Ban corporate Skype immediately

[Vox Populi Vox Dei]

http://biz.yahoo.com/prnews/051110/to217.html?.v=15

Technology industry analyst firm Info- Tech Research Group (www.infotech.com) is telling enterprises to ban Skype - the freely-available Voice over Internet Protocol (VoIP) phone service - from their organizations.

"Companies that are already banning peer-to-peer applications, such as instant messaging, should add Skype to its list of unsanctioned software programs," says Info-Tech analyst Ross Armstrong.

"Approximately 17 million registered Skype users are using the service for business purposes," says Armstrong. "Unless an organization specifies instances where Skype use is acceptable, and outlines rules for client-side Skype settings, that's 17 million opportunities for a hacker to invade a corporate network."

In a research note prepared for Info-Tech Research Group members, Armstrong outlines five reasons for an enterprise to ban Skype:

- Skype is not standards-compliant, allowing it and any vulnerability to
pass through corporate firewalls.
- Skype's encryption is closed source and prone to man-in-the-middle
attacks. There are also some unanswered questions about how well the
keys are managed.
- Enterprises using Skype risk a communication barrier with countries
and institutions that have already banned the service.
- Skype is undetectable, untraceable, and unauditable, putting
organizations that are subject to compliance laws at risk.
- The question of whether VoIP calls constitute a business record is a
legal quagmire. Throwing Skype into the communications mix further
clouds the issue.

Comments Armstrong, "The bottom line is that even a mediocre hacker could take advantage of a Skype vulnerability. If you are going to use Skype within enterprise, manage it as you would any other IT service: with policy and diligence."

 

[sunsoffun]

Interesting article. And there I though that this was Telkom taking a bit of a knock on their phone call business.

 

[RichardP]

The research was most probably commisioned by CISCO 'cos its hurting their SIP product sales. I think these people should speak to MTN on how to track Skype (as MTN clain they bill differently for VOIP)

 

[Sneeky]

When Info- Tech Research Group starts advising everyone that Skype is more of a potential problem than Internet Explorer already is, I will take note, otherwise it's just double talk.

A very valid point

 

[Turtle]

When Info- Tech Research Group starts advising everyone that Skype is more of a potential problem than Internet Explorer already is, I will take note, otherwise it's just double talk.

Exactly! If a corporation is really all that worried about having their corporate network hacked, then they should in fact ditch Windows outright (honestly ... Windows really is still the "swiss cheese" of operating systems in spite of all the "we're embracing security" PR/action from Microsoft), or at the very least, Outlook, IE and Word. This piece of "news" is obviously one of those "paid-for" bits of FUD/propaganda by (I think) the big telcos.

They mention that Skype is prone to man-in-the-middle attacks. Even if this is true, the only danger here is that someone (and almost certainly, in practice, only someone within your organisation or the called organisation) may be able to listen in on a phone call. But here's the stupid part: That danger is already present and highly exploitable on your 'plain old' telephone network, if not more so (and there isn't end-to-end encryption there ... if you're in an office or even some townhouse complexes, chances are there are dozens of other peoples phone lines available for easy listening right in your wall/conduit). It's especially easy for 'inside jobs', but the bugging of companies' phone lines by e.g. competitors is also surprisingly common. So they are suggesting corporations ditch Skype in favour of an even less secure existing voice communications medium.

Fortunately, I think even with FUD like this, although some dumb managers might fall for it, VOIP is unstoppable, because there is just so much $$$ to be saved.

 

[kilps]

This piece of "news" is obviously one of those "paid-for" bits of FUD/propaganda by (I think) the big telcos.

I agree there - it was too negetive

 

[lukev]

Just sounds like a company-comissioned study to curb Skype's growing market share. What a load of bollockses - why don't they compete the old-fashioned way by bringing out a better product.

 

[RichardP]

I love one of the reasons "Skype does not use industry standard protocols" ... no protocol is standard until its accepted and implemented by more than 1 other software vendors. me thinks its a case of sour grapes.