How to remediate – Skype Detection

1. Introduction

Skype Detection identifies instances where the Skype Voice-Over-IP service is running on a network. This matters because Skype’s peer-to-peer architecture can consume significant bandwidth, potentially impacting network performance and conflicting with corporate security policies. Systems typically affected are Windows desktops and servers running the Skype application. A successful exploitation could lead to high bandwidth usage, affecting confidentiality, integrity, and availability of network resources.

2. Technical Explanation

Skype runs as a peer-to-peer application, establishing direct connections between users. This means it doesn’t rely solely on central servers for communication, but uses ports to facilitate these connections. An attacker could exploit this by initiating numerous Skype connections to consume network resources or potentially intercept traffic if not properly secured. There is no specific CVE associated with simply *running* Skype; the risk lies in its configuration and usage.

• Root cause: The peer-to-peer nature of the application allows for direct connections, bypassing traditional firewall controls.
• Exploit mechanism: An attacker could initiate multiple connections to a Skype instance, causing denial of service through bandwidth exhaustion.
• Scope: Windows desktops and servers running the Skype client are affected. Older versions may have additional vulnerabilities related to authentication or encryption.

3. Detection and Assessment

You can confirm if Skype is running by checking for open ports associated with the service, or examining installed applications. A thorough method involves network traffic analysis.

• Quick checks: Use netstat -ano | findstr ":5349" to check for listening ports commonly used by Skype.
• Scanning: Nessus plugin ID 27861 can detect the presence of Skype, but results should be verified.
• Logs and evidence: Check application logs in C:UsersAppDataLocalSkype for running instances and connection activity.

netstat -ano | findstr ":5349"

4. Solution / Remediation Steps

If Skype is not required, disable or uninstall it. Filtering ports alone isn’t sufficient due to its ability to establish outgoing connections.

4.1 Preparation

• Ensure users have alternative communication methods if Skype is being removed. A roll back plan involves reinstalling the application from a trusted source.
• Change windows may be needed for widespread deployments, requiring approval from IT management.

4.2 Implementation

1. Step 1: Uninstall Skype through Control Panel > Programs and Features.
2. Step 2: Verify the uninstallation by checking the Programs and Features list again.
3. Step 3: Delete any remaining Skype folders in C:UsersAppDataLocal if present.

4.3 Config or Code Example

Before

Skype application installed in Programs and Features list

After

Skype application removed from Programs and Features list. No Skype folders present in user AppDataLocal directory.

4.4 Security Practices Relevant to This Vulnerability

Practices that directly address this vulnerability include least privilege, and a robust patch cadence.

• Practice 1: Least privilege – Restricting application installation rights reduces the potential for unauthorized software like Skype being installed.
• Practice 2: Patch cadence – Regularly updating systems helps mitigate vulnerabilities in applications if they are allowed to run.

4.5 Automation (Optional)

# PowerShell example - remove Skype using uninstall string from registry
Get-ItemProperty HKLM:SOFTWAREMicrosoftWindowsCurrentVersionUninstall* | Where-Object {$_.DisplayName -eq "Skype"} | ForEach-Object {
  Start-Process -FilePath $_.UninstallString -ArgumentList "/S" -Wait # /S for silent uninstall, check application documentation
}

5. Verification / Validation

Confirm the fix by checking for the absence of Skype in installed programs and verifying no related processes are running.

• Post-fix check: Run wmic product get name | findstr "Skype", expecting no output.
• Re-test: Re-run the earlier netstat -ano | findstr ":5349" command; it should not show any listening Skype ports.
• Smoke test: Verify that other communication tools (e.g., Microsoft Teams) are functioning as expected.
• Monitoring: Check application logs for any attempts to install or run Skype, alerting on unexpected entries.

wmic product get name | findstr "Skype"

6. Preventive Measures and Monitoring

Update security baselines to disallow unauthorized software installations. Implement application control policies.

• Baselines: Update a security baseline or policy (for example, CIS control 5) to prevent the installation of unapproved applications like Skype.
• Asset and patch process: Review application installations regularly as part of a vulnerability management program.

7. Risks, Side Effects, and Roll Back

Uninstalling Skype may disrupt communication for users who rely on it. Ensure alternative solutions are available.

• Risk or side effect 1: Disruption to user workflows if Skype is unexpectedly removed. Mitigation: Communicate changes in advance and provide alternatives.
• Roll back: Reinstall Skype from a trusted source using the original installation media or download link.

8. References and Resources

• Vendor advisory or bulletin: Skype Support
• NVD or CVE entry: Not applicable – running Skype is not a specific vulnerability, but configuration issues may be.
• Product or platform documentation relevant to the fix: Microsoft Skype Download Page