installed from the created skype user to prevent?

Is not installing skype a better option than installing skype with a special group & user?

share|improve this question
    
Check this blog: skype-open-source.blogspot.com Also I used to run Skype from a dedicated Virtual Machine. –  jippie Jun 23 '12 at 22:03
add comment

2 Answers 2

Is not installing skype a better option than installing skype with a special group & user?

As always in computer security, not installing something is more secure than installing something.

Whether or not you choose to install skype is a cost-benefit exercise: do you believe that skype is doing something dangerous - and how much are you prepared to accept that it might, versus the benefit of using the service?

This is a decision only you can make - my only comment would be that just because Skype is obfuscated, doesn't mean it is malware. Moreover, you're trusting a huge number of other packages on the system as it is.

Now, onto some technical observations. Whilst it is certainly possible for an engineer to obfuscate the machine code in their executable, it is much harder to compensate for the fact that the binary must make system calls to the kernel to get things done. This means that you can analyse these calls, and look into them. As I understand it, skype resists ptrace (and so strace), but you could easily build a LKM hooking the system calls you wish to dump - that Skype cannot stop. From there, you could audit exactly which files skype open()'d, and so on. I've never done it - and there'd be a fair amount of coding involved (you'd get all open calls and need to filter for a given set of PIDs), but it isn't impossible.

The next technical observation to make is that the Vanilla skype presentations attached to your first link have documented the process of attempting to remove the copy protection from Skype - so I think it's unfair to say "nobody knows what it does". We have a reasonable understanding, albeit with gaps.

To answer your question - running Skype as a separate user will provide you a level of security against skype evesdropping on your documents under the following caveats:

  • You never hand it elevated privileges.
  • There are no known or unknown security vulnerabilities present anywhere in any executable on your system that skype may run to escalate its privileges or obtain your privileges.

The reason for these should be straightforward - if you run Skype as root, it can do anything. If you have a vulnerability, Skype may be able to exploit it, assuming Skype is malicious.

I've looked at this myself, and personally I suspect that the high level of obfuscation in Skype is used primarily to protect the intellectual property used in Skype - making it difficult to reverse engineer it - rather than to hide anything nefarious. After all, a reputable software vendor distributing nefarious code who is detected risks damaging their reputation considerably.

share|improve this answer
add comment

I use skype under special account too. This way you can be sure that it can not read your personal files.

If you install skype from archlinux repository there is nothing to worry about. You can always download statically compiled skype from official site and run it only under special account.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.