We don’t know what those “security issues” are?

We don’t know, for instance:

• Are they related to the remote exploit that was publicly disclosed on Friday? Or to related attacks on the same theme? (as discussed on SecNiche today)
  
  
• What is the severity of these “security issues”? Remote compromise? Denial of service? What?
  
  
• What is the priority that we should place on getting this update in place? Is it a “UPDATE NOW!” kind of priority? or a “Update when you can”?
  
  
• What kind of mitigating circumstances are there for these security fixes?
  
  
• Are there any workarounds that could be put in place at a network layer (or any other layer) to prevent attacks on individual systems? (i.e. as a safety measure until the individual clients are all updated?)

We need to know this kind of information.

Particularly as Skype looks to try to move more into the “business” or “enterprise” market space, this level of NON-disclosure is unacceptable.

In comparison, take a look at any of the recent Microsoft security bulletins, like, oh, this one, and you can see the kind of information that…

Tonight Skype published a blog post saying that back on April 14th they released a “hotfix” for this problem in Skype for Mac version 5.1.0.922. That’s great… it’s good that the fix is out there, but…

how were we Mac users supposed to know about it?

Hmmm… let’s see… Could we find out about the Skype for Mac hotfix…

• … using the “Check for Updates” feature? Nope, doesn’t work for me. Maybe it works for others out there, but not for me.
  
  
• … from the Skype for Mac Release Notes page? Nope, that page STILL hasn’t been updated, three weeks later, to indicate that a new version is out. Nothing on there at all about 5.1.0.922.
  
  
• … from Skype’s Twitter account? Nope, no mention of a hotfix back on April 15th, although they did talk about the fact that Skype was mentioned twice on 30 Rock and that there was Skype call on the Rachael Ray show.
  
  
• … from Skype’s skypesecurity Twitter account? Nope, no mention.
  
  
• … on Skype’s Mac blog? Nope. Last post there was April…

Separately, Skype PR indicated to me that version 2.8 is not vulnerable – although I note that this information is not in Skype’s security blog post. (Skype has now confirmed in a tweet that Skype 2.x is not vulnerable.)

It’s great that Skype claims they fixed this in mid-April… but if they didn’t tell anyone – including, apparently, the security researcher who reported the issue – what value is it that they fixed the issue?

I have a longer piece that I need to write on this… but I’ll leave that for another post.

Meanwhile, we finally do have some information and a fix – many hours after it would have been helpful to have had it.

The original post remains below… From the Can-We-Please-Communicate-Better Department… there is apparently an open vulnerability in the Skype for Mac client that lets an attacker send a message to a Skype user and gain remote access. As reported…