Skype Gets it in the Neck Again

Silicon.com asks the rhetorical question Is Skype secure enough for businesses? and then answers itself:

Quote:

Analysis: Experts say 'no'

Poor old Skype, anyone would think that its the only VoIP system in the World to which security questions apply. One very poor piece of advice contained in the article:

Quote:

'Use it at your own risk' appears to be the motto among security experts for using Skype within a business. If the majority of use is internal, then alternatives exist such as the voice components of Microsoft Office Communicator or Lotus Sametime. Alternatively, telcos such as BT (the BT Broadband Softphone) and Interoute (iSip) now offer softphone clients that can be used freely between clients, with an obvious charge from breaking out to the PSTN.

I haven't attempted a security analysis of Communicator or Sametime, but from what I've seen the BT Softphone is not a secure alternative. Unlike Skype, it makes no attempt to encrypt the audio stream, or to secure the signalling channel. Although it does at least have secure authentication with the proxy so that others can't log-in as you and spend all of your prepaid credit.

The BT Softphone today is vulnerable to eavesdropping and unwanted call logging with tools like Cain & Abel and Wireshark. So IT managers, don't get comfortable just because you've banned Skype.