3

First of all, please don't shout at me for wanting to use Skype. I know that it's evil and I fully expect all the calls and text chats going through it to be stored permanently in govt data centers, but let's pretend we don't care about that.

Assuming one installs it on Linux (if there's still a binary available), is it likely that it could spy on other applications, intercept the network traffic or scan personal files (in other words, act like spyware)?

Or maybe it's even possible for an attacker to execute random code on my computer (inject malware)?

I know that it's closed-source software, so we can't look at the source and know for sure, but maybe someone has run some tests, trying to figure out what Skype does in the background.

Edit, clarification (hopefully)

  • I have used the (strong) words "spyware" and "malware" and it seems the way I wrote my question is causing a "Skype is not a virus" kind of reaction. This is of course true and I'd probably give a similar answer to a "is it a virus, yes or no" question, but that's not my actual question. Rather than a personal estimate, I'd like to know if there is reason to believe that Skype might, for instance, scan all my files for keywords and send those to some lovely security organization (either on purpose or by accident, because of a bug - however not one that requires my interaction). Again, "reason to believe" is not based on what you think of Microsoft, but by evidence or at least suspicious findings.
  • Skype would usually be running as my user (i.e., called by ~/.config/autostart/Skype.desktop) so it can read all my files, just like any other program I (same user) run. I don't see why it would need root privileges to read things owned by my user, (u+r set, of course). "All my files" means all (regular) files under / that my user has read access to (think personal files, not /var/log/messages).
  • As for vulnerabilities in previous versions - almost all programs have bugs and some are critical. However I'm not interested in bugs that require my interaction (say, I have to place a malicious library file somewhere).
Improve this question

3 Answers 3

Reset to default
2

Any application can be compromised. It is unlikely that Microsoft would infect its customers computers, but it is not impossible. There was a big case many years ago where Sony installed root-kits on people's computers. It is also possible that their could be a vulnerability in Skype (which there have been in the past) which a third party could utilize. A desktop application runs with whatever privileges are granted to the user under which its run. If you run it as root or Administrator privileges, then a malicious method or vulnerability could lead to interception of data or execution of unauthorized code.

In most cases, you have some level of defense with firewalls, host-based intrusion detection, network intrusion detection, or antivirus at the operating system level.

Whether an application is open source or not does not really impact is security or openness. An open source application is easier to analyze and critique, but if no one is looking for security issues or writing the patches, then its not magically more secure or less evil.

Improve this answer
2
  • "If you run it as root or Administrator privileges, then a malicious method or vulnerability could lead to interception of data or execution of unauthorized code." Why would such a buggy program have to be run as root in order to execute unauthorized code? But it usually won't be able to break system configuration without root privileges. A firewall usually won't prevent a program from reading local files. Also I don't have an IDS, iptables is enough network protection for me.
    – basic6
    May 5, 2014 at 19:09
  • I seem to remember Skype actively punches holes in your firewall. Which of course is a bad thing in itself. (Note that I'm talking about the real firewall outside your desktop computer, not some utility within the local OS misusing the term.)
    – Christopher Creutzig
    May 5, 2014 at 20:42
1

First of all I don't think you can call skype a malware! Now it officially belongs to Microsoft and it's not imaginable that Microsoft will try to "infect" your computer or would publish a malware in their code, something extra-ordinary to what Skype intended to do, it's not really something Microsoft would do.

In addition to that, your Skype application, as long as it doesn't run as root (which is not recommended for most of apps) wouldn't be able to do much damage to your Linux and won't be able to extract a lot of sensitive information.

Also if you are worried about Skype malware or something, you can run your Linux and have a virtual machine with Any OS which runs Skype in it, they use that machine for these type of activities which "you think" is dangerous.

Also you can encrypt all your sensitive data with free application like Truecrypt and only unlock them in a clean OS and use them.

Overall, I think calling Skype "evil", "malware", "all your data goes to gov. data centers" is not true, it's my opinion.

Also Skype could be closed source (like a lot of apps you use), but a lot of reverse engineers already took a look at it, if there was some codes which had hidden intentions, it would've been discovered. It does a lot of anti-debugging techniques, that's right, but still you can analyze it.

Improve this answer
3
  • I didn't call Skype malware, I asked if there's reason to believe it's used (not necessarily by MS) to inject malware. Of course I wouldn't run it as root, but saying it "won't be able to extract a lot of sensitive information" (without explanation) is just a wrong statement as it will have the same privileges as any other program run by me so it can read all my files (sensitive information). Is saying "all your data goes to gov datacenters" still a matter of opinion, since Snowden? Who can decrypt recorded Skype traffic would be more interesting. Thanks for the link though, I'll read that.
    – basic6
    May 5, 2014 at 18:59
  • 1
    1) Your Skype data/traffic would go to Skype/Microsoft servers, but still gov. will need authorization to access them, also it will be your Skype traffic, not your TXT file in your desktop 2) Skype won't access files in your computer, you can run a filemon for several hours/years and watch it. Even thought Skype is closed-source and encrypted, reverse engineers would've detected something unusual from it, nothing yet, not a single example yet. When I said "wont be able to extract sensitive info" I meant encrypted or your private files, with or without Skype you have to encrypt to keep them.
    – 72DFBF5B A0DF5BE9
    May 5, 2014 at 20:40
  • 1
    About bugs in software, I can tell you, it's not "Skype" related, it's general and might apply to ALL services you run in Linux, even some of them might run with higher privileges than your normal user. So it's not related to your question, your HTTP/IMAP/DNS/NFS etc. could have vulnerability worse than Skype, so it doesn't relate
    – 72DFBF5B A0DF5BE9
    May 5, 2014 at 20:45
0

I'm an expert on this particular issue and I can assure you that No, you do NOT need to worry about Skype compromising the security of your computer. Skype should be the LEAST of your worries.

The most important thing to remember for the security of your computer is: Don't open any file attached to an email UNTIL you have verified who it came from, you know why they sent it to you, and that the file has the correct file name extension for the type of file it is supposed to be.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .