It is being reported that Skype has fallen victim of a security flaw that can allow attackers to gain system-level privileges to vulnerable computers, Microsoft has confirmed. However, the company won’t immediately fix the issue because doing so would require a complete code overhaul. Jim DelGrosso, Senior Principal Consultant at Synopsys commented below.
Jim DelGrosso, Senior Principal Consultant at Synopsys:
“Although the details are still a bit unclear, Microsoft’s reluctance to fix the issue suggests that this is a flaw in the architecture or design of the software rather than a simple or even complex bug in the code. This highlights an important distinction that often gets overlooked. Bugs, which can often be identified with automated tools or manual code review, are discrete coding mistakes that can be addressed by modifying the affected parts of the code. Flaws are defects in the architecture or design of a software system and may require extensive reconstruction to mitigate the risk. This also highlights the importance of secure architecture and design at the outset of a software development project. It requires some effort and expertise on the front end, but it can avoid expensive or seemingly futile remediation efforts in the long run.”
