Skype: responds to report of security hole

Skype Profile info left vulnerable to malicious applications

Skype on Friday issued a public response to a security issue uncovered recently that leaves some profile and message information open and vulnerable to malicious applications. Uncovered by Android Police, the vulnerability deals with the way the Skype Android application stores some personal information, making your profile information -- and your Skype contacts' profile information (among other bits of Skype data) -- easily found and scraped by any application that wants to. Skype, on its blog, has said:

It has been brought to our attention that, were you to install a malicious third-party application onto your Android device, then it could access the locally stored Skype for Android files.

These files include cached profile information and instant messages. We take your privacy very seriously and are working quickly to protect you from this vulnerability, including securing the file permissions on the Skype for Android application.

To protect your personal information, we advise users to take care in selecting which applications to download and install onto their device.

That's a fairly serious hole, and it's good that it was discovered, reported and is being fixed. So have you been in any danger all this time? Possibly, but you would have had to have installed a malicious application that knew to run this exploit in the first place. Chances of that are fairly low, but not out of the question. And it's important to remember that we're talking about Skype data, not the full contacts list on your phone. That doesn't mean it's not a gaping hole that needs to be closed; but neither are we worried about the sky falling. Be careful what you download, folks. [Skype, Android Police]

SOURCE

Google preps Android for its corporate interview

With over 300,000 devices activated per day, Android's clearly firing on all cylinders from a consumer standpoint, but much like the famed Cheez-It wheel, some would argue that the OS isn't quite mature enough for unabashed enterprise use. 

Being a corporation itself, El Goog's obviously been toiling around the clock to change that, and it's taking three major strides today. An updated version of its Google Apps Device Policy enables employees to secure a lost or stolen Android 2.2+ device by locating it on a map, ringing the device, and resetting the device PIN or password remotely via the new My Devices website. Furthermore, Apps admins now have an option in the control panel to "Encrypt Data on Device," which will now include requiring encrypted storage on Android 3.0 tablets. Finally, Google Apps Lookup is acting as a type of internal blackbook, allowing users to easily sift through colleagues and contact them through one form or another. So... hired?

The Inquirer, Google Apps (1), (2) Official Google Enterprise Blog