Skype accused of leaving Android data vulnerable

VoIP service provider Skype is being accused of leaving users of its Android application vulnerable to attack.

Mobile news blog Android Police is reporting that the Android version of the Skype application is failing properly to lock down databases containing information on calls.

The blog said that data such as contact lists, profile information and instant message logs are being left unencrypted in folders on the handset. The directories could be viewed by users, as well as other applications.

Android Police suggests that, were a malicious application able to infect the device, personal details could be pulled from the Skype data archive and uploaded to an attacking system.

Skype acknowledged the issue in a posting to its official security blog.

"It has been brought to our attention that, were you to install a malicious third-party application onto your Android device, it could access the locally stored Skype for Android files," the company said.

"To protect your personal information, we advise you to take care in selecting which applications to download and install."

According to security experts, the risk from this issue could be very real. Daniel Hoffman, chief mobile security evangelist at Juniper Networks, told V3.co.uk that an attacker gaining access to Skype logs could obtain commonly sent data, such as credentials for financial accounts.

"When you have that account information and you have the name and address, you have everything you need for identity theft and fraud," he said.

The Skype issue may also be indicative of a much larger issue with Android applications. Improperly secured data logs combined with incidents such as the recent Droid Dream malware outbreak could represent major security troubles.

"People are downloading applications that are not securely vetted. You don't know who the developer is and you have no way to analyse it," Hoffman explained.

"When you correlate these events, you see that the time for mobile security and the time for mobile malware really is now."