Serious XSS vulnerability found in Skype for iOS
updated 07:25 pm EDT, Tue September 20, 2011
Users' address books could be copied
A security researcher going by "Phil P" and running the Superevr security blog has found a serious scripting vulnerability in the chat messaging feature of Skype versions 3.01 and earlier for the iPhone and iPod Touch that could execute malicious Javascript code without the user being fully aware, giving the attacker access to file contents of any file that the Skype app would have access to -- such as a user's address book.
The flaw comes as a result of the Skype program failing to properly encode the incoming users' "Full Name" field, which means Javascript code can easily be placed in that field instead. The victim still receives a message from the attacking user, but with the name replaced by the first characters of the code string.
This flaw alone would not by itself cause an issue except that Skype also improperly allows the URI scheme used by the built-in WebKit browser in Skype to use the "file://" URL header, gaining access to the file system under Skype's own permissions, which includes access to the iOS contact list. In the video below, Phil demonstrates the delivery of a Base-64 encoded JavaScript file (which is then decoded by the attacker's server) and run to copy the device's contact list back to the attacking server (in SQLite format).
Apple's built-in iOS application sandboxing prevents the attack from going anywhere beyond those files that Skype has access to. Skype on iOS is set by default to only allow existing contacts to chat with a user, which would largely prevent the possibility of such an attack being seen "in the wild"; but if the "established contacts only" feature is turned off, it opens up the possibility of random chatters executing a malicious JavaScript on iOS devices. As the attack is executed over http, a firewall or blocking ports would not prevent the attack.
This new vulnerability echoes a similar problem found in May by security researcher Guy Maddern, who discovered a way to execute a malicious payload in chat mode using Skype for Mac computers (version 5.x). The company at the time said the issue, which allowed attackers the chance at gaining full privileges for the compromised machine, had been discovered and fixed by the time reports appeared on it.
Attacking message is received using JS code in Full Name field
JavaScript attack executes
Fresh-Faced Recruit
Joined: Sep 2010
comment title
That's the problem with any security, at some point you have to trust something (in this case Skypes access to your contacts) and that's where the vulnerabilities come in. Hopefully Skype will address the issue quickly.