Skype Still Stonewalls About Security Holes

Want to make a network security specialist cringe? Tell him Skype is rife on the network. The VoIP software has myriad security holes that bedevil enterprise networks. Skype has refused to admit them -- and now it appears that rather than confronting them directly, it's rolling out a PR campaign to deny their existence. One of the biggest security complaints about Skype is its stealthiness -- it's tough for network administrators to even know it's being used. And if they don't know it's being used, how can they protect against it?

Skype, in its new PR campaign, is applying some twisted logic to the reason for that stealthiness. Kurt Sauer, Skype's Chief Security Office, told Techworld that "One of the reasons Skype is difficult to find is that the people who provide the carrier services [ISPs and telcos] are in competition with Skype."

He said that if Skype could be found easily, the carriers would block it or degrade it.

Even if that were the case -- and it's not -- making Skype invisible isn't the best way to solve the problem. The real reason it's so stealthy is most likely that if it could be found easily, network security folks would kick it off networks, and Skype would lose users.

In addition, it's well-known that Skype has a variety of security holes on its own. The company patches the software, but if network security folks don't know Skype exists on the network, how can they know to make sure that patches are applied?Sauer told Techworld that the company has recognized that it's been slow to act on security problems. But the solution the company is taking seems to be a PR blitz rather than taking any real steps.

For example, he said that the company will create security guides to help companies know how to deploy it securely -- but then gave no timeframe for when the guides would be available.

Skype needs to do more than talk about security. If it doesn't, expect users to migrate elsewhere. Free or near-free VoIP services are popping up all over, and it doesn't have the field to itself any more.