This is interesting.
March 06, 2007 (Computerworld) -- There's been a lot information --- and misinformation --- available about whether Skype is dangerous to corporate networks and individual users. How dangerous is it? In this article, I'll separate the truth from the myths when it comes to Skype vulnerabilities.
http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9012239Skype is a peer-to-peer (P2P) application, meaning that users connect to one another directly and not through a central server for communication. Skype initially uses Internet-based servers to authenticate users when they log in and to track their status, but when a "chat" or IM, "voice call" or "file transfer" is initiated, the parties involved in the communication do so in a P2P direct connection. If one or both of the users are behind a typical enterprise Network Address Translation (NAT) firewall, the communication can be relayed through a SuperNode because a direct P2P can't be established behind a NAT. In the case of a file transfers, you will see a message indicating your transfer is being relayed.
One of security professionals' primary concerns about Skype is it's so easy for a Skype client to find a way around a secure enterprise firewall configuration. Skype does this by using ports 80 and 443, which are open in most firewalls to allow Web browsing. In addition, Skype may reroute traffic if the initial port assigned during the Skype installation isn't available. This makes blocking Skype at a firewall more difficult since the ports Skype uses can change as needed.
Skype also encrypts each communication with a unique AES 25-bit encryption key, meaning each communication will use a different key each time you communicate, making eavesdropping communications almost impossible.
One more thing to keep in mind about Skype security are its SuperNodes, which route Skype traffic. A SuperNode is a computer with a specific configuration that must have a direct connection to the Internet and can't be behind a firewall using NAT. And they must have a 'real' public routable IP address. Beyond those restrictions, these SuperNodes can be any Skype user computer that meets the minimum hardware and configuration requirements.
