![](\"https:\/\/1.bp.blogspot.com\/-lK_gxcxu7xQ\/WoQEHgw1sjI\/AAAAAAAAvyI\/Gw-cBPy8z98ShJFmuz9aewOwYG7zxuanQCLcBGAs\/s1600-e20\/skype-hacking.png\" "\\"Microsoft")
<\/p>\n<\/p>\n
\nA serious vulnerability has been discovered in Microsoft-owned most popular free web messaging and voice calling service Skype that could potentially allow attackers to gain full control of the host machine by granting system-level privileges to a local, unprivileged user.\n<\/p>\n
\nThe worst part is that this vulnerability will not be patched by Microsoft anytime soon.\n<\/p>\n
\nIt’s not because the flaw is unpatchable, but because fixing the vulnerability requires a significant software rewrite, which indicates that the company will need to issue an all-new version of Skype rather than just a patch.\n<\/p>\n
\nThe vulnerability has been <\/p>\n
discovered<\/a><\/p>\n and reported to Microsoft by security researcher Stefan Kanthak and resides in Skype’s update installer, which is susceptible to Dynamic Link Libraries (DLL) hijacking.\n<\/p>\n \nAccording to the researcher, a potential attacker could exploit the “functionality of the Windows DLL loader where the process loading the DLL searches for the DLL to be loaded first in the same directory in which the process binary resides and then in other directories.”\n<\/p>\n \nThe exploitation of this preferential search order would allow the attacker to hijack the update process by downloading and placing a malicious version of a DLL file into a temporary folder of a Windows PC and renaming it to match a legitimate DLL that can be modified by an unprivileged user without having any special account privileges.\n<\/p>\n \nWhen Skype’s update installer tries to find the relevant DLL file, it will find the malicious DLL first, and thereby will install the malicious code.\n<\/p>\n \nAlthough Kanthak demonstrated the attack using the Windows version of Skype, he believes the same DLL hijacking method could also work against other operating systems, including Skype versions for macOS and Linux.\n<\/p>\n \nKanthak informed Microsoft of the Skype vulnerability back in September, but the company told him that the patch would require the Skype update installer go through “a large code revision,” Kanthak <\/p>\n told<\/a><\/p>\n ZDNet.\n<\/p>\n \nSo rather than releasing a security update, Microsoft decided to build an altogether new version of the Skype client that would address the vulnerability.\n<\/p>\n \nIt should be noted that this vulnerability only affects the Skype for the desktop app, which uses its update installer which is vulnerable to the DLL hijacking technique. The Universal Windows Platform (UWP) app version available from the Microsoft Store for Windows 10 PCs is not affected.\n<\/p>\n \nThe vulnerability has been rated as “medium” in severity, but Kanthak said, “the attack could be easily weaponized.” He gave two examples, which have not been released yet.<\/p><\/blockquote>\n \nUntil the company issues an all-new version of Skype client, users are advised to exercise caution and avoid clicking on attachments provided in an email. Also, make sure you run appropriate and updated anti-virus software that offers some defence against such attacks.\n<\/p>\n \nThis is not the first time Skype has been dealing with a severe security flaw. In June 2017, a <\/p>\n critical flaw in Skype<\/a><\/p>\n was revealed before Microsoft released a fix for the issue that allowed hackers to crash systems and execute malicious code in them.\n<\/p>\n \nLast month, among several messaging applications, Skype was also dealing with a critical remote code execution <\/p>\n vulnerability in Electron<\/a><\/p>\n \u2014a popular web application framework widely-used in desktop applications.<\/p>\n<\/div>\n<\/div>\n