If you use Skype on an iPhone or iPod touch, Phil Purviance can steal your device's address book simply by sending you a chat message.
“I'm going to send a user on an iPhone a message, and when he sees the message, the exploit will run,” the narrator says. “When the exploit code is run, the victim's iPhone will automatically make a new connection to my server to grab a larger payload instructing the victim's iPhone to upload its entire address book file to the server.”
The other lapse making Purviance's attack possible was the decision by iOS developers to make the file storing address-book contents accessible to every app installed, including Skype. That means all that's required to steal a full list of contacts is to find and exploit a vulnerability in a single program installed on a victim's device.
In a Web 2.0 kind of world, contacts for many people aren't exactly closely guarded secrets. For many others – say, attorneys and people who work with survivors of domestic abuse – the names, addresses and phone numbers of contacts are sensitive information.
It's already been 48 hours since this vulnerability was first documented, and the vulnerable app is still available in the iTunes Store. It will be interesting to see how long it takes Apple and Skype to close the gaping hole. ®