iSkoot disclosure of Skype credentials resolved – new version by Wednesday
April 28th, 2008 by Dan YorkIf you have been following this weekend’s discovery by Dameon Welch-Abernathy, a.k.a. PhoneBoy, of the iSkoot program disclosing Skype usernames and passwords (see also the chronology), you will know that the problem has been fixed and a formal statement from iSkoot would be forthcoming. That statement from iSkoot CEO Mark Jacobstein has now been issued on their blog. The key part related to the vulnerability is this:
A recent build allowed a development/pre-production version of the Symbian client to be downloaded in place of our production version, which did indeed produce the issue Phoneboy reported. We have checked our other platforms (Blackberry, J2ME, Windows Mobile, etc.) and fortunately this issue impacted only Symbian devices. We’ve pulled the development/pre-production build and fixed the bug and will be doing a forced upgrade to every Symbian user no later than Wednesday (4/30).
The folks at iSkoot are definitely to be applauded for their quick response. The incorrect build has been pulled from their site and, as stated, they intend to have a new version out no later than Wednesday. In the meantime, I would personally suggest that iSkoot users on Symbian devices simply stop running the application until the new build has been downloaded.
Good outcome, all in all.
Technorati Tags:
iskoot, skype, voip, voip security, security, skype security, phoneboy
April 28th, 2008 at 9:02 pm
[...] #7, April 28, 2008: As noted here, iSkoot now has issued a formal statement and plan for a [...]
May 7th, 2008 at 3:50 pm
[...] Particular thanks go out to Phone Boy, as well as Andy Abramson, Dan York, Jonathan MacDonald, and Jim Courtney – who not only helped us to identify the issue but also [...]