Beware: Skype "Security Center" Scam

I use Skype a lot to chat with friends and business partners outside the US. It's cheap, and the quality is often better than POTS (Plain Old Telephone Service)-based systems. However today, my Skype client almost bit me.


The above message (see screen shot) came in as I was on my normal telephone line and immediately caught my interest.

A Security Center warning? Via a Skype client?

Now, as the founder of a security software company, you'd probably expect me to be immune to social engineering attacks by now, and ultimately, I was. But it took me a few seconds. This is one well-crafted scam, and Skype is becoming so rich with features that for a moment, I wondered if Skype had in fact integrated with the Windows Security Center.

Then, the fog lifted.

A call to Robert Sandilands and the other hard-working guys in our Authentium virus lab confirmed that this social engineering scam and others (including dating offers) are starting to become reasonably prevalent on the Skype service.

Skype users, heed this advice: if you see a "Repair Service" warning come in over Skype, DO NOT click on the links.

According to Eric in the lab, the link takes you to a fake web-scanner complete with animated progress bar and a pretend file tree that will pretend to find spyware/viruses, then try and scare you into handing over your credit card details.

"The link at the bottom of your SKYPE snapshot image leads to a page that does a mock scan of your system (but what it really is just HTML code and java-script displaying several filenames pre-stored in a java-script file, with a progress bar and such, and then displaying number of infections found)..."

"...which then prompts the user to visit another webpage that asks the user to purchase their antispyware solution and prompts the user for shipping and billing information, credit card information, country and state of residence, etc. The page is written to look very professional with privacy statements, etc."

Skype users - please be careful, and please ignore "Security Center" security warnings that appear in the Skype interface - they are scams. And be prepared - we can expect to see a lot more of these Skype-based social engineering attacks in the future.